Spotify
Spotify plays music, podcasts and audiobooks, and lets you organise music into playlists. It’s made by Spotify, based in Sweden.
Criminals have used its name in fake downloads or scams, so get it only from spotify.com.
What it is
People use Spotify to listen to music, podcasts and audiobooks, build playlists and control playback on compatible speakers. Spotify provides the Mac app through its website.
If you enable Local Files, Spotify can read audio files in folders you select. Local Network access lets it find compatible devices such as speakers. Spotify also collects listening history, searches, device details and IP addresses to run the service and personalise recommendations.
Spotify is an established streaming service. Its privacy policy says it uses personal data for tailored advertising and shares some user and usage data with advertising partners. Privacy settings include controls for tailored advertising.
Who makes it
Spotify is a Swedish audio streaming company whose service launched in 2008. Its legal name is Spotify AB. Its website is spotify.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
The real Spotify is signed by Spotify, Apple team ID 2FNC3A47ZF. A copy signed by anyone else isn’t from Spotify. HARD’s Mac app checks this for you; to check by hand, open Terminal and run codesign -dv "/Applications/Spotify.app", and look for that TeamIdentifier.
Its bundle ID, the name macOS knows it by, is com.spotify.client. Download it only from spotify.com, not from an ad or a link someone sends you.
Fakes. In December 2024, ESET reported malicious links in Spotify podcast and playlist descriptions, including offers of cracked Spotify. These links led to fraudulent download sites distributing malware.
What it connects to
In normal use, Spotify talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
*.spotify.com | Sign-in and Spotify services |
i.scdn.co | Album artwork |
*.spotifycdn.com | Loading Spotify content |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Files and Folders | To read local audio files in protected folders when you use Local Files. |
| Local Network | To find compatible speakers and other playback devices on your network. |
Security record
Problems with Spotify or Spotify in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Outsiders copied content and track information from Spotify without permission; Spotify said it had taken steps to address the incident. | ↗ |
References
- Spotify Mac download spotify.com
- About Spotify newsroom.spotify.com
- Spotify Privacy Policy spotify.com
- Spotify macOS deployment and bundle identifier patchbee.io
- Updating your Spotify app support.spotify.com
- Local files support.spotify.com
- Controlling app access to files in macOS support.apple.com
- AirPlay devices not showing up in Mac app community.spotify.com
- Desktop app domains needed for whitelist community.spotify.com
- Spotify Web API: currently playing track and artwork URLs developer.spotify.com
- Spotify moderator advice about blocked content domains community.spotify.com
- ESET: criminals using Spotify to distribute malware eset.com
- Spotify 2025 Annual Report s29.q4cdn.com
- The signature on a real installed copy, read by HARD with
codesign.