Why Should You Care About This?
When you sign up for a music distribution platform, you're not just uploading your songs — you're handing over a full package of personal data: your real name, email address, banking details or digital wallet information, the ISRC and UPC codes assigned to your tracks, and your streaming statistics. If a distributor sells this data to third parties, the consequences can range from minor annoyances all the way to a serious threat to your financial rights.
What Exactly Gets Sold?
Your data generally falls into three categories:
- Identity data: Your name, nationality, address, and account identifiers. Once sold, this opens the door to spam marketing campaigns or outright fraud attempts.
- Performance data: Play counts, audience demographics, and top-listening regions. Marketing companies purchase this information to target artists with shady promotional offers or so-called "guaranteed promotion" tools.
- Rights data: ISRC numbers and track ownership details. If this data is sold or leaked, it can put your legal rights at risk — particularly if it's used to file fraudulent ownership claims against your own music.
Common Scenarios and the Damage They Cause
Here's what can realistically happen when your data gets sold:
- Marketing bombardment: You start receiving unsolicited pitches from streaming manipulation services or PR agencies you never contacted — because your information is now sitting in commercial databases.
- Discriminatory pricing: Some advertising platforms purchase performance data to gauge how desperately you need promotion, then quote you inflated prices based on that insight.
- Fake ownership claims: Leaked ISRC data in the hands of bad actors can be used to file false Content ID claims on platforms like YouTube, potentially freezing your earnings for an extended period.
- Competitor targeting: A rival distributor may purchase your data to send you aggressive switch-over pitches right around the time your contract is up for renewal.
How to Tell If Your Distributor Is Selling Your Data
There's no direct way to verify this, but there are warning signs worth watching for:
- Read the privacy policy carefully. Look for vague phrases like "we share your data with trusted partners" without any clear definition of who those partners actually are.
- Check whether the platform offers an explicit opt-out option for marketing data sharing.
- Pay attention to whether you start receiving marketing messages from services you never signed up for shortly after joining the platform.
- Search music forums and communities for other artists' experiences with the same distributor.
Practical Steps to Protect Yourself
- Use a dedicated email address: Create a separate email specifically for distribution platforms. If spam starts rolling in, you'll know exactly where the leak came from.
- Avoid linking your bank account directly unless necessary: Use intermediary digital wallets like PayPal or Payoneer wherever the platform allows, rather than connecting your personal bank account.
- Register your work with the relevant rights organizations: Signing up with bodies like ASCAP, SOCAN, or your country's local collecting society adds a legal layer of protection that makes fraudulent ownership claims significantly harder to pull off.
- Keep your own record of your ISRC codes: Save all your codes in a private file outside the platform so you're never completely dependent on a single distributor for access to your own metadata.
- Review the terms of service before you sign: If you spot a clause granting the distributor unlimited rights to "analyze and use" your data, that's either a negotiation point — or a clear reason to look elsewhere.
What to Do If You Discover Your Data Has Been Sold
If you have reasonable evidence that your distributor shared your data without your explicit consent, here's how to respond:
- Contact the distributor in writing and request a formal explanation of how your data has been used.
- File a complaint with the data protection authority in your country or in the country where the company is based. Companies operating in Europe are subject to the GDPR, which gives you the right to access and delete your personal data.
- Begin the process of pulling your catalog and moving it to another distributor, provided your contract allows for this without penalties.
- Change your login credentials and update any linked personal information as soon as you've made the decision to leave.