Short answer: Zoom is usable today, but its privacy track record shows a pattern worth knowing. Over the years Zoom has repeatedly shipped a feature that quietly cut a corner on privacy or security, gotten caught by researchers or regulators, and fixed it only after public backlash. It works, but it has earned trust back after the fact rather than protecting it by default.

Zoom works. It is reliable, almost everyone has it, and for a lot of people it became how work happened overnight. We are not here to tell you it is evil, or that you can never click a Zoom link again. We are here to show you something more useful: a pattern in how Zoom has handled your privacy, so you can decide for yourself where you are comfortable using it.

That pattern is simple to say. Ship fast, get caught, fix after backlash. Over and over, Zoom has shipped something that quietly cut a corner on privacy or security, gotten caught by researchers or regulators, and then fixed it once the story got loud enough. Here is the receipt trail.

It said your calls were end-to-end encrypted. They weren’t.

For years Zoom marketed “end-to-end encryption,” the gold standard where not even the company can read your call. Researchers and then the U.S. Federal Trade Commission found that wasn’t true. Zoom held the keys itself and used weaker encryption than it advertised. The FTC called the claims deceptive and, in late 2020, required Zoom to overhaul its security. Notably, the settlement came with no fine and no money back for users. Source: FTC press release, Nov 2020.

The independent researchers at the Citizen Lab put it more bluntly. They titled their analysis “Move Fast and Roll Your Own Crypto”, and found Zoom used a non-standard, weaker encryption scheme. They also found something stranger: some encryption keys were being routed through servers in China, even when everyone on the call was outside China. Also reported by The Intercept.

Its app fed Facebook your data, even if you had no Facebook account.

In March 2020, reporters at Vice/Motherboard found Zoom’s iPhone app was sending data to Facebook the moment you opened it, including details about your device and your carrier, whether or not you had a Facebook account, and none of it was disclosed in Zoom’s privacy policy. Zoom removed the code after the report. Source: Vice/Motherboard, Mar 2020.

That was part of a larger privacy lawsuit. In 2021 Zoom agreed to an $85 million settlement over claims it shared user data with Facebook, Google, and LinkedIn, on top of the “Zoombombing” problem where strangers hijacked calls.

A Zoom executive helped China shut down memorial meetings.

This one is not about a setting. In December 2020, the U.S. Department of Justice charged a China-based Zoom executive with working on behalf of the Chinese government to disrupt online meetings commemorating the Tiananmen Square massacre. Prosecutors said he and others fabricated evidence to get Zoom to terminate the meetings and suspend the accounts of dissidents. Source: BBC, Dec 2020.

In 2023, its terms quietly claimed the right to train AI on your calls.

In August 2023, people noticed Zoom’s terms of service let it use customer content, your audio, video, and chat, to train artificial intelligence (AI is software that learns patterns from large amounts of data). After the backlash, Zoom updated the terms to say it would not do that without your consent, and the CEO called the whole thing “a process failure.” Sources: Variety, CBS News.

Credit where it is due.

Zoom did eventually ship real end-to-end encryption, in October 2020, for free and paid users alike, after first planning to reserve it for paying customers only. Source: Zoom announcement. We mention this on purpose. The point of this page is not that Zoom can never change. The point is the pattern: the fix tends to arrive after someone forces it, not before.

So what should you actually do?

You do not have to quit Zoom tomorrow. You do have to know what you are putting on it. A few honest options:

For sensitive conversations, turn on Zoom’s end-to-end encryption, or use a tool that respects you by default.

If you want off Big Tech, there are good alternatives that you can even run yourself:

• Jitsi Meet: free, open-source video calls. No account needed, and you can host it on your own server.
• Nextcloud Talk: if you already run Nextcloud, calls are built in, on infrastructure you control.
• Signal: for smaller, genuinely private calls, end-to-end encrypted by default, run by a non-profit.

We can help you set any of these up. That is the whole point of Desk Ready: you should not need a backlash to get the privacy you were promised.