According to Billboard, users who “pre-save” an upcoming release to their Spotify accounts may be sharing more personal data with the act’s label than they think.

Pre-saving music means that users can add a release to their library as soon as it comes out. Spotify users click through and approve permissions that give the label way more account access than the streaming giant normally grants them — enough to track what they listen to, change what artists they follow and potentially even control their music streaming remotely, as written by Billboard

These permissions allow for labels to access some of the data that streaming companies usually keep to themselves in order to compete with other streaming giants. However, we are now in a time where the policies of online giants like Google and Facebook has made online privacy a controversial issue, which means that the pre-saving process could cause some concern. That is why so many computer users will start using a virtual private network to help shield themselves from prying eyes, and remain safe online without their privacy being compromised.

Labels are even asking for more permissions than needed. As an example, Spotify users who, tried to pre-save the Little Mix single “Bounce Back” from links shared by their label, Sony Music, were prompted to agree that Spotify could allow Sony to “view your Spotify account data,” “view your activity on Spotify” and “take actions in Spotify on your behalf.”

“I’m not sure if most people realize that,” says media analyst with Gabelli & Company, John Tinker. “There’s nothing they’re doing that’s illegal — it’s just that no one ever actually realizes when they sign off on these things what they mean.”

Billboard reports that the only access labels need to pre-save music on Spotify is permission to “add and remove items in your Library.” But the submenus for Sony’s Little Mix campaign asked users for 16 additional permissions, including to “control Spotify on your device” and “stream and control Spotify on your other devices.”

Pre-save campaigns help boost the first-week listening that can drive strong chart debuts and quickly became a music business marketing staple after Spotify added the feature as part of a 2017 update to its API, the software that allows online programs to share data. But now the feature has abecome a way for major labels and rights holders to get data on listeners.

Major labels are not the only parties who can ask for these kinds of permissions. As an example, independent singer-songwriter Ingrid Michaelson is using the digital marketing company feature.fm in the pre-save campaign for her upcoming album, Stranger Songs, and is asking for 12 additional permissions beyond those needed to pre-save the album — including access to users’ email addresses and control over private playlists. Although considering many agencies such as this Digital Marketing Company and more adhere to strict data privacy constraints, it doesn’t seem reasonable nor plausible that it will follow through.

Spotify has made it hard to see the extent of permissions that labels ask for, and has not taken actions to restrict information from third parties. On May 28, The Washington Post reported that Spotify was among the many iPhone apps that use data trackers to pass along information about users or devices to third parties in the middle of the night, while users sleep, as well.

“I think Spotify could do a lot better, and they ought to be clearer about the nature of consent,” says Pasquale. “Individual consumer action will change nothing: Most people are just too busy to hear about this problem and act on their own. Regulators have to step in and be aggressive in terms of punishing things that are clearly unfair or deceptive and making sue there are some basic standards that are met.”