The issue isn’t that Spotify have some sinister agenda, or even that they might sell data. It’s that startups and social networks repeatedly pile up vast amounts of private data while demonstrating an extremely blasé attitude toward privacy and what happens to that data in the future.
Facebook and Uber have been some of the biggest offenders so far. Uber (at least in the past) have let any employee access customer data and have broadcast certain people’s locations in realtime at public events. Facebook, despite having to be audited over privacy by the US government every year until sometime in the 2020’s, because of how badly they’ve abused confidential user information before, are still ultimately in the business of selling that data to other people and forever poking at the boundaries of what’s legal.
Loads of other startups are piling up the data with little regard for edge cases. Outside of startups, there are (for instance) free torch apps on Google Play that ask for a ridiculous number of permissions during installation, then harvest data and pass it on to the developer for sale. All of these things expose not only your own data, but anyone’s data you happen to have a copy of.
These things aren’t a massive a threat at all for most of us, and probably won’t become so, but the things they do with data can become a massive threat to vulnerable people. If you think for a second you, one of your friends or family couldn’t become vulnerable or have a need for privacy within the course of a few days or hours, then you’re naïve at best.