Spotify

Overview

Spotify operates both an embeddable audio player for websites and an advertising analytics platform with conversion tracking pixels. The embed allows publishers to surface Spotify content directly on their pages, while Spotify Ad Analytics serves brands and agencies measuring campaign performance across the Spotify advertising ecosystem.

What This Script Does

Spotify Embedded Player The Spotify embed player is loaded via an iframe from open.spotify.com/embed/. The embedding page includes a small JavaScript snippet from open.spotify.com that resizes the iframe and handles messaging between the player and the host page. The player itself:

• Streams audio via Spotify's CDN infrastructure (audio-ak-spotify-com.akamaized.net, audio4-ak-spotify-com.akamaized.net)
• Contacts open.spotify.com and api.spotify.com for track metadata, album art, and playback control
• For logged-in users, sets authentication cookies under spotify.com to maintain session state and sync playback history to the user's Spotify account
• For anonymous users, sets a transient session cookie scoped to the embed interaction
• Sends playback events (play, pause, skip, seek) to Spotify's analytics infrastructure
• Does not set third-party tracking cookies on the host page domain for advertising purposes

Cookies potentially set in the Spotify origin (iframe):

• sp_t (third-party within Spotify iframe, 1 year) — Spotify anonymous tracking identifier
• sp_ab (third-party, 1 year) — A/B testing bucket assignment
• sp_landing (third-party, 1 day) — landing attribution cookie

Spotify Ad Analytics Pixel Spotify Ad Analytics (formerly Spotify Pixel) is a conversion tracking product for brands advertising on the Spotify platform. The pixel loads from pixel.byspotify.com and fires on advertiser pages — typically landing pages or post-conversion destinations. It:

• Records that a user who was exposed to or clicked on a Spotify ad subsequently visited the advertiser's site
• Sets a third-party tracking cookie on byspotify.com (1 year) to maintain attribution windows
• Collects IP address, User-Agent, page URL, referrer, and custom conversion event data
• Sends attribution data to Spotify's measurement infrastructure for campaign reporting

Podcast Embed Spotify podcast embeds use the same open.spotify.com/embed/episode/ iframe infrastructure as music embeds. Behavior is identical in terms of data collection and cookie setting.

Domains contacted:

• Embed player: open.spotify.com, api.spotify.com, audio-ak-spotify-com.akamaized.net
• Ad Analytics: pixel.byspotify.com, spclient.wg.spotify.com

Consent & Compliance

GDPR/ePrivacy: The Spotify embedded player serves a functional purpose — providing audio content directly requested by the user. However, the iframe sets cookies under spotify.com that may qualify as non-essential if they track users beyond the immediate playback session. For logged-in users, playback data synced to Spotify accounts constitutes personal data processing. Spotify Ad Analytics pixels are marketing tools requiring explicit opt-in consent. The ePrivacy Directive requires consent for advertising tracking cookies set by byspotify.com.

CCPA/CPRA: Spotify Ad Analytics pixels that share conversion data with Spotify qualify as selling or sharing personal information under CCPA.

EU-US Data Transfers: Spotify AB (Swedish entity) processes data under GDPR directly. US data transfers to Spotify's infrastructure are covered by Standard Contractual Clauses.

IAB TCF: Spotify Ad Analytics maps to IAB TCF Purposes 1, 2, 3, and 4.

Consent category: Functional (embedded player) and Marketing (Ad Analytics conversion pixel).

Should You Block This Without Consent?

Conditional. The embedded Spotify player serves a functional content purpose and can load without consent, though operators should disclose that the iframe may set cookies for logged-in Spotify users. Spotify Ad Analytics pixels are marketing tools that track advertising conversions and must be blocked until marketing consent is granted. Implement these as separate scripts with separate consent conditions — do not bundle the embed and the pixel under a single consent toggle.