Spotify is already managing this like a crisis. According to research just published by researchers at UC Berkeley, Spotify has been using a cookie that cannot be deleted, still tracks if the user blocks cookies, and even operates in browser stealth mode. In fact, if you try to delete this thing, the cookie dynamically regenerates. "The cache cookie method used ETags, and is capable of unique tracking even where all cookies are blocked by the user and 'Private Browsing Mode' is enabled," the researchers described.
The cookie is powered by Kissmetrics, and also
deployed by Hulu and others.
In response to the potentially horrible press, both companies have dropped the use of the cookie immediately. In other words, both were caught red-handed, and are now hoping for the best. "We take the privacy of our users incredibly seriously and are concerned by this report," a Spotify spokeswoman told Digital Music News. "As a result, we have taken immediate action in suspending our use of Kissmetrics whilst the situation is investigated."
The only problem is that most in Europe have already downloaded the application, as have early-adopting Americans. And, there's no clear way to remove this thing. "If you do everything the average user does to say 'I don't want to be tracked,' it still tracks you," an IT professional who examined the cookie told Digital Music News. "The potential for invasion of privacy is huge."
Update (8/4): Spotify is now part of a lawsuit related to the Kissmetrics tracking implementation.

Comments Closed
@kensolo_2345 Monday, August 01, 2011
Ken Solano
One of the few companies I'd let track me...

@stevoflores Monday, August 01, 2011
Steve
ugh!!!

@jamesowenflynn Monday, August 01, 2011
James Owen Flynn
Yeah, I think/hope nothing will come of this though...

wallow-T Monday, August 01, 2011
I forget who it was, who said that the only way to make money on the Internet is through the systematic violation of user privacy.

bobby corbin Wednesday, September 07, 2011
yeah just shut up

Vail, CO Monday, August 01, 2011
The only reason they make it so hard to delete is because they know users will try. And the sad part is that if Berkeley never published this research Spotify would never have done anything.

@bgershon Monday, August 01, 2011
Bernard Gershon
Shame x 3. why???

@AUMikeG34 Monday, August 01, 2011
MG
What is the evil they are tracking?

@DonnieAlan Monday, August 01, 2011
Donnie Alan
Is anywhere safe?

nathan Monday, August 01, 2011
Maybe now I can get an invite.

Jeff Thursday, August 04, 2011
If you need an invite send me an email - couponcowens @ g m a i l . c o m

JacksonL Monday, August 01, 2011
But what does Placido Domingo think of this?

@roemusics Monday, August 01, 2011
Roe!
I knew spotify was no good!

@ldschumacher Monday, August 01, 2011
Linda Schumacher
Yikes! What to do?

@AlethiaJA Monday, August 01, 2011

@uwehook Monday, August 01, 2011
Uwe Hook
Are you using Spoitfy? Good, you have an evil tracking cookie on your computer.

@nddrylliog Monday, August 01, 2011
Amos Wenger
Woops. Love it when the greedy get caught.

Miy Cal Monday, August 01, 2011
So how do you get rid of it?

paul Monday, August 01, 2011
We've gotten a few questions about how to remove this. We're checking to see if Spotify has any remove tool or method.
/pr.

@Osomotley Monday, August 01, 2011
Simon Kedward
Not sure how I feel about this.

@EmpressEricka Monday, August 01, 2011
Empress Regnant
Dammit.

bobby corbin Wednesday, September 07, 2011
hey thers no need for that type of talk so shut up

Drew I. Monday, August 01, 2011
This is disappointing and disturbing.

@MusicSF Monday, August 01, 2011
Aidin Vaziri
Spotify knows what naughty sites you're visiting...

@TheSchoenberger Monday, August 01, 2011
Aaron Schoenberger
A problem so soon... Ouch!

MisterSoftee Monday, August 01, 2011
Spotify knows I'm leaving a comment on Digital Music News right now...

@AlexPham Monday, August 01, 2011
Alex Pham
Spotify is leaving a bad taste in users' computers...

GrayPowell Monday, August 01, 2011
I love Spotify but I just cannot give them my hard earned money for their premium app. The reason is that there's no trust --- so what will they be doing with my credit card info, is it secure, etc.? Are they going to sell all that info to third parties also, charge me incorrectly if I'm not watching every moment, dropping a cookie that can easily be taken over by a virus? Remember they were trying to keep this a secret so what else is going on there?
Apple never does anything stupid or as consumer unfriendly as this, which is why I'll stick with them. Trust: It still means something. You lost mine Spotify!
buh-bye

Econ Monday, August 01, 2011
A few months ago Apple was blasted for doing backups without user consent and havnign the ability to track that data. They had to rush an iTunes update to make the backups explicit and to have old ones deleted.

jomo Thursday, August 04, 2011
yes i do shop online, but i can usually control those cookies and not have them respawn once they are deleted.
yes, sure the company still has the data i've entered stored; but at least i have a little more control in being able to remove/delete the cookies on there.
furthermore, this wasn't something that's disclosed in the 'fine print' - and that's what's really offensive.
potential exploits of this sort of cookie can make other data vunerable - ESPECIALLY if this cookie is difficult/impossible to remove aside from a full low level wipe and reinstall.
not to mention spotify's payments to the actual musicians/songwriters are abysmally small.
screw spotify, it's all damn hype - but they are not a service whose best interests are musicians OR consumers of music. They are looking to capitalize on both in a rather drastic and vile manner.

John Wednesday, August 03, 2011
Do you ever shop online? Do you shop anywhere with a credit card? Your info is as safe with spotify as anywhere else.

Ignacio Monday, August 01, 2011
How do you remove this thing?!
If I remove app, is the cookie still there?
Do I have to nuke browsers?

@seandammit Monday, August 01, 2011
seandammit
oof.

@cyruspireh Monday, August 01, 2011
cyrus pireh
spotify tracking users without consent! you cannot remove the cookie from your computer!!

@ljishie Monday, August 01, 2011
ishie
uggghhhhhh

mrsbaker66 Monday, August 01, 2011
Rupert Murdoch's idea?

@Gighive_TheBuzz Monday, August 01, 2011
Noe Pacheco
Is privacy a myth?

@paulhting Monday, August 01, 2011
Paul H. Ting
Oh well...too late now..no removal instructions

@CarlyKane Tuesday, August 02, 2011
Carly Kane
I wonder if it does the same thing on a Mac.

@dandoll Tuesday, August 02, 2011
Dan Doll-Steinberg
Spotify is spying on all its users. If you already use this permanent tracker are you stuck?

@ryanpatrickdaly Tuesday, August 02, 2011
Ryan Daly
beware fellow Spotify-ers...

@jargonmediaNY Tuesday, August 02, 2011
Jargon Media
Oops...

@perfectrhys Tuesday, August 02, 2011
John Williams
This is a bit like playing zombies on Black Ops.

@bandwidthmusic Tuesday, August 02, 2011
bandwidthmusic
Caught ya!!

Bill Rosenblatt Tuesday, August 02, 2011
Paul,
I think you need to describe your source more specifically than "an IT professional who examined the cookie." Otherwise you lay yourself open to being the (possibly unwitting) relayer of biased and/or ignorant information. I'm sure you remember the Sony BMG fiasco with First4Internet; the source was publicly known and trusted.
I don't see this "gotcha" being reported on eff.org, for example. This makes me question its validity; if it were really this big a deal, they'd be all over this like a cheap suit.

paul Tuesday, August 02, 2011
Bill,
I'll happily offer more information here. The IT professional is actually employed by me, and has been for several years. He knows his cookies ;)
/pr.

@nophirex Tuesday, August 02, 2011
Nophi
We drank the Kool-Aid.

Bill H Tuesday, August 02, 2011
Mint and Yelp use the same KissMetrics cookies. I'm sure there are more, but those are the only two I've found on my computer.

@CSignore15 Tuesday, August 02, 2011
Chris Signore
Not cool Spotify, NOT COOL.

@LadyT_DCdiva Tuesday, August 02, 2011
Lady T
This is BS!!

@Suga_Shane Tuesday, August 02, 2011
Shane Baker
Spyify!

@RavenRobin Tuesday, August 02, 2011
Nerd & Nomad
Oh no!

@kmiles5830 Tuesday, August 02, 2011
Kay Milla
Spotify on that bull ish.

@McBuddah Tuesday, August 02, 2011
Hamish Mackintosh
NOW THIS does concern me!

@OnPoint_El Tuesday, August 02, 2011
International El
I knew it...smh

@MikeRJohanns Tuesday, August 02, 2011
Mike Johanns
Way to go.

@TuneLab Tuesday, August 02, 2011
TuneLab.com
I think "virus" is a more accurate term

@PrideOfLR Tuesday, August 02, 2011
Grant Trill
Gee thanks...

@johncon966 Wednesday, August 03, 2011
John Connolly
Bad Spotify!

@Minifran Wednesday, August 03, 2011
Fran Cowan
Wow- Spotify you really screwed up...

@zoomis Wednesday, August 03, 2011
Monty
... spotify is trying to kill you

@funkyjenn Wednesday, August 03, 2011
funkyjenn
How to get rid of it!

@UX_KV Wednesday, August 03, 2011
Karuna Venter UX/IA
Early adopters beware: Spotify is using the infamous, undeleteable evil tracking cookie...

@paull_nl Wednesday, August 03, 2011
Paul Lamens
"The potential for invasion of privacy is huge", zegt de dr. Clavan van dienst in dit stukje tekst...

@lakarune Wednesday, August 03, 2011
Chakra Kahn
beware the evil tracking cookie!

@k_miller98 Wednesday, August 03, 2011
Kyle Miller
Fuuuuuuuu now I can't get rid of it. Can I?

trackme biotch Thursday, August 04, 2011
tracking me, eh? well, I hope they like news, music and porn!

Maing Thursday, August 04, 2011
Hmmm... "Ghostery" blocks it, and all Kissmetrics cookies/bugs, should you select that option.
If you didn't care about tracking cookies before, why do you now?
At this point, it's like sniffing your own fart and saying "yes, it DOES smell bad."

billybob Wednesday, September 07, 2011
my farts smell like roses!!!

@MarcIntheOC Thursday, August 04, 2011
Marc Mullendore
UGH!...

mitsu Thursday, August 04, 2011
the only reason to make it non removable is so you can have in place a resource. we are now in and have been for sometime an age where it is no longer about selling (advertising, suggesting, branding, etc...), but merely having a disposable in place resource for future prospect. an in place stealth cookie is worth more when the plan from the begining is not to sell advertising space or even the adds themselves, but rather being able so sell the right to do those things.
it's easier to sell a database to potential advertisers when you don't have to worry about the lack of customers wether willing or not. so now it just comes down to who has the biggest resource, (database), and for how much.

@b1ward Friday, August 05, 2011
Byron Ward
Oops...

@berutt Friday, August 05, 2011
Bryan Rutt
Hey Spotify users...so much for our privacy!

Visitor Monday, September 19, 2011
I think you need to describe your source more specifically than "an IT professional who examined the cookie." Otherwise you lay yourself open to being the (possibly unwitting) relayer of biased and/or ignorant information.

@b1ward Friday, August 05, 2011
Byron Ward
Oops...

@tonyjalicea Monday, August 08, 2011
Tony Alicea
Yikes!

Peter Saturday, August 20, 2011
The real problem is not that spotify does this. The problem is that browsers allow it.

OUR SPONSORS
Follow Us