FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Video

Spotify Widgets

PreferencesOfficial website

Spotify embed widgets place a track, album, playlist or podcast player on your site via an iframe from open.spotify.com. Loading the player contacts Spotify servers, can set Spotify cookies and exposes the visitor IP address.

Block Spotify Widgets until consentScan my site
Overview

What does Spotify Widgets do?

What are Spotify Widgets?

Spotify Widgets are embeddable iframe players that allow website owners to place a Spotify track, album, playlist or podcast episode directly on a page. The player is served from open.spotify.com and when it loads, the visitor browser makes a direct connection to Spotify servers, exposing the visitor IP address and allowing Spotify to set cookies.

Data and Cookies Collected

When a Spotify Widget loads it can set several cookies including sp_t (a tracking identifier lasting one year), sp_landing (stores landing page data for one day), sp_dc (account routing cookie lasting one year used when the visitor is logged in to Spotify) and player preference cookies. The widget also exposes the visitor IP address, device information and playback events to Spotify regardless of login status.

GDPR and ePrivacy Implications

Spotify Widgets trigger obligations under both the GDPR and the ePrivacy Directive. The ePrivacy Directive requires prior consent before storing or accessing cookies on a visitor device. Under GDPR, the transfer of IP addresses and personal data to Spotify constitutes processing that must have a lawful basis. Because the widget loads automatically on page render, consent must be obtained before the iframe is injected into the page.

Consent Requirements

Consent is required before loading any Spotify Widget. The consent must be freely given, specific, informed and unambiguous. A compliant implementation replaces the iframe with a consent placeholder that only loads the Spotify player after the visitor actively accepts. Consent should be categorised under a media or functional cookies category in your consent management platform.

Data Transfers Outside the EU

Spotify AB is headquartered in Sweden but operates on global cloud infrastructure including servers in the United States. Visitor data including IP addresses, device identifiers and playback events may be transferred to and processed in the United States. Spotify relies on standard contractual clauses and, where applicable, the EU US Data Privacy Framework as transfer mechanisms. You should document these transfers in your records of processing activities.

Practical Compliance Steps

To use Spotify Widgets compliantly: gate the iframe behind a consent management platform and only inject it after the visitor opts in; display a clear placeholder explaining what will load; categorise the service in your cookie policy under media players; document the US data transfer and the transfer mechanism in your records; review Spotify data processing terms annually; and inform visitors that playback may be linked to their Spotify account if they are logged in.

Compliance

Spotify Widgets and the GDPR

Spotify Widgets is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive (2002/58/EC)

Impact assessment (DPIA)

A DPIA should be considered where Spotify Widgets are embedded on high traffic pages or pages targeting sensitive audiences. Key risks include transfer of visitor IP and playback data to Spotify infrastructure in the United States, linkage of playback to authenticated Spotify accounts, and the inability to offer a cookieless version. Document the legal basis, implement consent prior to loading the iframe and verify standard contractual clauses with Spotify.

Sample text for your banner

We would like to load a Spotify player to let you listen to music directly on this page. Spotify will receive your IP address and may set cookies to identify your device. If you are logged into Spotify, your playback may be linked to your account. Do you consent to loading the Spotify player?
Cookies and trackers

What Spotify Widgets sets and contacts

Tracking method
Embedded Spotify iframe player loaded from open.spotify.com that streams media, sets Spotify cookies and exposes the visitor IP
Server location
European Union and United States (Spotify is based in Sweden and uses global cloud infrastructure including the United States)
Data transferred outside the EU
The visitor IP, device data and playback events are processed by Spotify on global infrastructure including the United States under standard contractual clauses and, where applicable, the EU US Data Privacy Framework.

