The TOS has been updated to state the following:

> Notwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.

Apparently the TOS can be edited at any time to say anything without notice.

It’s worth mentioning that per this agreement they can still do almost anything else with that data. They could put your face up on a billboard if they wanted to.

I’m out. I was a paying user. Can’t run fast enough from ever doing business with them again.

How about analyze all the meetings from company x in order to insider trade or perform some other kind of corporate sabatoge.

> or perform some other kind of corporate sabatoge.

Webex seems to be the "corporate" video conference service, when secrets are a concern, from my experience.

Which provider will you be moving to, and have you checked that their ToS are more acceptable?

This is the question! Is there anything anyone would recommend on security grounds?

Enterprise may resonate with something with Signal level e2ee.

Has anyone tried Element IO, as an example, in a commercial setting?

Asking for a friend.

jitsi

https://meet.jit.si/

If you don't need the "advanced" zoom features, I can highly recommend Jitsi. Free public service and you can self-host if you need it. We have been running a fully remote company with 90% of meetings via Jitsi since COVID with great success. I recommend Chrome over Firefox though, as FF's WebRTC support is behind Google's.

Doesn’t using a Google product taint the solution, if privacy is a major concern? Also, WebRTC leaks ip addresses when using a VPN.

What is the secure way to video conference? Webex? FaceTime offers end to end encryption, but can not easily share non-mac os screens.

Articles like this sure make me like Apple sometimes

https://9to5mac.com/2023/07/20/apple-imessage-facetime-remov...

Yeah, though I don't really understand your privacy/security model. If you are worried about being targeted directly by Google or some three letter agency, you certainly should not use any of this technology. Instead, you need to go back to the basics, to something running on a physically segregated network, with a much smaller attack surface area. If you are just worried about being dragnet tracked, you are way better off with Jitsi than Zoom even if you end up using Chromium to connect to the session.

Jitsi but using Chrome doesn't fix anything privacy-wise.

Well for me it does, at least to some extent, as I use Chromium built by Arch Linux and run a new clean profile for each call. I highly doubt Google is collecting my actual data (not metadata), like AV streams or even web history, in this configuration.

Most "free markets" in the US -- certainly all that matter -- are dominated by 2 or 3 players, and when they all agree to do the same sorts of anti-consumer things, there's nowhere to go. Even if Teams or some other small player has better ToS now, who's to say they won't do the same thing tomorrow? Or do it anyway, without telling anyone?

Per the agreement using the service can probably be considered consent. Ie “we won’t use your data without your consent” translates to legal code “if you accept the TOS which you do if you use the app, then you’ve given consent”

That argument wouldn't fly in a court of law in the EU/UK, but many many companies try it on anyway.

> Apparently the TOS can be edited at any time to say anything without notice.

Yes, as with most terms of service. It's one of the things that makes terms of service statements unreliable.

This is not true. At least in the US you are required to notify customers when you change the terms of service, and as far as I know in the EU as well.

I'm well aware of the US court ruling in the early 2000s that declared the users must be notified of ToS changes. And yet, companies frequently change ToS without providing such notification in a way that customers will actually notice anyway, so it doesn't seem to matter much.

Unfortunately it's like Gmail. Even if I'm not using them, enough other places do that it's not feasible to totally avoid them without adding complications to my life. Those complications might be worth it to you, but eg my therapist's office uses Zoom for the backend of their app. You'd never know it unless you're the kind of person to dig into that.

They just made another edit and removed the line.

Here's the edit history going all the way back to March:

- 4/1 https://www.diffchecker.com/dCuVSMnp/

- 7/1 https://www.diffchecker.com/Zny4Rjqw/

- 8/7 https://www.diffchecker.com/ER0RHSdb/

- 8/8 https://www.diffchecker.com/RLiqgAaA/

"...will not use...to train..." (emphasis mine)

They'll do inference all day long, but not train without consent. Only being slightly paranoid here, but they could still analyze all of the audio for nefarious reasons (insider trading, identifying monetizable medical information from doctor's on Zoom, etc). Think of the marketing data they could generate for B2B products because they get to "listen" and "watch" every single meeting at a huge swath of companies. They'll know whether people gripe more about Jira than Asana or Azure Devops, and what they complain about.

