Last month, a curious website began circulating online. At first glance, it seemed playful—simply a list of Spotify playlists linked to around 50 high-profile individuals, including politicians, tech leaders, and journalists. But the story behind the site was far more intriguing. An anonymous figure, introducing himself only as “Tim,” had uncovered the listening habits of these public figures and displayed them for the world to see under the mischievous title “The Panama Playlists.”

The name was no coincidence. It was a tongue-in-cheek reference to the infamous Panama Papers, the document leak that exposed global offshore banking activities years earlier. Where that scandal unveiled hidden wealth, the Panama Playlists revealed something arguably more personal: people’s music choices, the songs they put on repeat, and the guilty pleasures they might never have wanted the public to know.

For those caught in this prank, it felt like a warped version of Spotify Wrapped—a reminder that in the digital age, even the most trivial personal data can become unexpectedly public.

A Window Into Private Listening Habits

Among the names exposed were several prominent figures in business and technology. Salesforce founder Marc Benioff allegedly kept a playlist featuring the cheeky anthem “Billionaire.” Political strategist Jacob Helberg appeared to have eclectic taste, mixing pop stars like Charli XCX with rising artists such as Chappell Roan. A playlist tied to Sam Altman, CEO of OpenAI, even suggested he once used Shazam to identify Missy Elliott’s “Get Ur Freak On.” (That particular list has since disappeared, and Altman’s team later denied ownership of the account.)

Two journalists, Mike Isaac and Kashmir Hill of The New York Times, were also swept up in the exposure. Tim’s digging showed that Mike had listened to “Huggin and Kissin” by Big Black Delta an astonishing 139 times over the past year. Kashmir’s writing playlists, meanwhile, revealed an affinity for Mogwai and Aphex Twin—music she admitted helps her focus, though she was disturbed to find personal playlists named after her children had been made public.

Other revelations leaned toward the humorous. U.S. Vice President JD Vance was linked to the Backstreet Boys’ classic “I Want It That Way,” a revelation that quickly spread online. While many found it funny, it also highlighted the uneasy line between entertainment and invasion of privacy.

Why This Felt Different From Normal Online Sharing

In today’s social media-driven world, most of us carefully curate what we show online. We choose which vacation photos go on Instagram, which movies we list on Letterboxd, and which books we display on our Zoom backgrounds. These are intentional choices designed to shape our personal brand.

Spotify playlists, however, are usually created for personal enjoyment—not for public consumption. Having them revealed felt closer to exposing someone’s Netflix watch history, showing what they genuinely consume rather than the image they project. It was a subtle but powerful reminder: what we think is private may not be.

Spotify, for its part, has long positioned public playlists as a feature, encouraging sharing as a way to build community and discover new music. But by default, every new playlist is public unless users deliberately switch the setting to private. Many people—including reporters who cover privacy for a living—were surprised by just how visible their accounts actually were.

Who Was Behind the Prank?

Eventually, “Tim” revealed himself as Riley Walz, a 23-year-old engineer fascinated by the amount of personal data freely available online. Using custom-built bots, he scraped Spotify data linked to dozens of political, media, and entertainment figures.

Finding the accounts was surprisingly easy. Many people had signed up years ago when Spotify automatically tied accounts to real names or email handles, leaving them searchable. “All I had to do was type their names into the search bar,” Walz explained.

Unsurprisingly, Spotify was not amused. A spokesperson said that scraping data violates the platform’s User Guidelines and confirmed their legal team had contacted Walz with a cease-and-desist order. Walz, however, dismissed the claim, arguing that the data was already publicly available.

A History of Playing With Data

The Panama Playlists were not Walz’s first experiment. He had previously created LooksMapping, a project that analyzed Google reviews to rank restaurants based on the perceived attractiveness of their patrons. Another project, IMG_0001, highlighted how older iPhones once made it easy to upload raw videos directly to YouTube.

For Walz, these projects share a theme: demonstrating just how much personal information is scattered across the open internet. “Thirty years ago, I couldn’t just walk into an office and ask for their private records,” he said. “Now, with the right tools, anyone can collect this kind of information in minutes.”

A Broader Trend: Public by Default

Spotify is hardly the only company designing systems where personal activity is visible by default. Venmo once made transaction histories public until widespread backlash forced changes. Substack subscriptions are publicly viewable, exposing what newsletters people follow or pay for. Even Instagram’s location-sharing feature, though not default-enabled, caused an uproar when launched, forcing executives to reassure users about privacy controls.

These examples highlight a broader issue: the digital platforms we rely on often treat privacy as an opt-out choice rather than the default. And most users never realize what they’ve left exposed.

Legal scholars like Neil Richards, a law professor at Washington University, argue that this undermines what he calls “intellectual privacy”—the right to read, listen, or watch without fear of judgment or surveillance. Our private consumption habits, he argues, reveal far more about us than we might expect.

Mixed Reactions From the Exposed

Some figures took the Panama Playlists in stride. Palmer Luckey, creator of Oculus and founder of Anduril, admitted he once created a playlist dedicated to Pokémon but shrugged off the exposure, noting he now prefers old-school devices like cassettes and CDs. Coinbase CEO Brian Armstrong confirmed that he listens to a single song—Gareth Emery’s “Long Way Home”—on repeat for hours to concentrate. Helberg, for his part, laughed off his playlist, remarking that real-world music tastes rarely match the “indie-only” image people project.

But others, particularly journalists and politicians, were unsettled. For them, it was a stark reminder of how even benign personal data can be weaponized for embarrassment or ridicule.

What This Means for the Future of Privacy

The Panama Playlists may not be as explosive as the Panama Papers, but the cultural implications are significant. It illustrates how everyday digital activity—from music streaming to mobile payments—can inadvertently create a digital footprint that is both accessible and revealing.

Younger generations may be more comfortable with constant sharing, from Snap Maps location updates to read receipts in messaging apps. But even they express discomfort when companies roll out new forms of exposure without consent.

The key lesson is clear: privacy online is rarely the default. Whether it’s playlists, purchases, or subscriptions, users must actively protect their digital lives—something many people don’t realize until their habits become headlines.

Conclusion

The Panama Playlists prank was equal parts entertaining and unsettling. On one hand, it showcased the humor in exposing that powerful figures enjoy the same guilty-pleasure songs as everyone else. On the other, it reminded us how fragile our sense of privacy has become in an era where so much of our personal data lives online.

As companies like Spotify, Instagram, and Venmo continue to walk the line between social sharing and surveillance, users will need to be more vigilant than ever. What feels private today may be tomorrow’s viral leak.

The digital age has blurred the boundary between the public and the personal. And if the Panama Playlists taught us anything, it’s that our playlists—like the rest of our online footprints—are telling stories about us, whether we want them to or not.