Zoom Calls Aren't as Private as You May Think. Here's What You Should Know.

Videos and notes can be used by companies and hosts. Here are some tips to protect yourself.

zoom laptop iStock-1168006075

Update: Several days after this article appeared, Zoom tightened sections of its privacy policy and made other changes to its privacy practices. This article was originally published on March 24, 2020.

At Laura Purcell's lake community in Rockaway, N.J., a group of 25 moms craved some connection at the end of a long week of coronavirus restrictions. So the mother of 8-year-old triplets arranged a virtual happy hour using Zoom, the teleconferencing service.

The conversation ranged from which wines people were drinking and which stores were still stocking toilet paper to serious talk about how schools and hospitals were managing the crisis.

"It was amazing" Purcell reports. "There were lots of offers to help each other, offering to shop for each other."

What Purcell and her pals didn't think about were the kind of data-privacy concerns that might come up when people use other online platforms such as Facebook or Google. But just like those other web services, Zoom collects personal information about its users and doesn't provide a lot of detail about how it's used for advertising, marketing, or other business purposes.

More on Technology and the Coronavirus

And most of the people on Zoom calls probably don’t realize how much information a host can gather. Depending on what tier of service—from a free option to advanced levels for big companies—a host can make a recording of the conference, have it transcribed automatically, and share the information later with people who aren't in the meeting.

All of this matters because Zoom is suddenly a big part of many Americans' lives.

Because of the coronavirus precautions that have people staying at home, the platform has become an important tool for businesses as well as many school districts. And the free and low-cost versions are also being used by individuals for everything from therapy sessions to video lessons with guitar legends to informal gatherings.

"We were like 'It's happy hour,'" says Purcell. "I doubt that anyone thought about the privacy issues before we jumped on."

What Zoom Knows About You

If you're starting to use Zoom, it makes sense to look at the privacy issues from two perspectives. The first thing to understand is what information Zoom itself can collect, and what it can do with the information. Then there's the information that the meeting host gets and how it can be shared.

Individuals can take some measures to safeguard their privacy by changing the way they use the service. But Consumer Reports' advocates say that Zoom should also improve the platform's privacy practices.

Zoom's privacy policy is similar to many digital platforms', claiming the right to collect and store personal data, and share it with third parties such as advertisers.

In Zoom's case, that extends to what the company calls customer content, or "the content contained in cloud recordings, and instant messages, files, whiteboards ... shared while using the service."

Videos aren't off-limits, according to the document, and neither are transcripts that can be generated automatically, the documents you share on your screen, or the names of everyone on a call. (The privacy policy posted online was updated over the weekend but backdated to Wednesday, March 18.)

Could your instant messages and videos be used to target advertising campaigns or develop a facial recognition algorithm, like videos collected by other tech companies? That's probably not what people are expecting when they contact a therapist, hold a business meeting, or have a job interview using Zoom.

We reached out to the company for comment on its privacy practices. It acknowledged receiving our questions in an e-mail but hasn't provided answers yet.

"Zoom isn't necessarily doing anything users would object to" with the data, says Bill Fitzgerald, a Consumer Reports privacy researcher who analyzed the company's policies. "But their terms of use give them a whole lot of leeway to collect information and share it, both now and in the future." (Consumer Reports is a Zoom client, using the service for some company-wide meetings.)

"Zoom should update their terms to ensure that data collected during meetings from any participant or host is explicitly excluded from any advertising or marketing use, and that they don't view and tag video footage to train AI for facial or object recognition," says Justin Brookman, director of privacy and technology policy at Consumer Reports.

What Your Host Knows About You

Zoom video conferences are started by what the company calls a “host.” Unlike other services you may have used, Zoom provides the host with rights that might not be immediately apparent to other participants—or, in some cases, to the hosts themselves.

A Zoom host can be someone you know and trust, like the friend who organized Purcell's get together, as well as your employer, a client, a school official, or a relative stranger from a social gathering.

"Zoom puts a lot of power in the hands of the meeting hosts," says Brookman. The host has more power to record and monitor the call than you might realize if you're just a participant, especially if he or she has a corporate account. There are a few things you should know when you're on a call.

When the video is being recorded, a small red button pops up along with the word "recording" in small type. But Fitzgerald says those indicators are easy for many participants to miss.

If a host records a conference, the video could be passed around the same way any video makes the rounds on social media. For that reason, Consumer Reports is recommending that Zoom require participants to click on a consent button before recording can begin. Zoom already has this feature available, but it’s off by default. (If you’re hosting a videoconference, we suggest you use it.)

"While a person going to a video call is pretty clearly agreeing to go to a video call, it's less clear whether they expect that the call will be recorded and reshared at the host's discretion," Fitzgerald says. "For people using Zoom for telemedicine or to access mental health services, or for sharing any information that they don't want disclosed to others, knowing that a recording is being made and how that recording is being stored is important information."

Even if you trust the person running a meeting not to share the content inappropriately, not all hosts are equally sophisticated when it comes to storing personal information. A recording of the video can be stored locally on the hard drive of a laptop or secured on Zoom's cloud storage with a password that the host creates and could, perhaps, share with others.

Zoom provides hosts with a feature that might seem intrusive to participants if they knew about it. The host can turn on "attention tracking" to monitor whether any participant clicks away from the Zoom window for more than 30 seconds while a screen is being shared. It doesn't make any distinction between an employee who is, say, watching a random YouTube video and one who is updating a document related to the meeting.

"If you're teleworking on a home computer, your boss shouldn't be able to monitor what's on your screen. Zoom should get rid of attention tracking mode, or at the very least make participants aware when it's on,” Brookman says.

CR's experts have some advice for enhancing your privacy while using Zoom. First, keep your camera and mic turned off unless you're actually speaking. If you feel that you need to have the camera turned on, Zoom lets you choose a photo as the background for your video. You can pick one from your hard drive or use one supplied by Zoom.

That can be important because the books on the shelf, posters, or other items in your living space can reveal information that you might not want to share with some of your co-workers or clients. And those images of your bedroom may not disappear when the conference is over; they can be stored for months or even years, and shared with people you've never met.

Allen St. John

I believe that technology has the power to change our lives—for better or for worse. That's why I’ve spent my life reporting and writing about it for outlets of all sorts, from newspapers (such as the Wall Street Journal and the New York Times) to magazines (Popular Mechanics and Rolling Stone) and even my own books ("Newton’s Football" and "Clapton’s Guitar"). For me, there's no better way to spend a day than talking to a bunch of experts about an important subject and then writing a story that'll help others be smarter and better informed.