This is really important, and I would further emphasize the word our. Zoom doesn't need permission to train an in-house artificial intelligence model when it can just transmit/sublicense that data to someone else who will train a model, or to an internal team who will use it for "consulting services" in the broadest sense that that team can imagine.

I generally feel like the general slowdown of capital availability in our industry will lead/is leading to companies doing a lot more desperate things with data than they've ever done before. If a management team doesn't think they'll survive a bad couple of quarters (or that they won't hit performance cliffs that let them keep their jobs or bonuses), all of a sudden there's less weight placed on the long-term trust of customers and more on "what can we do that is permissible by our contract language, even if we lose some customers because of it." That's the moment when a slippery ethical slope comes into play for previously trustworthy companies. So any expansion of a TOS in today's age should be evaluated closely.

> If a management team doesn't think they'll survive a bad couple of quarters (or that they won't hit performance cliffs that let them keep their jobs or bonuses)

Agreed, and these kinds of short-term incentives are one of the problems with American companies. On the flip side...

Japanese companies think about products in decades -- the product line has to make money 10 years from now.

Some old European brands think about their brand in centuries -- this product made today has to be made with a process and materials that will make people in 100 years think that we made our products at the highest quality that was available to us at the time.

Got any data to back this up or are you just spouting racist tropes?

Making generalized claims about companies is racist now? I must've missed the memo.

I guess it makes sense. Companies are people, after all

They're not making claims about companies, they're making claims about cultures (American, European, Japanese).

No.

> American companies.

> Japanese companies

> Some old European brands

Unless the parent comment was edited, of course.

This is overly broad generalization that does not hold up to scrutiny.

Konami vs Kojima and any of the DieselGate companies come to mind.

* * *

> without your consent.

†but we'll prompt you an overly long privacy policy including such consent whose acceptation is just a checkbox you tick the first time your join a call without even paying attention (nor choice)

This seems to be a pretty big thing. Zoom seems to have been adopted by a lot of government processes.

How does this apply for court hearings, council meetings, etc…

ZoomGov likely has a different ToS

That still allows them to broadcast your meeting in a feature film of their choice. No, this is insane. The only reasonable option here is (1) end-to-end encryption or (2) ephemeral storage purely for the provision of the service.

A very powerful example of the difference between the words “will” and “shall.”

Hats off to zoom for the free contract drafting lesson!

> You can use "will" to create a promise--a contractual obligation. See Bryan A. Garner, A Dictionary of Modern Legal Usage 941-942 (2d ed., Oxford U. Press 1995). When used in this way, "will" is not merely stating a future event, it is creating a promise to perform:

> > Landlord will clean and maintain all common areas.

> In most basic contracts, I recommend using "will" to create obligations, as long as you are careful to be sure any given usage can't be read as merely describing future events. I'm generally against "shall" because it is harder to use correctly and it is archaic.

https://law.utexas.edu/faculty/wschiess/legalwriting/2005/05...

So, I get that you’re downvoting and contradicting, but are you sure we don’t agree? Let’s put it this way: I was observing precisely what you copied and pasted: this is a perfectly valid way to write a contract if you subsequently want to be able to argue either side.

Was zoom careful to be sure any usage can’t be read as merely describing future events? Will ambiguity exist until this agreement is tested ?

Given that they use "Zoom will" 21 times in the document to clearly refer to their obligations—including 4 times in the paragraph entitled "10.5 Our Obligations Over Your Customer Content"—I seriously doubt they're counting on or will get points for any ambiguity.

Meanwhile not once do they use "Zoom shall". It's pretty clearly just a stylistic choice and not anything sneaky.

Edit: They even use "will" in the all-important phrase "you will pay Zoom". Surely you don't think they meant to be sneaky in that usage, and that is merely meant as a prediction of future events?

I stand corrected. I suppose reading the contract instead of snarking might have allowed me to avoid the embarrassment. Thank you.

Thanks for responding graciously!

When in Rome; you as well.

Does that mean they could sell the data and let someone else train their AI model without consent?

Interesting that they limited the clause to only audio, video and chat. Looking at their definition of Customer Content it means that they can use, for example, documents you shared, transcripts, a very nebulous ‘outputs’ and visual displays.

So they can create a transcript of the conversation and train with it. Or train on any document you may have shared during a Zoom meeting.

