The SoundCloud audio player can be embedded in websites to play audio files. As the name of the service says, it is a playback tool for audio files, such as audiobooks, podcasts and so on.
An analysis shows that SoundCloud may only be used on websites with consent. But even then, legal questions remain.
SoundCloud is not a German construct, but has roots in the UK and uses American services.
On the other hand, audio files can simply be played without SoundCloud (unless you want to support the SoundCloud universe). This raises the question of why SoundCloud should be used or supported at all.
Privacy problems with the SoundCloud audio player
Data transfer to an American company
Embedding the SoundCloud script establishes a connection to the domain soundcloud.com as soon as the website is loaded. In the process, a file is also retrieved from the domain sndcdn.com. The script additionally loads further files from soundcloud.com and subdomains.
A lookup at ARIN, the American Registry for Internet Numbers, shows, for example, that the IP address 65.9.66.6 belongs to the following company:
A data transfer to the USA, or to a US company to which American authorities have access under a Presidential Executive Order, is therefore potentially taking place (keywords: Cloud Act, EO12333 and FISA). As is well known, this contradicts the GDPR (see CJEU ruling on the Privacy Shield and Art. 44 GDPR).
Cookies
SoundCloud sets cookies. As soon as the script is embedded, the cookie named sc_anonymous_id is set with a lifetime of 10 years. The cookie name should not obscure the fact that it is potentially a tracking cookie. An example value shows what I mean: 107222-829866-225395-88888.
Such a value is obviously suitable for uniquely identifying a user worldwide, potentially for 10 years.
After a certain playing time, SoundCloud sets further cookies, namely the one just mentioned and others:
- sc_anonymous_id (lifetime: 10 years, example value: 107222-829866-225395-88888)
- _pxvid (lifetime: 2 years, example value: 0cb734d3-5d21-21eb-8320-0242ac220000)
- sclocale (lifetime: 2 years, example value: de)
Unfortunately, there is no information from trustworthy sources on what these cookies are for. Whoever embeds the SoundCloud audio player on their website can therefore not explain it sufficiently. This contradicts the GDPR. In my view, this alone rules out a legally compliant use of the SoundCloud player.
Why these cookies require consent is explained in numerous articles on Dr. DSGVO. Keywords are § 15 (3) TMG, Art. 5 (3) ePrivacy Directive, the German Federal Court of Justice ruling on Planet49 and § 25 TTDSG (from December 2021).
Company headquarters
According to the legal notice of the website soundcloud.com, the company's seat is Berlin, Germany. However, the legally responsible party is a company with the address c/o Third Floor, 20 Old Bailey, London, EC4M 7AN, United Kingdom.
The legal notice of SoundCloud is somewhat odd and, in my view, unlawfully drafted, because it leaves open questions that a legal notice is actually supposed to answer. For example: Which company is responsible for the website? Who is the limited partner of SoundCloud Global Limited & Co. KG?
According to a WHOIS query, the WHOIS server whois.gandi.net is able to provide information on the registrant of soundcloud.com. The result matches the contact given in the legal notice of soundcloud.com. The registrant is SoundCloud Global Limited & Co. KG in Germany.
To use the service, the controller must state who the provider of the service is and who the data recipients are.
Recommendation
Because the SoundCloud player sets a cookie as soon as the script is loaded, which is functionally completely unnecessary, a consent request before embedding the script is strongly recommended.
Because of the two other cookies set after playback starts, a consent request is advisable at the latest before the audio file is played. However, since the audio player allows no external control after loading, consent must be requested before the script is loaded. Regarding the consent request, please note that common consent tools such as Cookiebot, UserCentrics, Borlabs Cookie, consent manager, OneTrust, CCM19 or Klaro! are, according to my tests, not suitable for achieving legally secure websites.
Because the legal notice on the SoundCloud website is, in my view, so sloppily drafted, I believe one cannot place great trust in the company with regard to data protection. I therefore generally advise against using this tool.
The location of the registrant of SoundCloud addresses also speaks for no longer using SoundCloud, unless you want to harm the domestic economy and hand even more data to Amazon.
Replacing SoundCloud easily
There is a simple alternative to SoundCloud: with the HTML audio element, a way to play MP3 files can be offered that raises no privacy questions. For this, the audio file should be stored locally on your own server. Example:
<audio id="audio_with_controls" controls src="/audiodatei.mp3" type="audio/mp3" ></audio>
HTML audio element for playing sound files.
The player then looks like this:
As you can see, the playback element has everything an audio player needs. Embellishments, for example adding an image or text, should be no problem nowadays.
If you want to add your own buttons for playing and stopping the audio file, you can do so with the following JavaScript code:
var player = document.getElementById("audioPlayer");
function playAudio() { player.play(); }
function pauseAudio() { player.pause(); }
Privacy problems are inevitable with SoundCloud because even a consent request does not appear to be legally secure due to missing information.
Instead of SoundCloud, a very simple, privacy-compliant solution can be used in many cases.
Key takeaways of this article
Using the SoundCloud audio player on websites is problematic under data protection law, as it transfers data to US companies and sets cookies whose purpose is unclear.
The text warns against using SoundCloud because the legal notice is unclear and data protection appears questionable. It recommends using the HTML audio player instead.
To avoid privacy problems, SoundCloud is often not a good choice. There are simpler, privacy-compliant alternatives.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
