Pirate activists linked to Anna’s Archive have scraped nearly the entire Spotify music catalog, pulling 256 million rows of track metadata and 86 million audio files that total around 300 terabytes. The group started distributing this enormous dataset through peer-to-peer torrents on December 20, 2025, positioning the effort as an open preservation archive for music history. Spotify swiftly labeled the perpetrators anti-copyright extremists, confirmed unauthorized access to some audio content, and launched measures to contain the fallout.
The scraped data captures content largely up to July 2025, with some popular tracks from later releases included. Activists prioritized files based on Spotify’s internal popularity scores, retaining high-stream songs in their original 160kbps OGG Vorbis quality while compressing lesser-known ones to conserve space. This collection spans an estimated 99.6% of all platform listening activity and includes detailed metadata, such as artist details, album information, and unique international standard recording codes, for millions of tracks. Metadata torrents were made available first, followed by phased releases of audio files and supplementary elements, such as album artwork.
Anna’s Archive took credit in a detailed blog post titled “Backing up Spotify,” describing their shift from archiving books and papers to music as part of a broader mission to safeguard cultural works. They contended that current preservation initiatives overly prioritize popular or high-fidelity recordings, risking the loss of niche content due to corporate shifts or licensing expirations. Spotify’s extensive library, though not exhaustive, provided a solid foundation for a decentralized archive that anyone with adequate storage could mirror and maintain. The company and rights holders, however, regard the operation as clear-cut piracy that breaches strict licensing terms.
The activists accessed public metadata through Spotify’s web API endpoints and applied unrevealed techniques to evade digital rights management for large-scale audio extraction. They probably relied on numerous accounts or proxies to avoid detection over the extended scraping timeline. Spotify identified the irregular activity, verified it following the public disclosure, and responded by deactivating the affected accounts, implementing enhanced security measures, and maintaining vigilant oversight. Officials emphasized that user privacy remained unaffected, while pledging continued collaboration with labels and partners to ensure the protection of artist royalties.
This breach could deliver severe negative consequences for Spotify and the broader music ecosystem. Widespread availability of the archive enables tech-savvy users to construct personal offline streaming systems or even unlicensed public alternatives, potentially eroding subscription revenue as listeners opt for free options. It revives piracy threats reminiscent of early file-sharing eras, threatening to diminish overall industry earnings that already face pressure from streaming payouts. Furthermore, the high-quality dataset poses risks for unauthorized AI music generation training, complicating Spotify’s negotiations with tech firms over licensed data usage and possibly undermining future licensing value.
Long-term, the incident highlights vulnerabilities in streaming exclusivity models, where decentralized distribution renders complete removal impractical once files circulate on torrents. Spotify may face heightened scrutiny from investors over security lapses, as well as potential legal battles with rights holders seeking accountability. While immediate user migration seems unlikely, given the convenience of official apps, persistent underground access could gradually erode growth in paid tiers, especially in markets sensitive to cost. The event underscores ongoing tensions between digital preservation ideals and commercial copyright enforcement in an increasingly fragmented online environment.
