Pandora

Is Pandora safe?

Yes, for listening. Pandora plays licensed music and podcasts, has no messaging between listeners and no public comments, and we found no breach of its accounts. We score it 58/100, about level with Spotify (57) and below YouTube Music (65).

What pulls the score down is how Pandora pays for its free service. Most of its revenue comes from ads, and those ads are targeted using your location, your listening and the devices you use. Logins depend on a password alone.

Pandora and your data

Pandora has 39.8 million monthly listeners, but only 5.6 million pay, according to its owner's June 2026 quarterly report. The rest hear ads, and the data behind them is wide.

Apple's privacy label lists location, contact info, identifiers and usage data as used to track you across other companies' apps and websites. On Android, Pandora tells Google Play that it shares approximate location, device IDs, email address and user IDs with other companies, partly for advertising. It also lists voice or sound recordings as shared for advertising or marketing, which few music apps declare. Precise location is collected as an optional extra for advertising.

Since 2019 Pandora has been part of SiriusXM, and the two share one privacy policy, effective March 2026. It says SiriusXM uses its own and licensed modelling tools to infer information about you from your listening history and demographics for marketing and advertising. Precise location can be passed to ad and analytics partners where state law allows. SiriusXM says it does not sell personal data "for profit", but accepts that some of its ad-related disclosures may count as a sale under state privacy laws. It does not sell or share data for targeted ads about users it knows are under 18.

Accounts and security

There is no record of a Pandora data breach in California's breach register or in the Have I Been Pwned database. That is a good sign, but the account protections are basic. We found no two-step login, so a password reused from a leaked site is the main way into an account.

Pandora also has no paid bug bounty. Its HackerOne listing is an external programme that asks researchers to email [email protected] and states that no rewards are offered. Google Play says data is encrypted in transit and that you can request deletion.

Content and children

Pandora is one of the calmer apps a teenager could use. It is mostly radio-style stations and on-demand music from licensed catalogues, plus podcasts. Listeners cannot message each other, and there is no comment section where strangers can reach them.

The App Store rates Pandora 13+, the same minimum age as its privacy policy. The rating notes infrequent mature themes, profanity and drug references, which come from songs and podcasts rather than from other users. Your content settings can block explicit tracks, which handles most of it.

SiriusXM's legal record and Pandora

Pandora itself has no fine or order against it in the last 10 years that we could find. Its parent has had more trouble. In November 2024 a New York court ruled, in a case brought by the state attorney general, that SiriusXM's phone-and-chat cancellation process broke the federal Restore Online Shoppers' Confidence Act. That ruling concerns Sirius subscriptions, so we treat it as background for Pandora. You can read more on our SiriusXM page.

SiriusXM's quarterly report also lists a royalties lawsuit filed in 2024 by the Mechanical Licensing Collective against Pandora. It is a dispute about payments to songwriters, not about listeners.

How to use Pandora more safely

1. Use a unique password, and protect the email account linked to Pandora.
2. Use the privacy rights page at pandora.com/privacy/ccpa to opt out of the sale or sharing of your data for targeted ads.
3. Turn off location access for Pandora in your phone settings.
4. Leave the microphone permission off unless you use voice search.
5. Block explicit content in the settings of a teenager's account.

How we scored it

The regulatory record (85) is Pandora's strongest factor, since no regulator decision names it. Scams and harmful content (80) is close behind, thanks to licensed content and no contact between listeners. Privacy (38) is the weakest, because of location tracking, ad profiling and shared voice data. Security (55) reflects a clean breach record but no two-step login and no paid bug bounty.