Zoom videoconferencing company building

Zoom has rewritten parts of its privacy policy after Consumer Reports highlighted concerns by users and privacy experts about the service.

The teleconferencing platform has exploded in popularity during the coronavirus epidemic, as a way for businesses, schools, clubs, and friends to stay in touch.

More on Coronavirus

But, as we pointed out last week, Zoom's privacy policy allowed the company to collect information from users' meetings—from videos to transcripts to the notes you might have shared through Zoom's chat feature.

The privacy policy didn't prevent Zoom from using that personal information for targeting ads on or off the platform, or for other business purposes.

Much of that changed over the weekend.

"After hearing the concerns that you and others have raised over the past week or so, Zoom just posted a blog announcing some clarifying updates to it privacy policy," a spokesperson told CR. 

Zoom's new privacy policy now states that so-called "Customer Content" can't be used for advertising purposes, that video is only retained at the user's request, and that it's not accessed by the company. The revised document also explains in more detail what kind of consumer data Zoom does collect, such as phone numbers and user names.

The changes were described in a company blog post signed by Zoom's chief legal officer, Aparna Bawa. "We are not changing any of our practices," the post read, just providing more clarity and detail.

“This is a pretty significant rewrite with some real improvements,” says Justin Brookman, CR’s director of privacy and technology policy.

This is the second change Zoom has made in the past few days to improve user privacy. The company also said it was updating its iOS app to stop sharing data with Facebook after the publication of a Motherboard investigation last week.

In addition, Zoom told Consumer Reports that it would stop retweeting Zoom screen captures posted by teachers that included images of students. (If you're a teacher, don't do that.)

When we contacted Zoom, a spokesperson responded, "This was an oversight on Zoom’s end, and the company will be deleting any retweets of teacher’s photos of students and will cease the practice immediately."

 

How to Protect Your Privacy on Zoom

If you're participating in Zoom calls, there are still a few things to be cautious about.

Zoom gives hosts significant power, including the ability to record meetings and order transcriptions, and the duty to keep any meeting data safe, whether it's stored on a laptop or under a host's password in Zoom's cloud.

A number of embarrassing Zoom videos have going viral after being shared online. So even if you trust everyone on the call not to share your video, slipshod security by the host could make your communications public. 

You can look for an icon that tells you when a meeting is being recorded by the host. If you feel comfortable doing so, you can ask your host to turn on a feature that requires participants to provide consent before a recording can begin. 

If you’re hosting a videoconference, we suggest you use the feature, which is turned off by default. 

To be cautious, you can keep your camera and mic turned off unless you're actually speaking. If you feel that you need to have the camera turned on, Zoom lets you choose a photo as the background for your video.

That will keep other people from seeing the dirty dishes in the sink, family photos, or political posters or books you might not want to share with your co-workers or clients.

If you do not want to receive targeted ads from Zoom after visiting zoom.us, you can click the “Cookie Preferences” link at the very bottom of any page on the site and adjust the slider to “Required Cookies.”

Finally, the new privacy policy adds some details about Zoom's Attention Tracking feature, which has generated criticism over the past few weeks. It can alert a meeting host when you're clicked out of the Zoom window for at least 30 seconds while the host is sharing their screen. 

"Zoom should strongly consider providing a visual indicator that the Attention Tracking is in use or even better get rid of it entirely," says Brookman. Currently, the privacy policy says that hosts are responsible for alerting meeting participants.