If there's a miscommunication going on, the opening gambit came from Spotify. They could have spelled out in the TOS exactly what they would do with the data, and contractually bound themselves never to change that activity without issuing new TOS.