> How the Spotify Web API and embedded player work: the sp_t, sp_dc and sp_adid cookies, US data processing, GDPR consent rules and compliance. > > Canonical: https://www.flowconsent.com/en/services/video/spotify-web-api Video # Spotify Web API Preferences · [Official website](https://developer.spotify.com/documentation/web-api) The Spotify Web API and embedded player let websites stream music and display playlists directly on a page. When the player or API is loaded on a public page, it requests Spotify domains that set third party cookies such as sp\_t, sp\_dc, and sp\_adid. These cookies measure usage, keep logged in sessions, and support advertising, so they are not strictly necessary. Their use requires prior consent under the GDPR and the ePrivacy Directive, and data may be processed on US infrastructure. [Block Spotify Web API until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=video) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Video](https://www.flowconsent.com/en/services/video) - Consent Preferences - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers European Union and United States (Spotify is based in Sweden with US infrastructure) Overview ## What does Spotify Web API do? ## What the Spotify Web API is The Spotify Web API is the developer interface that lets websites and applications read catalogue data, manage playlists, and control playback, while the Spotify embed is a ready made iframe player that streams tracks and albums on a page. Many sites use the embedded player to share songs or playlists, and others call the Web API to display rich music content. In both cases the visitor browser connects to Spotify domains, which set cookies and process technical data as the player loads. ## What data and cookies it collects When the embed loads, Spotify sets third party cookies such as sp\_t for anonymous usage analytics, sp\_landing to store the landing page, sp\_dc for device and account continuity for logged in users, and sp\_adid for advertising where applicable. Alongside these cookies, Spotify receives the visitor IP address, browser and device information, the referring page, and playback interactions. For users signed in to Spotify, this activity can be associated with their account, which makes the processing personal data under the GDPR. ## GDPR and ePrivacy implications Because these cookies are written to and read from the visitor device for analytics and advertising rather than strictly necessary functions, Article 5(3) of the ePrivacy Directive requires prior consent. The IP address and account linkage also make the data personal under the GDPR, so you need a lawful basis, clear information, and an entry in your record of processing activities. The embed should therefore never load before the visitor has accepted the relevant cookie category. ## Consent requirements Consent must be obtained before any Spotify domain is contacted, which means the player iframe and the Web API calls have to be blocked until the visitor actively opts in. A recommended pattern is a click to load placeholder that shows a static cover and a play button, loading the real embed only after consent is given. Pre ticked boxes, implied consent from scrolling, and cookie walls do not meet the standard, and consent must be as easy to withdraw as it was to give. ## Data transfers and practical compliance steps Spotify is based in Sweden but uses infrastructure and sub processors in the United States, so document the transfer under the Standard Contractual Clauses and reference Spotify supplementary measures. In practice, gate the embed and the API behind your consent management platform, use a click to load wrapper, and list the Spotify cookies and their durations in your cookie policy. Name Spotify as a recipient, disclose the US processing, and review periodically because cookie names and durations can change. Compliance ## Spotify Web API and the GDPR Spotify Web API is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive) - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) The Spotify embed sets persistent third party cookies (sp\_t, sp\_dc) and an advertising identifier (sp\_adid), links activity to Spotify accounts for logged in users, and sends IP addresses and device data to infrastructure that includes the United States. A DPIA should assess the scale of tracking through embedded players, the combination of analytics and advertising cookies, the international transfer to the US, and retention, together with mitigations such as click to load gating, consent control, and clear cookie disclosure. ### Sample text for your banner > We use the Spotify player to let you listen to music on our site. When you allow it, Spotify places cookies on your device to keep your session, measure usage, and support advertising, and it may receive your IP address and device information. This content loads only after you accept the marketing category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings. Cookies and trackers ## What Spotify Web API sets and contacts - Tracking method Embedded player and Web API with third party cookies - Server location European Union and United States (Spotify is based in Sweden with US infrastructure) - Data transferred outside the EU Embedding the Spotify player or calling the Web API loads Spotify domains operated by Spotify AB and Spotify USA Inc. Although Spotify is headquartered in Sweden, it relies on infrastructure and sub processors in the United States, so personal data such as IP addresses and device identifiers can be transferred there. These transfers are governed by Standard Contractual Clauses and supplementary measures described in the Spotify privacy and data processing terms. ### Cookies set (4) | Name | Type | Duration | Purpose | | ----------- | --------- | -------- | --------------------------------------------------------------------------------------------------------------------------- | | sp\_t | analytics | 1 year | Anonymous usage analytics cookie set by Spotify to measure how the embedded player and content are used. | | sp\_landing | analytics | Session | Stores the landing page so that Spotify can attribute the entry point of the visit. Short lived and used for measurement. | | sp\_dc | marketing | 1 year | Maintains device