In a blog post boldly titled "SORRY," Spotify chief Daniel Elk says, "We should have done a better job in communicating what these policies mean and how any information you choose to share will — and will not — be used." The TL;DR explanation of exactly how Spotify plans to access your personal data is simply that the streaming music service will not access your photos, location, voice, or contacts, unless you give "your explicit permission." In other words, you'll need to opt-in.
If you choose to op-in, the permissions will be used to unlock neat features in Spotify like recommendations based on where you're listening to music and "personalised cover art" based on photos you share with Spotify.
More specifically, that means that Spotify is not going to track your location unless you choose to share it. Spotify is not going to access your photos unless you say it's OK. And Spotify is definitely not going to use your microphone to spy on your daily life unless you want to use voice controls to tell Spotify what to do.
Many of the new features are opt in, and any of them you don't like, you can easily opt out of. That's pretty much exactly how every other app and service works. So who's fault is all of this? Well, perhaps it was wrong for us bloggers to freak out about the whole thing without first investigating the policies. At the same time, people are understandably guarded about their privacy, especially when so many services are misleading and dishonest about how they're using your data. At the very least, the end result is transparency, and that's the best possible outcome.
Read Spotify's full explanation here.