The worst agreements we've found. Every entry quotes the company's own clauses verbatim, with a link to the source and the date we retrieved it. The commentary is ours; the clauses are theirs.
Effective September 1, 2021. Nobody has touched it since. Start with who's allowed to sign this thing. You must be at least 13. If you're a minor, you need a parent or guardian's permission. And you must warrant that you have the authority to bind your record label to a New York arbitration agreement. Read that in order: a thirteen-year-old, with a permission slip, signing away a company's right to a jury trial. And it sticks — you promise you're authorized regardless of whether you stay authorized. The kid quits the label. The label is still bound. Then the money. If Spotify wrecks your account, their maximum exposure is thirty dollars. But the arbitration section promises a thousand dollars if you beat their final settlement offer — so the prize for winning is thirty-three times the most you were ever permitted to win. Somebody wrote both numbers into the same document and shipped it. Not that you'll get there, because your sole and exclusive remedy is to uninstall the software. Spotify for Artists is a website. There is nothing to uninstall. And there's a whole paragraph explaining that Apple will refund your purchase price, which is zero. The parts the lawyers clearly did mean: you indemnify Spotify for glitches in Spotify's own data, you waive class actions, and you have one year to complain about anything. If you're on a label: find out who clicked accept, because whoever it was bound the entity permanently. If you're the artist: back up your analytics yourself. Our opinion on the text as published. Not legal advice — if catalog rights are involved, get a lawyer.
Iru makes the agent your IT department installs on your work laptop, so the interesting question isn't what they collect from website visitors. It's what the thing on your machine sees, and who you can complain to about it. Our read: the collection is granular and tied to your legal name, the complaint channel routes back to the employer who installed it, and the document contradicts itself on whether your data goes to marketing partners — not once, but across a narrative section, a table, and a legal denial that no two of which agree. There's also a promised opt-out with no visible mechanism to exercise it, and open-ended retention with no ceiling. And the sentence defining who "we" even means still names three Kandji subsidiaries. The company rebranded; the policy didn't. Someone opened this file in October 2025, edited it, saved it, and walked straight past the old company name in paragraph one. Keep that in mind when you reach the part about reasonable technical and organizational measures. If you're an employee: ask IT what Iru configuration is on your device and what it transmits — Iru won't tell you, by their own rules. Turn on GPC in every browser, individually. If you're signing the contract: put a number of days on retention in the MSA, and demand notice of policy changes instead of silent posting. This is our opinion on the text as published, read against the revision last modified October 22, 2025. Not legal advice — a contract that matters deserves a real lawyer.