Spotify
Verified“EU-controlled company, US-dependent machine.”
- Listing
- NYSE: SPOT
- Users
- 761M
- Revenue
- €17.2B
- People
- 7,287
48 = midpoint of Control 68 & Data 29
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 16 sourced facts across 10 independent sources, last verified 2026-06-12. 4 open questions hold confidence at 85% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
80
EU-incorporated parent (Luxembourg), Swedish main operating company, and proven EU enforceability (the IMY fine was litigated and upheld). Deduction: a US operating subsidiary places part of the business under US jurisdiction.
Why 80? 4 sourced facts · click to expand
Parent entity: Spotify Technology S.A., incorporated in Luxembourg (RCS B123052). The main operating company is Spotify AB (Sweden); the US operating company is Spotify USA Inc. (New York).
FY2025 Form 20-F, organizational structure · as of 2026-02-10
The Swedish DPA (IMY) fined Spotify AB SEK 58M (~€5M) in June 2023 for GDPR Article 15 transparency failures. A court reduced it to SEK 40M in 2024; the Administrative Court of Appeal restored the full SEK 58M on 3 June 2025. Evidence that EU enforcement against Spotify works.
IMY / Digital Policy Alert · as of 2025-06-03
Not a designated Very Large Online Platform under the DSA: Spotify self-reports fewer than 45M average monthly EU recipients (against ~195M 'Europe' MAUs, a figure that includes non-EU countries).
European Commission DSA designation list · as of 2026-05-28
Spotify has been the EU's most effective private enforcer against a US gatekeeper: its 2019 complaint led to Apple's €1.84B antitrust fine (March 2024) and fed the DMA's first enforcement wave (€500M Apple fine, April 2025).
European Commission · as of 2025-04-23
Control & Ownership
55
Voting control is unambiguously EU: two Swedish founders hold 69.3% of votes. But the economic majority is non-EU (~86% of shares US-record-held), the largest outside shareholder is Tencent (voting-neutralized), and the only listing is the NYSE.
Why 55? 5 sourced facts · click to expand
Swedish founders Daniel Ek and Martin Lorentzon control 69.3% of total voting power (28.8% + 40.5%) through 309.9M beneficiary certificates — non-transferable, zero-economic-value instruments carrying one vote each, stacked on top of their ordinary shares.
FY2025 Form 20-F, major shareholders table · as of 2025-12-31
The founders' combined direct economic interest is only ~15.1% (Ek ~5.8%, Lorentzon ~9.3%). 86.3% of ordinary shares were held by US record holders at end-2025; aggregate institutional (mostly US/UK) holdings are ~65% of shares. The economic majority of Spotify is non-EU.
FY2025 Form 20-F · as of 2025-12-31
Tencent (China) is the largest outside shareholder at 8.1% economic interest (from the December 2017 Spotify–Tencent Music equity swap), but exercises no independent voting power: its votes are cast by Daniel Ek under an irrevocable proxy.
FY2025 Form 20-F, footnotes 1 & 5 · as of 2025-12-31
No other shareholder holds above 5%. Baillie Gifford (UK) reported 7.6% economic / 2.9% voting at end-2024 and fell below the disclosure threshold during 2025.
FY2024 & FY2025 Form 20-F · as of 2025-12-31
Listed only on the New York Stock Exchange (ticker SPOT) since the April 2018 direct listing. There is no EU listing.
CNBC / Form 20-F · as of 2018-04-03
Data →
Where your data lives and who can reach it
Data & Infrastructure
15
Spotify's own 20-F states the 'vast majority' of data storage — including users' personal data — and computing runs on Google Cloud, a US provider subject to the CLOUD Act. Transfers rely on SCCs; there is no published EU-only residency option. This is what most directly determines where your data lives.
Why 15? 4 sourced facts · click to expand
The FY2025 20-F states Spotify relies on Google Cloud Platform 'for the vast majority of our primary data storage (including personal data of users and audio data licensed from rights holders) and computing'.
FY2025 Form 20-F, risk factors (direct quote) · as of 2026-02-10
Spotify announced its migration to Google Cloud in February 2016 and completed the move off its own data centers by ~2018. It remains on GCP as of the latest filings.
