From Spotify’s updated Terms & Conditions (effective August 19th), which you probably didn’t read.
I. You’re now being tracked even when you’re not on Spotify, often through Spotify ‘business partners’.
II. In addition, Spotify is now even tracking your friends’ profiles.
III. Under the new terms, Spotify is not obligated to follow the privacy laws of your country.
IV. If your data does happen to be breached, that’s your problem.