SoundCloud

Is SoundCloud safe?

Mostly, if you treat it as the open platform it is. SoundCloud is where unsigned artists upload their own tracks, and that openness is the point. It also means SoundCloud behaves more like a social network than a jukebox: strangers can comment and send messages, the free tier is paid for by tracking ads, and in December 2025 attackers pulled email addresses for about a fifth of its users. We score it 54/100, below Spotify (57) and level with YouTube (54).

The December 2025 breach

On 15 December 2025 SoundCloud said it had detected "unauthorized activity in an ancillary service dashboard". The data taken was email addresses plus information already visible on public profiles, and it affected about 20% of users. SoundCloud said no passwords or financial data were accessed. Two denial-of-service attacks then knocked the website offline for a while.

The attackers tried to extort the company. In a January 2026 update SoundCloud said the group had "made demands and deployed email flooding tactics to harass users, employees, and partners", and that it was working with the authorities. The data was published online, and Have I Been Pwned added 29,815,722 SoundCloud accounts on 27 January 2026. SoundCloud's final update, on 24 February 2026, said an outside investigation had confirmed that no sensitive data was taken.

That is less serious than a password leak, but it is not harmless. A list that ties a real email address to a named music profile is ideal for convincing phishing, such as a fake "copyright strike" or "distribution payment" email aimed at an artist.

Ads, tracking and your listening data

Apple's privacy label lists location, identifiers and usage data that may be used to track you across other companies' apps and websites. A user ID is linked to you for third-party advertising, and payment details, email, uploads and search history are linked to you too. Google Play's data safety section says device IDs and app interactions are shared with other companies for analytics and advertising.

The privacy policy, last amended on 17 August 2026, fills in the detail. SoundCloud may pass your email address in hashed form to ad partners, including social networks, to show you SoundCloud ads elsewhere. Rights holders who license music to SoundCloud can receive listening data and public profile details. Users outside the EU and UK can switch off the use of third-party data for ads in their settings; in the EU and UK personalised ads depend on cookie consent. Subscribing to Go or Go+ removes the ads but not the data collection.

The AI terms row

In February 2024 SoundCloud added a line to its terms allowing it to use uploaded content to "inform, train, develop or serve as input" to AI technologies. Artists noticed in May 2025 and the clause spread on social media. On 14 May 2025 chief executive Eliah Seton wrote that the wording "was too broad and wasn't clear enough", and said SoundCloud had never used artist content to train AI models.

The terms now say SoundCloud will not train generative AI models that aim to replicate or synthesise your voice, music or likeness without your explicit consent through an opt-in. That is a real commitment for musicians, but it is narrower than a full ban: SoundCloud says it still uses AI for recommendations, search, tagging and fraud detection.

Scams and unwanted messages

Unlike most music apps, SoundCloud has direct messages, and you decide whether anyone on SoundCloud can write to you or only people you follow. Its help pages warn against phishing, deals that are "too good to be true" and requests for unreleased demos or private downloads. The privacy policy says SoundCloud scans links in private messages for phishing, malware and fraud.

For younger users, the open model is the weak point. The terms set a minimum age of 16 in the EU and UK and 13 elsewhere, and the App Store rating is 13+, but we found no teen-specific limits on messaging like the ones at BandLab.

How to use SoundCloud more safely

1. Turn on two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login from the website settings and save the backup codes.
2. Set messages to "only people you follow" in Privacy Settings.
3. Treat any email or message about copyright strikes, payouts or promotion deals as suspect, and sign in through the app instead of a link.
4. Outside the EU and UK, switch off third-party data for ads; in the EU and UK, reject advertising cookies.
5. If your email is in the breach list, expect targeted phishing and change your password if you reused it anywhere.

How we scored it

The regulatory record (85) is the strongest factor, with no fine or order found. Privacy (40) is the weakest: location and identifiers are used for tracking, and hashed emails go to ad partners. Security (53) is held near the middle by the 2025 breach of about 30 million email addresses, softened by two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login and the absence of password data. SoundCloud also runs a public bug bounty on Bugcrowd that covers its apps and website and pays $200 to $4,500. Scams and harmful content (55) reflects open uploads and messaging with no teen limits that we could find.