I woukd have preferred the exception - if that was the intent - to enumerate the components of the Customer Content that they want to use for training.

10.1 Customer Content. You or your End Users may provide, upload, or originate data, content, files, documents, or other materials (collectively, “Customer Input”) in accessing or using the Services or Software, and Zoom may provide, create, or make available to you, in its sole discretion or as part of the Services, certain derivatives, transcripts, analytics, outputs, visual displays, or data sets resulting from the Customer Input (together with Customer Input, “Customer Content”);

It's gone. They removed this part.

Aaaand now it's back

> redistribute, publish, import, access, use, store, transmit, review, disclose, preserve, extract, modify, reproduce, share, use, display, copy, distribute, translate, transcribe, create

This is very Technologic

It's missing "pickle" and "ferment", but I guess there's not enough culinary influence at Zoom HQ.

They should use more Python.

They're also allowed to use it twice. Also, they can distribute it, and then redistribute it.

Yeah, if the TOS says one thing, and a blogpost pinky-promises another, only one of those two actually counts as far as I'm concerned.

The AI part isn't the bad part. It's the "use for marketing", like gMail.

One implication is that lawyers can no longer use Zoom for anything which is attorney-client privileged.

How does this add up with E2EE?

They claim they can’t read anything passing through the server. Is there some other way they’ll get access?

https://support.zoom.us/hc/en-us/articles/360048660871-End-t....

E2EE is not the default mode for Zoom.

e2ee is not the default, and is incompatible with some of their other features like "cloud recordings".

they also got caught being malicious and/or dumb in the past (https://www.businessinsider.com/china-zoom-data-2020-4) so there's no reason to bother with them now.

I have not had a chance to read up on this yet but does zoom not have a paid version or corporate version that would not follow under these same TOS? If not it seems crazy like a shot in the foot because lots of businesses use zoom and I know most want or are required to use privacy preserving programs.

I wonder if a deceptive marketing post explaining a privacy policy change could be considered material if there was a lawsuit.

I wonder if you could found out when they violate their own terms.

I actually consider the act of doublespeak potentially insinuating ill intent.

What you and what you say need to be consistent to preserve user trust and then being inconsistent shows mismanagement by senior leadership or even potentially intent to deceive or spin the situation while still implementing the policy. It’s the PR classic do one thing say another.

Edit: Oh, and then this hits almost at the same time…

https://www.sfgate.com/tech/article/zoom-return-to-office-an...

>I actually consider the act of doublespeak potentially insinuating ill intent

I agree with this sentiment and it feels like a heuristic at this point.

I think it comes from a decade of watching when corporate officers get caught red handed then try and denial of service the bad press with their jingoistic pablum.

> I agree with this sentiment and it feels like a heuristic at this point.

Well I might just take that heuristic and do some basic sentiment analysis to rank companies on their doublespeak.

If you do I’d love to see the results

This doublespeak should result in huge fines, but there's lobbying instead

And corrupt officials that accept the lobbying, which is the bad bit.

"It's not corruption, it's lobbying", the "it's not a bug, it's a feature" of politics.

Well, the practice of being able to take your case to the government is a great one. The government - already paid for with free money from non-government people working - is the one letting itself be corruptable.

Exactly the point of my last comment no one will ever use this service again. Taking a hard NO on this forever.

Speaking of pinky promises:

> We will not use ... protected health information, to train our artificial intelligence models without your consent.

> We routinely enter into ... legally required business associate agreements (BAA) with our healthcare customers. Our practices and handling of ... protected healthcare data are controlled by these separate terms and applicable laws.

To my understanding there is nothing in the separate terms (BAA) or applicable laws (HIPAA) that actually guarantees this.

I don't want to assume malice but if in good faith I would have expected an updated BAA with an explicit declaration regarding data access and disclosure in a legally-binding fashion rather than a promissory blogpost vaguely referencing laws that don't themselves inherently restrict the use of PHI for training by Zoom.

It would really only require a single term.

They have added:

> Notwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.

The BAA (https://explore.zoom.us/docs/en-us/baa.html) looks the same. Did you mean to the TOS (which is subject to change as has now happened twice)?