Google Cloud blog · as of 2016-02-23
Google LLC and Spotify USA Inc. are US entities subject to the US CLOUD Act compelled-disclosure regime, which applies to providers under US jurisdiction regardless of where the data physically resides.
US Department of Justice, CLOUD Act resources · as of 2026-06-12
Spotify's privacy policy (Section 7) confirms personal data is shared internationally, with transfers outside the EU/EEA protected by Standard Contractual Clauses and adequacy decisions. There is no published EU-only data-residency commitment.
Spotify Privacy Policy, §7 · as of 2026-06-12
Operations & People
50
Operating HQ and leadership are in Stockholm and the company reports in euros, but the workforce center of gravity has shifted to the US (3,466 US vs 1,271 Sweden average FTEs in 2025).
Why 50? 3 sourced facts · click to expand
Workforce by location (2025 average FTE): United States 3,466, Sweden 1,271, UK 887, of 7,287 total. The largest employee base is in the US.
FY2025 Form 20-F · as of 2025-12-31
Since 1 January 2026, Daniel Ek serves as Executive Chairman with Alex Norström and Gustav Söderström as Co-CEOs — leadership remains Stockholm-centered.
Q1 2026 shareholder letter / FY2025 20-F · as of 2026-01-01
Scale: 761M monthly active users and 293M Premium subscribers (Q1 2026); FY2025 revenue €17,186M with net income €2,212M, reported in euros. Europe is the largest region at 26% of MAUs (~195M, including non-EU countries).
Q1 2026 results / FY2025 Form 20-F · as of 2026-03-31
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
4 open questions — they lower confidence, never the score
- ?
Which Google Cloud regions hold EU users' personal data?
Not publicly documented in filings or policy. Even EU regions would remain under CLOUD Act reach via Google, but region transparency would materially change the data-sovereignty read.
- ?
Exact EU-only user count
Spotify discloses only 'fewer than 45M' DSA recipients vs ~195M Europe-region MAUs (which includes non-EU countries). The gap is methodologically contested.
- ?
Further appeal of the IMY fine
No public record of an appeal to the Supreme Administrative Court as of 2026-06-12.
- ?
Precise EU economic ownership
Street-name (DTC) holdings make beneficial-owner geography approximate; we report record-holder data from the 20-F rather than estimating a single percentage.
EU Cloud Sovereignty Framework lens
The EU Cloud Sovereignty Framework (SEAL-0 to SEAL-4, June 2026) formally targets cloud providers, not streaming services. This is an analogous mapping for orientation, not a certification. Spotify's overall profile is roughly SEAL-1-equivalent: jurisdictional sovereignty without data or operational sovereignty.
Strategic
EU voting control; non-EU economic gravity
Legal & jurisdictional
EU incorporation; EU enforcement proven (IMY)
Data & AI
Personal data on US hyperscaler; CLOUD Act; SCCs only
Operational
Operations depend on GCP; US workforce plurality
Supply chain
Single non-EU provider for the vast majority of storage and compute
Technological
Proprietary stack bound to a proprietary US cloud
Security & compliance
GDPR-compliant posture; fined, litigated, paid
Environmental sustainability
Out of scope for this profile version
EU alternatives
Hi-res streaming owned by Xandrie SA (Pantin, France) — privately held French ownership; the strongest EU-sovereignty profile in music streaming. Hosting details not publicly documented.
Paris HQ, Euronext-listed — but the largest shareholder (~37%) is Access Industries (Len Blavatnik, US/UK). More EU than Spotify on paper; not cleanly EU-controlled.
Listed here so you don't switch by mistake: despite Norwegian roots, Tidal is ~86% owned by Block, Inc. (US) since 2021. Not an EU alternative.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. The previous automated score (33, 'Not sovereign') treated missing data as worst-case and subtracted points for popularity — both removed. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile. Supersedes the automated score of 33/'Not sovereign', which treated unknown data as worst-case (e.g. zeroed the entire economic pillar) and subtracted 15 points for popularity. Facts re-verified against the FY2025 Form 20-F, IMY/court records, the EC's DSA list, and Spotify's privacy policy.
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology