Spotify removed 75 million AI tracks in a year. The DSP enforcement wave is now trilateral.

On July 23, 2026, Spotify disclosed to the Los Angeles Times and Rolling Stone that it removed more than 75 million AI-generated tracks over the past 12 months as part of a sustained crackdown on royalty fraud, mass-uploaded "AI slop," and unauthorized voice replication. This is the third large-scale DSP-side AI enforcement move in the last 10 days, after Qobuz/FUGA on July 13 and Deezer on July 21. The pincer we described in those two pieces is now trilateral. Here is what closes today.

The numbers

Spotify's disclosure covers a 12-month rolling window, not a single-day sweep like Deezer's. Broken down:

The 205,000/day average is the operative number for distributors. It says that Spotify has been running an internal classifier at that volume for a year already, silently. The disclosure isn't a policy shift — it's a public acknowledgment of an enforcement layer that was already live.

Spammers shouldn't earn royalties that should go to professional artists and songwriters. — Spotify leadership, per LA Times

What Spotify is targeting

The disclosure names five specific enforcement layers:

1. Voice cloning ban. Unauthorized AI replicas of recognizable artists are removed on detection. No warning, no ticket — the track disappears.
2. Machine-learning spam detection. A behavioral pattern classifier that downranks or removes tracks matching the "AI slop" fingerprint: mass uploads from thin distributors, fake metadata, sub-30-second tracks designed to farm royalties, artificially inflated stream patterns.
3. DDEX metadata labeling. Spotify now distinguishes 100% AI-generated from AI-assisted at the DDEX manifest level. This is the same distinction Qobuz codified on July 13 — the labeling standard has real teeth now at both DSPs.
4. Anti-scraping defenses. Prevents generative AI companies from bulk-harvesting the Spotify catalog for training data. This is Spotify hitting back at Suno-style scraping (see the Suno leaked-code piece from six days ago).
5. Dedicated monitoring team. A human ops layer tracking evolving spam tactics in real-time. This is the piece distributors under-estimate — a human team means new tactics get patched in days, not months.

What is NOT being removed: AI content where the creator holds commercial rights, avoids unauthorized voice replication, and demonstrates genuine creative intent. AI-assisted mixing, mastering, and authorized remixes stay. The distinction is the same one every recent DSP move has landed on — 100% AI-generated is the removal category, not "AI touched the track anywhere."

The pincer is now trilateral

Ten days ago there was a single distributor-tier filter (FUGA for Qobuz). Two days ago there was a second-tier DSP catalog cleanup (Deezer, retroactive). Today there is a first-tier DSP catalog cleanup at Spotify's scale, disclosed retroactively for a year. Mapped side by side:

The prediction we made in the Qobuz post — "other DSPs follow within 6-12 months" — collapsed to eight days for Deezer and to ten for Spotify. The prediction market is closed. The forecast now is simpler: Apple Music and Amazon Music land within the next quarter, because they already run internal AI classifiers for royalty-share calculations and now have public cover to act on the output.

The false-positive tax nobody is talking about

Spotify's 75 million removal figure is the ceiling of a math problem. Suppose the classifier runs at 99% accuracy — an aggressive target for any production ML system. Over 75 million removals, a 1% false-positive rate is 750,000 human tracks incorrectly taken down in a single year. At 99.5%, still 375,000. These are real releases from real artists, and their remedy is the same as at Deezer: an appeal that only works with independent evidence.

The evidence bar is not "the artist claims it's their voice." It is a timestamped, signed technical analysis from a detector unaffiliated with the DSP or the distributor. Model version, per-class probabilities, cryptographic hash. Attached to the appeal at appeals@spotify.com or the equivalent for whatever DSP hits the artist next.

Two audiences with acute exposure right now:

1. Independent artists releasing after 2024. These are the years generative AI became commercial. Any human release from this window is more likely than average to trip an internal classifier that was trained on the same era's generative output. If your record is post-2024 and human, you are in the false-positive risk pool.
2. Distributors delivering into Spotify without pre-upload classification. Your catalog was already being scored internally by Spotify — you just didn't have visibility into the score. Now the score decides who gets removed. Sub-distributors without their own classification pass are downstream of both the removal AND the label conversation with the artist ("how did this happen?").

Voice cloning is now a takedown category, not just a copyright issue

The voice cloning ban is the enforcement piece with the fastest activation. If you record with your own voice and your track has a distinctive vocal signature, Spotify's classifier can — and will — misfire on you. The remedy for a misclassified voice clone flag is not "prove copyright." It is "prove this is your voice, not a synthesized replica."

That is a proof-of-humanity problem, and it applies to a much wider set of artists than the classical voice-clone target (dead celebrities, catalog artists whose likeness Suno-style models trained on). Any indie artist with a recognizable vocal identity now has skin in the game.

What to do this week

If you're a distributor:

1. Wire pre-upload classification. This is now table stakes across FUGA, Deezer, and Spotify. The specific verdict class matters — you need to distinguish human, hybrid, licensed-AI, and unlicensed-AI so the DDEX manifest carries the right AIGC label per Spotify's new metadata standard.
2. Capture and store a signed certificate per human release at ingest. Six months from now, when Spotify retroactively removes something that was human all along, your artist calls you first. Having the certificate on file lets you answer with evidence instead of promises.

If you're a human artist:

1. Run each of your recent releases through a detector once and save the certificate — especially if you have a distinctive vocal signature or if you record in a genre where Spotify's classifier has been aggressive (electronic, ambient, lo-fi hip-hop, spoken word).
2. If a lookup returns uncertain or hybrid on a track you know is 100% human, pay for the full report. The signal breakdown tells you which acoustic characteristics tripped the classifier, and sometimes the fix is upstream (mix decisions, production choices, metadata).

What DistroShield emits for the Spotify case

The production classifier (v9, 4-class primary + v8 attribution) maps directly to Spotify's new DDEX distinction:

The signed certificate returned by the API — model version, per-class probabilities, timestamp, SHA-256 hash — is the same artifact that appeals to Deezer or Qobuz. One integration, three DSPs covered. Apple and Amazon fold in automatically when they publish their DDEX schemas, because the shape of the response was already designed around the AIGC standard.

The window is closing faster than the industry has adjusted

In ten days: one distributor filter, two DSP catalog cleanups, one of them at the platform that pays 30%+ of most indie artists' recorded-music income. If your ingest still relies on manual review or trust in the artist's stated origin, the failure mode changed from "occasional embarrassment" to "systematic loss of catalog." The tools to answer per track are cheap. The cost of not answering keeps compounding.

DistroShield's public lookup returns a verdict on any track for free. A signed certificate — the artifact you attach to a Spotify appeal, a Deezer takedown reversal, or a FUGA delivery escalation — is $5 and takes a minute. Distributor API pilots run seven days, 50 tracks, no credit card.