How to remove 'Record Company Required Metadata' from music files

Unique tracking code is inserted into audio files when you purchase music from iTunes and Amazon. This provides no benefit to you and is a privacy risk. Be safe and just remove it. Posted 17 November 2012

If you are purchasing songs from an online service like iTunes or Amazon or Google Music you probably clicked through a notice like this, about something called ‘Record company required metadata’ (Metadata is just extra data in the audio file, like album name, cover art, etc).

From Amazon’s help page:

Some record companies require us to insert identifiers in the metadata that accompanies music when you download it from the Amazon MP3 Store or Cloud Player. This includes music you have purchased from Amazon.co.uk and matched music imported to Cloud Player from your device. These identifiers may contain information that can be used to identify you as the owner of the purchased music or matched music. For example, these identifiers may include a random number Amazon assigns to your order or copy, the Amazon store name, codes that identify the album and song (the UPC and ISRC), Amazon’s digital signature, and an identifier that can be used to determine whether the audio has been modified. Music supplied by Universal Music Group will also include in the identifier the purchase date and time, and the first part of the email address associated with your Amazon.co.uk account so that you know these files are unique to you.

Songs sold in the Amazon MP3 Store that include these identifiers are marked on their product detail page. These identifiers do not affect the playback experience in any way.

That’s fine, this is required by the record labels to combat piracy. Vendors like Amazon and Apple can easily add this extra data to the tracks.

The problem is that the data is easy to inspect, modify, and overwrite with free software. It’s not exactly a secret, it is a published standard. Because of this, is not a reliable way to positively identify where it came from. It’s just security through obscurity, with no additional security components. The music industry isn’t exactly known for innovation or tech savvy, so this isn’t all that surprising. This lazy scheme may help them but it does nothing to protect you.

Why is this your concern? If you lose your MP3 player, or if your laptop gets stolen, or if you get malware on your machine, others can access your music and distribute it without any consequence to them. It’s a bit like a thief stealing your wallet and using your ID to impersonate you. Thieves don’t care if your music leaks out to file-sharing sites and you risk having your account shut down (or worse) if the files are traced back to you.

Best practice is to simply remove this extra data to protect yourself. It’s pretty easy, too.

I use Ubuntu Linux so that’s what I’ll use in my example for how to remove the data. It’s free, you can download it and use it without installing on your Mac or Windows computer if you like. If that’s too complicated then find a Hex editor and an ID3 tag editor for your OS and follow along. Don’t let all the odd looking code confuse you, it’s just letters and numbers. If you are concerned about damaging your files then make a copy and work on the copy until you are satisfied you get it right.

The images below show both kinds of iTunes and Amazon tracking data in audio files. The first are the ID3 tags. These are the easiest kind to see and edit. The second is the hex editor displaying the extra data, called ‘Unique Identifier Technology Solution’ data.

ID3 Metadata from Amazon and iTunes

ID3 Metadata from Amazon and iTunes

My first attempt failed because I simply cut out the identifying data, reducing the total number of characters. It worked fine when I simply replaced all the data with a . (aka period, or “full stop”) instead, since there were many lines like that below. In Bless, press Ctrl + B to bring up the Bitwise operations which brings up a place to type 0 (numeral zero) like shown below. Press the Execute button then save the file. All done, file cleaned of this record company extra data. The file plays just fine, and the track, artist, album art data, etc. are all still there.

UITS metadata, which is completely different from ID3 tags

UITS metadata, which is completely different from ID3 tags

I've removed the data unique to me here

I've removed the data unique to me here

It is as simple as scanning the data in the right pane in Bless, and just converting anything suspicious to zeros. Legitimate data like artist and album are labeled, it is all “human readable”, so don’t worry about removing too much. Work on a backup copy until you get the hang of it, then clean up your music collection. Next step is to automate this process but I’ve not figured that out yet.