Not just social information
As written, if you agree to Spotify's new contract, you give permission for Spotify to "collect information stored on your mobile device, such as [but not exclusively]...."
https://www.spotify.com/us/legal/privacy-policy/?version=1.0.0-GB
"3.3 Information Stored on Your Mobile Device
With your permission, we may collect information stored on your mobile device, such as contacts, photos, or media files."
That's rather more broad than just contacts. "Media files" could be...any file (they don't say which media). They also chose the open-ended "such as" instead of a bounded phrase like "possibly including." "With your permission?" This is a contract. None of it is binding without your permission. Or as they put it "If you don't agree with the terms of this Privacy Policy, then please don't use the Service."
Okay, but what can they do with the data they might snaffle off your device? "YOU EXPRESSLY AUTHORISE SPOTIFY TO USE AND SHARE WITH OTHER COMPANIES IN THE SPOTIFY GROUP, AS WELL AS CERTAIN TRUSTED BUSINESS PARTNERS AND SERVICE PROVIDERS...." Also to law enforcement, to protect Spotify, for academic use, for information about the service, or as an asset to be sold. (Section 5.2.5)
That's pretty much whatever they want, then.
Spotify can finally tell us what songs are most popular during Uber's Rides Of Glory http://rideofglory.blogspot.com/
Biting the hand that feeds IT
