Spotify's privacy policy got a rather significant update: http://t.co/XjPbIvRHv1
— Forbes Tech News (@ForbesTech) August 21, 2015- it wants access to photos, contacts (suggests you may need the permission of your contacts before agreeing to this) and files on your phone
- wants access to your location and also potentially your movements (whether you're running or walking)
- doesn't matter whether or not you're a paying customer
- on prompting Spotify have issued a statement saying (among other things) "The data accessed simply helps us to tailor improved experiences to our users, and build new and personalised products for the future."
source
I looked this up after I got the prompt from spotify to agree to updated policy