and account continuity for users who are logged in to Spotify, linking embedded activity to their account. | | sp\_adid | marketing | 1 year | Advertising identifier set where applicable to support advertising and measurement across Spotify services. | ### Third-party domains contacted (4) - `open.spotify.com` - `embed.spotify.com` - `embed-cdn.spotifycdn.com` - `audio-ak.spotifycdn.com` Questions ## Frequently asked questions about Spotify Web API Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does the Spotify embed set? The Spotify player sets third party cookies such as sp\_t for anonymous usage analytics with a lifetime of about one year, sp\_landing to remember the landing page for a short period, sp\_dc for device and account continuity for logged in users for about one year, and sp\_adid for advertising where applicable. The exact set depends on whether the visitor is signed in to Spotify. ### Do I need consent to embed the Spotify player? Yes. The cookies set by the embed are analytics and marketing cookies that are not strictly necessary, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before the player or the Web API contacts Spotify. The simplest compliant approach is a click to load placeholder. ### What is the legal basis for the Spotify Web API? The storage and reading of cookies relies on consent under the ePrivacy Directive, and the subsequent processing of personal data such as IP addresses relies on consent under Article 6(1)(a) of the GDPR. Legitimate interest is generally not available because consent is already required to set the cookies and load the embed. ### Does the Spotify embed transfer data to the United States? Yes. Although Spotify is headquartered in Sweden, it relies on infrastructure and sub processors in the United States, so IP addresses and device data can be transferred there. Document the transfer under the Standard Contractual Clauses and reference Spotify supplementary measures in your privacy notice. ### Do I need a DPIA for the Spotify Web API? A full DPIA is not always mandatory, but it is advisable when you embed Spotify across many pages or combine it with other tracking. Document the purposes, the cookies and their durations, the international transfer, and retention, and apply mitigations such as click to load gating and consent control. ### How do I embed Spotify in a compliant way? Block the player iframe and any Web API calls until the visitor accepts the marketing category in your consent management platform. Use a click to load wrapper that shows a static cover and loads the real embed only after consent, list the Spotify cookies in your cookie policy, and disclose the US processing. ### Are there alternatives to embedding Spotify? You can link out to Spotify instead of embedding, use a self hosted audio player for your own tracks, or choose a privacy friendly music widget that does not set tracking cookies. These options reduce or remove third party cookies and US transfers, at the cost of the native Spotify streaming experience. ### How do I update my cookie policy for Spotify? List each Spotify cookie such as sp\_t, sp\_dc, and sp\_adid with its purpose and duration, name Spotify as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan because Spotify cookie names and durations can change over time. Same category ## More services: Video [See the whole category](https://www.flowconsent.com/en/services/video) ### [Viqeo](https://www.flowconsent.com/en/services/video/viqeo) [Viqeo is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Viqeo supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Viqeo ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/video/viqeo) [Video](https://www.flowconsent.com/en/services/video/viqeo) · ### [Omny Studio](https://www.flowconsent.com/en/services/video/omny-studio) [Omny Studio is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Omny Studio integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Omny Studio helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/video/omny-studio) [Preferences](https://www.flowconsent.com/en/services/video/omny-studio) · ### [Wowza Video Player](https://www.flowconsent.com/en/services/video/wowza-video-player) [Wowza Video Player is a video hosting and streaming platform that helps businesses deliver high-quality video content to their audiences. It provides adaptive bitrate streaming, customizable players, and content management tools. Wowza Video Player supports live streaming, on-demand playback, and video analytics. With CDN-powered delivery and responsive embeds, Wowza Video Player ensures smooth playback across all devices and network conditions for engaging video experiences.](https://www.flowconsent.com/en/services/video/wowza-video-player) [Preferences](https://www.flowconsent.com/en/services/video/wowza-video-player) · ### [Wistia](https://www.flowconsent.com/en/services/video/wistia) [Wistia is a user preference and personalization service that helps websites deliver customized experiences based on individual visitor settings and choices. It manages preferences for content display, communication channels, and interaction styles. Wistia integrates with website platforms to remember and apply user choices consistently across sessions. With privacy-compliant preference storage, Wistia enhances satisfaction by ensuring tailored browsing experiences for every visitor.](https://www.flowconsent.com/en/services/video/wistia) [Preferences](https://www.flowconsent.com/en/services/video/wistia) · ### [EmbedPlus](https://www.flowconsent.com/en/services/video/embedplus) [EmbedPlus is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. EmbedPlus supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, EmbedPlus enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/video/embedplus) [Marketing](https://www.flowconsent.com/en/services/video/embedplus) · ### [StorifyMe](https://www.flowconsent.com/en/services/video/storifyme) [StorifyMe is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. StorifyMe supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, StorifyMe ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/video/storifyme) [Preferences](https://www.flowconsent.com/en/services/video/storifyme) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)