Spotify Car Thing Bricking: Paid Hardware Deliberately Rendered Useless

Spotify announced it would discontinue support for Car Thing, a $90 hardware device, rendering all units completely nonfunctional. Unlike typical product discontinuations where hardware continues working without updates, Spotify planned to remotely brick the devices, turning them into electronic waste. The decision affected customers who purchased the device as recently as months before the announcement. Privacy implications included the fact that Car Thing collected driving pattern data, voice commands, and listening preferences linked to Spotify accounts. Users had no ability to repurpose the hardware or export their usage data before the bricking date. The incident illustrated the risks of connected hardware that depends on cloud services: when the company decides to end support, customers lose both the device functionality and the data generated through its use. Consumer advocates filed FTC complaints arguing the planned bricking constituted unfair business practices.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.