Cookies set (4)

NameTypeDurationPurpose
sp_tTracking1 yearSpotify tracking identifier that persists across sessions to identify the visitor device
sp_landingFunctional1 dayStores the landing page URL data for Spotify analytics
sp_dcAuthentication1 yearAccount routing cookie used when the visitor is logged in to Spotify to link playback to the account
sp_player_prefsFunctional1 yearStores player preferences such as volume and playback settings

Third-party domains contacted (4)

  • open.spotify.com
  • embed.spotify.com
  • www.spotify.com
  • *.scdn.co
Questions

Frequently asked questions about Spotify Widgets

Can't find your question? Write to us, we answer fast.

What cookies does the Spotify Widget set?

The Spotify Widget can set sp_t (a tracking identifier lasting one year), sp_landing (stores landing page data for one day), sp_dc (account routing lasting one year, used when the visitor is logged in to Spotify) and player preference cookies. These cookies are deposited as soon as the iframe loads, before the visitor interacts with the player.

Is consent required before loading a Spotify Widget?

Yes. Consent must be obtained before the Spotify iframe is injected into the page. The widget contacts Spotify servers and can set cookies on page load, which triggers the ePrivacy Directive requirement for prior consent. Replace the iframe with a consent placeholder and only load the player after the visitor opts in.

What is the legal basis for using Spotify Widgets under GDPR?

The required legal basis is consent under Article 6(1)(a) GDPR for the processing of personal data, combined with Article 5(3) ePrivacy for the setting of cookies. Legitimate interest is not available because Spotify sets cookies for its own tracking purposes and the processing is not strictly necessary for the service.

Does the Spotify Widget transfer data to the United States?

Yes. Spotify AB is headquartered in Sweden but operates on global infrastructure including servers in the United States. Visitor IP addresses, device data and playback events may be transferred to the United States. Spotify relies on standard contractual clauses and the EU US Data Privacy Framework as transfer mechanisms.

Is a DPIA required for Spotify Widgets?

A DPIA should be considered for high traffic sites or those targeting sensitive audiences. The key risk factors are the transfer of personal data to the United States, the inability to offer a cookieless version, and the potential linkage of playback to authenticated Spotify accounts. Document your assessment and the standard contractual clauses that cover the transfer.

How do I implement Spotify Widgets compliantly?

Gate the iframe behind a consent management platform. Display a placeholder that describes what will load. Only inject the Spotify iframe after the visitor opts in. Categorise the service under media players in your cookie policy. Record the US data transfer and the transfer mechanism in your records of processing activities. Review Spotify data processing terms annually.

Are there privacy friendly alternatives to standard Spotify Widgets?

There is no official cookieless Spotify embed. Alternatives include linking to the Spotify track instead of embedding, hosting an audio file directly on your server, or using a server side proxy that removes direct visitor to Spotify connections. Any of these avoids the need for prior consent and eliminates the US data transfer.

How do I update my cookie policy for Spotify Widgets?

Add Spotify to your cookie policy listing under the media players or functional cookies category. List the cookies sp_t, sp_landing and sp_dc with their durations and purposes. State that data may be transferred to the United States under standard contractual clauses and the EU US Data Privacy Framework. Note that consent is required before the player loads.

Same category

More services: Video

See the whole category

Uscreen

Uscreen is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Uscreen integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Uscreen helps organizations maintain robust websites that meet user expectations and technical requirements.

Video

SproutVideo

SproutVideo is a user preference and personalization service that helps websites deliver customized experiences based on individual visitor settings and choices. It manages preferences for content display, communication channels, and interaction styles. SproutVideo integrates with website platforms to remember and apply user choices consistently across sessions. With privacy-compliant preference storage, SproutVideo enhances satisfaction by ensuring tailored browsing experiences for every visitor.

Preferences

VideoJS

VideoJS is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. VideoJS integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, VideoJS helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Viloud

Viloud is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Viloud enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Viloud empowers marketing teams to achieve measurable growth.

Marketing

StorifyMe

StorifyMe is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. StorifyMe supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, StorifyMe ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Captivate.fm

Captivate.fm is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Captivate.fm integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Captivate.fm helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site