What is the sp_landing cookie?
sp_landing is an HTTP cookie associated with Spotify's services, found on the .spotify.com domain. It typically appears when a visitor interacts with an embedded Spotify player, a „Listen on Spotify” button, or is redirected to a Spotify page from a third-party site.
The cookie is set by Spotify, not by the hosting website, but it may be triggered by a script or iframe embedded by that site's administrator.
What data it stores
The cookie stores information about the landing page through which the user began interacting with Spotify, used to correlate the current session with the traffic source or associated marketing campaign.
The exact value format is not publicly documented by Spotify and may vary. The data is sent to Spotify's servers (the .spotify.com domain and possibly related subdomains), not to the site hosting the widget.
What it is used for
From Spotify's perspective, this cookie helps measure the effectiveness of marketing campaigns and attribute traffic to specific pages (for example, a promoted album, artist, or playlist).
For the site embedding Spotify content, this cookie provides no direct functional benefit – it exclusively serves Spotify's analytics and advertising interests.
Does it require consent?
sp_landing is classified as a marketing cookie (advertising/tracking), falling outside the „strictly necessary” category. Under Romania's Law 506/2004 (transposing the ePrivacy Directive) and the GDPR, this type of cookie requires the visitor's prior consent before being set.
- Site administrators must disclose this cookie in their cookie policy.
- The Spotify script/widget generating it should be blocked until consent for the marketing category is obtained.
- ANSPDCP (Romania's data protection authority) can sanction the lack of consent for tracking cookies.
How to block or delete sp_landing
A visitor can manually delete or block this cookie via browser settings (Chrome, Firefox, Edge, Safari – per-site cookie management), or use private/incognito browsing.
For site administrators, the recommended solution is a consent management platform (CMP) that automatically blocks Spotify scripts and iframes until the visitor accepts the marketing category – for example, CookieFix can load such widgets only after explicit consent, preventing premature setting of cookies like sp_landing.
Frequently asked questions
It's an HTTP cookie set by Spotify on the .spotify.com domain, used for marketing purposes related to the page through which the user reached Spotify content.
Its typical duration is 1 day, after which it expires automatically.
Yes, since it's classified as marketing/tracking, it requires the visitor's prior consent under the GDPR and Law 506/2004.
By blocking the Spotify script or iframe until consent for the marketing category is granted, using a consent management platform (CMP).