The BAA still states: Zoom shall not Use and/or Disclose the Protected Health Information except as otherwise limited in this Agreement ... for the proper management and administration of Zoom ... Zoom will only use the minimum necessary Protected Health information necessary for the proper management and administration of Zoom’s business specific purposes

As discussed in my comments on yesterday's post "proper management and administration" is vague language copied from HHS and can be construed as improving products as described in a legal analysis I quoted. I would also hazard a guess that a provider signing this agreement could be construed to have implied consent.

Nevertheless, it would not be hard to explicitly state that this does not include training models in the only truly legally binding agreement at play. An explicit declaration was also recommended in said legal analysis.

For me, that BAA doc flashes up and immediately redirects me to the homepage.

Strange, only seems to be happening to me on mobile.

This should work: https://web.archive.org/web/20230808072418/https://explore.z...

Doesn't the TOS already count as consent?

That is where I am stuck.

Until the TOS clearly says otherwise, as far as I can see, the TOS at least implies this:

1. We will not use your data to train AI without your consent.

2. By accepting these TOS, you give your consent to everything in this long list (which includes training AI).

In Europe/UK, it is established law that agreeing to TOS is not consent for everything in it, especially when referring to the use of personal data for things that aren't strictly necessary to do what the user has asked, and also especially given that in order for it to be consent freely given then there must be no difference in service depending on whether consent is given or not.

However, many companies reckon they'll get away with it, the enforcement is not universal and rapid, and I don't trust Zoom as far as I can throw it on this particular score.

But the TOS says:

> You agree to grant and hereby grant Zoom a perpetual, worldwide, non-exclusive, … [rest already quoted several times in the thread]

so that promise to not do it without consent is meaningless as they have consent from anyone who has agreed to the ToS which anyone using the service/product has done.

> You agree to grant and hereby grant Zoom [...] license and all other rights required or necessary to [...] create derivative works [...]

> [...] for the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software, or Zoom’s other products, services, and software, or any combination thereof [...]

Those two clauses, coupled with the current murky state of AI-from-copyrighted-material, should make everyone run screaming from Zoom as a product that can be entrusted with confidential information.

We can drop them from all of our portfolio companies and I personally can as well.

But what are the best alternatives at the moment?

Zoom is very popular…

I find google meet pretty good. The zoom desktop client kills my mac, but the web client doesn't have great performance. Meet performs better in the browser for me

Every time I try to use Meet in an up to date Google Chrome MacBook, it makes my entire browser stutter. And it's much worse than the Zoom desktop client when it comes to audio cancelling and visual quality

If you use Slack their video calling is pretty good these days, at least for internal calls.

The marketing piece explains why you might want them to let them have these rights. The TOS are what you're giving up in exchange.

It is perhaps a sign of how pervasive the assumption that a subscriber is an asset rather than a stakeholder that they have thought it is reasonable for a commercial communication service to claim copyright on private communications of their subscribers.

Can you imagine the response to telephone company saying they can use your voicemail messages for their own purposes.

It is illuminating to do a search for the word "consent" in the document, considering they say that they will not use things without it.

Seems like it might be worth them including, IANAL. Otherwise can't they just change it in the website UI...? They don't promise any particular process for acquiring consent, but sure declare you give it to them for many many other things.

> but the TOS is the important part,

You think a TOS that's biased towards the company, or the customer, has any legal effect on a Chinese domestic corporation that's subject to the laws and regulations of the Ministry of State Security? Really?

The terms have since been updated. It's still an interesting lesson in spin when the change they made looks like this https://diffcheck.io/y-_v1LkBYyk4WBueHX

It's very hard to read that on mobile. What changed?

If my hours of watching legal eagle on YouTube qualifies me to give legal advice for a country I don’t even live in then yes, that marketing statement can have very real influence on how a court is willing to interpret the agreement between Zoom and its users.

Funny how people have been granting pretty much the same batch of rights to Microsoft for decades when they used Skype, and nobody minded.

In addition Skype's ToS granted MS a licence to any and all IP you might discuss during a Skype call.[1] I wonder why no businesses were bothered by that...?

[1] ...decades ago, I don't know how it reads now, can't be arsed to check.

Times have changed. AI invokes existential dread.

They have amended the TOS with this statement:

> Notwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.

The main point is that "You agree" is the customer, not the end user.

Which means that in the case where Zoom is provided to you by your employer, they claim that the employer consent is just what matters. Once more "Fuck GDPR".