There’s a new rule when it comes to security and privacy: If a service is free, then you’re the product.
Actually, come to think about it, the rule isn’t so new. I’m the product when I listen to the radio. Radio stations exist to deliver a product–namely, an audience–to advertisers, and the audience is different when you’re talking top 40 versus urban contemporary versus country versus classic rock versus alternative versus adult contemporary.
But when it comes to streaming music, the game changes a bit.
You see, when it comes to radio stations, there’s a lot of stereotyping going on. Based on my profile as a middle-aged white male with a college degree, no advertiser is going to expect to find me in the urban contemporary audience. Based on my zip code, they’d probably put me in the country or classic rock camp.
Streaming, in exchange for giving me more precision in my choices, gives advertisers more precision. Males tend to gravitate toward the music they listened to in their teens and twenties once they reach my age, which drives my wife nuts since women tend to stay more receptive to new music longer. Advertisers can infer a lot of things when they know I’d much rather listen to They Might Be Giants than Van Halen.
Unfortunately that doesn’t seem to be enough for Spotify. If you listen to Spotify on a phone, they collect pretty much everything about what you’re doing on the phone, so that means they don’t just guess where you live, they know. They also know where you work. And what apps you use, what social media you use, and based on that, they know a lot about your friends too.
What’s worse is that they do this to their paid subscribers too, not just to those who listen for free.
I’m uncomfortable with all of this metadata collection, because it doesn’t tell the whole story. And a company like Spotify won’t just serve that metadata up to advertisers. If I were advising the government–I’m not in that business anymore but I used to be–and they wanted information on somebody, I would advise them to go to Spotify before going to Google or Apple because it’s a newer relationship with a lot less baggage. And while I’m not doing anything wrong, I’m less sure that none of my friends are doing anything wrong, and there are no guarantees whatsoever about seven years from now. But the metadata doesn’t tell what we talked about–only that we talked, and how frequently. The data that can prove my innocence is missing.
Building an MP3 collection costs money, but I feel quite a bit better about listening to my own MP3s in light of this. If it makes me old fashioned and paranoid, so be it. But I’m an old-fashioned guy with SSDs and my best computer has 32 gigabytes of RAM in it.
We all have contradictions, but the metadata can lose those subtleties. That’s the danger with it.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.