---
title: "Spotify AB fined SEK 58,000,000 (Sweden, 2023)"
canonical: "https://dposchool.com/gdpr/fine/imy-spotify-2023-06"
source: "https://www.imy.se/tillsyner/spotify-ratten-till-tillgang/"
source_note: "Only the authority's decision is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Fine · Sweden

# Spotify AB: SEK 58,000,000

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Authority:** Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)
- **Country:** Sweden
- **Date:** Decision of 12 June 2023
- **Amount:** SEK 58,000,000, as imposed (not converted)
- **Appeal status:** Upheld ([source](https://www.imy.se/tillsyner/spotify-ratten-till-tillgang/))
- **Provisions cited:** [Article 12(1)](https://dposchool.com/gdpr/article/12#1), [Article 15(1)(a)](https://dposchool.com/gdpr/article/15#1-a), [Article 15(1)(b)](https://dposchool.com/gdpr/article/15#1-b), [Article 15(1)(c)](https://dposchool.com/gdpr/article/15#1-c), [Article 15(1)(d)](https://dposchool.com/gdpr/article/15#1-d), [Article 15(1)(g)](https://dposchool.com/gdpr/article/15#1-g), [Article 15(2)](https://dposchool.com/gdpr/article/15#2)

## What the fine was for (summary, not the official text)

Gave users their data on request but did not explain clearly enough how it was used (purposes, categories, recipients, retention, sources, transfer safeguards).

## Official source

- [Decision or announcement of the authority](https://www.imy.se/tillsyner/spotify-ratten-till-tillgang/)

Checked against the official source on 28 October 2026.

Only the authority's decision is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Fines](https://dposchool.com/gdpr/fines) / Spotify AB

[All fines](https://dposchool.com/gdpr/fines)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents