Once you've given those permissions on Android by installing/upgrading Spotify, you have no guarantee that the app won't use them without your knowledge. Any options to limit the features from inside the app itself are purely cosmetic from an access control point of view.

Not sure about Android, but at least on iOS, you aren't prompted to allow access to photos until the you attempt to use the feature in most cases, which is what Spotify are arguing for here. But you're right, once you've granted permission it's up to the app to be responsible.

Makes me think the OS should provide a 'Just this once' button when being asked to allow access to extra permissions.

That would be nice. Otherwise, soon I'll need to use a "throw-away" phone just for the apps since most of them usually require more permissions than I'd like to share.

True, it's really more of an Android issue, than a Spotify issue.

Not really, it's a limitation Spotify has to deal with if they want to offer 'services' which require these permissions. Access to photos is not needed to stream music, last time I checked ;)

That Android has 'one-ticket-for-everything-LOL' security flags is sad, but that doesn't mean Spotify then thus has the responsibility to work with that and if they are so serious regarding privacy of their users, offer a way to make me control what they can see / do, however I can't: at install I have to give permissions and after that I can't control what they can see / do or not, not in the app, not in my account, nowhere. I just have to trust them.

That last part is a bit difficult at the moment.

If you're on iOS you always have to opt-in to give an app access to photos or contacts. On Android, you can't do anything about it now, but it should be moving to a similar system with Android 6 (marshmallow). Neither allows you to restrict access to accelerometers, light sensors, etc as far as I am aware.

If they siphon up your contact list and store it before Marshmallow comes out, blocking it later won't do you much good.

Many custom Android roms have had deep per-app permissions for years (CM is basically built around it at this point), and previous versions of Android loosely supported per-app permissions through the App Ops app.

You can get this on Android already if you install Cyanogenmod.

Yeah, but Sony locked up my phone's low light noise reduction behind some nasty DRM system and if I switch off the stock OS it turns the camera into a huge piece of shit.

Remind me to not buy a phone from Sony again.