Eh, how do we know what they want? We have to give over access to all our info and trust they'll only use the bits they'll say? This is a problem of the permissions systems rather than of the company - but weather Notch is over-reacting or not is kind of moot:

“With your permission, we may collect information stored on your mobile device, such as contacts, photos, or media files. Local law may require that you seek the consent of your contacts to provide their personal information to Spotify, which may use that information for the purposes specified in this Privacy Policy.”

It's hard to know what they really want and what they say they want - we need to fix the way we let apps use our data.