An anonymous researcher operating a newly launched website called Panama Playlists published what the site says are the Spotify playlists and listening histories of multiple politicians, tech leaders and journalists, including Vice President J.D. Vance, White House press secretary Karoline Leavitt and former Florida Attorney General Pam Bondi.
The site, which went live recently, posted screenshots and links it says correspond to private and public Spotify accounts it identified after what the creator described as “a little sleuthing.” The Panama Playlists operator provided examples of songs they attribute to specific officials — saying Vance often plays the Backstreet Boys’ “I Want It That Way,” Leavitt listens to Beyoncé’s “Run the World (Girls)” to get “pumped up,” and Bondi plays Nelly’s “Hot In Herre.” The site’s creator wrote that many of the accounts used real names and that some users have settings enabled that reveal their last-played songs.
In a note on the site, the anonymous researcher said they have been scraping public Spotify data continuously since summer 2024 and that the collection allows them to determine what songs users played, how many times and when. The operator emphasized that the project relied on information the researcher described as publicly available and said there is no affiliation with Spotify.
Panama Playlists framed the effort as playful rather than malicious, presenting short profiles and playlists it attributes to public figures and providing links it says lead to the corresponding Spotify pages. The site stopped short of asserting that accounts were definitively private or hacked, instead claiming identification through pattern-matching and other open-source techniques.
The disclosures raise questions about how much information users of streaming platforms expose when they maintain public profiles or enable playback visibility. The site’s operator said some accounts have settings that display the last played song and that continuous scraping of that publicly visible data produced the timelines posted on Panama Playlists.
Representatives for the named officials did not immediately respond to requests for comment. The site’s anonymous creator did not make themselves available for interview beyond the notes and excerpts posted on the site.
Spotify’s public policies allow users to maintain public profiles and share playlists, but the platform also provides privacy settings that can limit visibility, including a private listening mode and options to hide recently played activity. The Panama Playlists operator asserted that the data it published came from accounts and settings that were publicly accessible, rather than from breaches of private systems.
Cybersecurity specialists and privacy advocates have previously cautioned that information people post publicly online can be aggregated and analyzed in ways the original poster may not anticipate. Aggregated listening patterns, timestamps and publicly listed followers or playlists can be combined to build profiles of public activity. The Panama Playlists disclosure is the latest example of how such aggregation can draw public attention to seemingly mundane account data.
The site included posts on figures beyond the three named in its initial examples and suggested the operator would continue to add profiles. It did not, in the material posted, outline any commercial intent or sell access to the data; Panama Playlists described the project in lighthearted terms and invited readers to explore the listings.
The disclosures are likely to prompt renewed scrutiny of privacy settings on streaming platforms among public figures and private users alike. How platform operators and account holders respond could determine whether the material remains accessible as presented or is altered through privacy changes, account settings adjustments or platform interventions.
Panama Playlists’ revelations come as public attention to digital footprints continues to grow, with lawmakers and regulators increasingly focused on the intersection of technology, privacy and public life. The site’s anonymous operator said the research began in mid-2024 and has continued into 2025; the extent to which any of the identified accounts are definitively owned by the public figures named remains framed on the site as the product of investigative identification rather than confirmed admission by those users.