Spotify's rotating QR code treats paying families like suspects

Is it reasonable to ask a paying customer to stand next to the person who pays the bill, phone in hand, to prove they belong to the same family? Spotify seems to think so. We think the rule behind it is fair. The way it is being enforced is not.

Spotify wants proof you share a roof, and wants it in person

According to Music Business Worldwide, Spotify is asking some Premium Family members to prove they live with the plan manager. The manager opens a QR code in the app and the member scans it with their own phone. The code changes every few seconds, which is meant to make a screenshot hard to reuse. The member has seven days from the notification. Miss the window or fail, and they can't join a different Family or Duo plan for 12 months.

Spotify hasn't announced this beyond a support page, and the page says only that it may ask "some" members. Users on Reddit spotted the prompts first. Some reportedly already beat the check by pointing a second device at the manager's screen over a video call.

The rule is fair. The method is the problem

Let's be clear about where we stand. Spotify's US terms already say Family members must reside at the same address. As Engadget notes, co-CEO Alex Norström described this on an earnings call as enforcing existing rules. A company is entitled to enforce its terms, and we won't pretend that a plan for people living "under one roof" was ever meant to cover friends in other cities.

But the rule being legitimate doesn't make every enforcement tool proportionate. The QR check puts the burden on the customer, with a clock. A family with a student away at university, or someone working abroad for a few months, may well qualify as a household. They would still have to coordinate an in-person scan within a week, as Mashable points out. That is a bureaucratic chore, not a security measure.

And the penalty looks steep. A year-long block from other shared plans, applied to someone who may simply have been out of town for seven days, strikes us as out of scale with the offense. Even the support page is vague about what happens to the member's access afterward. PPC Land notes that the QR section doesn't say whether they stay on their current plan.

Surveillance-lite, or just clumsy?

We'd stop short of calling this surveillance in the strict sense. In its address verification section, Spotify's page says "We don't track your location. We only check your address to verify." Nothing in the documentation shows the scan collecting more than that, though PPC Land points out that the page doesn't explain what the scan transmits.

Still, the posture matters. A check that demands proof of physical proximity treats every flagged member as a suspect until proven otherwise. It also appears easy to defeat: if a video call and four devices are enough, as one Reddit user described, the people it catches may be the ones who don't bother to cheat. That could mean honest families with awkward schedules.

There's also a business reason, and it's not subtle. Goldman Sachs, in a report published October 15, argued that streaming services could capture more value by "tightening the definition/eligibility of the family plan, without meaningfully impacting demand," and said Netflix's crackdown showed "room" for periodic address verification. That is the bank's view, and we read the QR code as part of that logic: monetization first, family second.

Check your plan now, and Spotify should soften the penalty

The economics explain why people share. In the US, Family costs $21.99 a month for up to six accounts, while Premium Individual is $12.99. Split six ways, Family is roughly $3.67 each. Take that away and the alternative is more than three times the price.

Our advice to readers is simple. If everyone on your plan genuinely lives at your address, you have little to fear, but keep the app updated and respond to a prompt immediately. If you've been stretching the definition for years, assume the rule will be enforced sooner or later and consider moving to your own Individual plan before you're forced to. Duo won't help here: it is covered by the same same-address rule and the same 12-month bar.

Spotify, for its part, could make this far less hostile. It could allow a longer window, offer an alternative for temporarily separated households, and publish clear consequences for failure. It could also drop the year-long block for first-time misses. Netflix-style enforcement worked for Netflix, but music is a service people tend to hold onto for years, and Spotify risks souring that relationship for a few extra subscriptions. We think it should enforce the rule and keep the suspicion out of it.