Spotify – €4,900,000 Fine (Sweden, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Sweden fined Spotify EUR 4.9 million for not giving users enough information about their data. Spotify didn't clearly explain where users' data came from or how it was shared internationally. This case shows that companies must be transparent about data handling.
What happened
Spotify failed to provide users with clear information about the origin and international transfer of their data.
Who was affected
Spotify users who were not given sufficient details about their data's origin and international transfers.
What the authority found
The Swedish Data Protection Authority found Spotify did not comply with user rights to information under GDPR.
Why this matters
This case highlights the importance of transparency in data handling. Companies must ensure users understand how their data is used, especially regarding international transfers.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 5 March 2026.
Processing notes: articles corrected, amount discrepancy, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Swedish Data Protection Authority (DPA) has imposed a fine of EUR 4.9 million on the music streaming provider Spotify. The DPA had launched an investigation after receiving a number of complaints and following a lawsuit filed against Spotify by the Austrian organization 'None of your Business'. In its investigation, the DPA found that Spotify had not sufficiently complied with data subject rights. Spotify failed, for example, to provide data subjects with sufficient information about the origin of their data or international transfers involving their data. Spotify also failed to provide information that was difficult to understand, such as information about technical processes, in the data subjects' native language; rather, such information was only available in English. Spotify has already taken measures to comply with the requirements for the handling of data subject requests. In addition, the DPA classified the identified deficiencies as not very serious.
Related Enforcement Actions (1)
Other enforcement actions involving Spotify in SE
Details
Fine Date
12 June 2023
Authority
Integritetsskyddsmyndigheten
Fine Amount
€4,900,000
About this data
Cite as: Cookie Fines. Spotify - Sweden (2023). Retrieved from cookiefines.eu
Last updated: