The Sound of Privacy – What Your Spotify Data Reveals About You - Dennis Schulz & Thomas Hugle

Value of the Information & Strength of the Argument

The presentation delivers strong concrete examples, based on real datasets, to illustrate how much sensitive information can be extracted from music streaming data. The argumentation is built on tangible evidence: device histories, skip-ratio analyses, and behavioral patterns. The speakers do not rely on theoretical claims but show actual rows and plots from their own or colleagues’ data. They also discuss the limitations of data quality (e.g., changing platform labels) and the power of simple heuristics (e.g., children’s repetitive songs). However, the talk remains anecdotal and does not provide systematic quantitative results or comparisons with other studies. Nevertheless, the hands-on approach makes the argument persuasive and relevant for a security and privacy-aware audience.

Scientific Rigor, Source Quality, Title Accuracy

The speakers reference specific GDPR articles and legal provisions correctly, and they describe their own data-request experiences with various companies, which adds authenticity. They do not cite external research papers or official reports, but they discuss the legal framework accurately. The title is well suited to the content: the talk indeed reveals how Spotify data can expose private information. The link between the title and the content is direct and clear. The few sources mentioned (GDPR articles, conference pages) are appropriate but limited.

The title accurately reflects the central topic: demonstrating how much personal information can be inferred from Spotify data.

7/10

The talk is based on concrete real-world data analyses, with legal references (GDPR articles), but lacks external scientific references and is essentially a conference experience report.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction: origin of the project, Slack message, 16 colleagues shared Spotify data.
• 08:00Legal basis: GDPR articles 15 (access), 20 (portability), 12 (transparency); how to request data from Spotify.
• 16:00Examples of data requests from other companies (Ryanair, Thümann, health insurance, Deutsche Post), highlighting practical issues.
• 25:00Standard Spotify dataset: playlists, search strings, partial search entries, and hints for identification via playlist names.
• 35:00Extended streaming history: 216,000 rows, device platform history, construction of device timeline and owner identification.
• 45:00Behavioral analysis: skip ratio per device to detect different users, children's songs as parental indicator, incognito mode limitations.
• 53:20Conclusion: privacy implications, recommendation to request and inspect one's own data.

• NDC Conferences — Conference series where the talk was recorded.
• NDC Oslo — Event page for the NDC Oslo conference where this talk took place.

• GDPR – Official Text — Legal text of the GDPR, confirming the articles cited by the speakers.