The AI part isn't the bad part. It's the "use for marketing", like gMail.

One implication is that lawyers can no longer use Zoom for anything which is attorney-client privileged.

How does this add up with E2EE?

They claim they can’t read anything passing through the server. Is there some other way they’ll get access?

https://support.zoom.us/hc/en-us/articles/360048660871-End-t....

E2EE is not the default mode for Zoom.

e2ee is not the default, and is incompatible with some of their other features like "cloud recordings".

they also got caught being malicious and/or dumb in the past (https://www.businessinsider.com/china-zoom-data-2020-4) so there's no reason to bother with them now.

I have not had a chance to read up on this yet but does zoom not have a paid version or corporate version that would not follow under these same TOS? If not it seems crazy like a shot in the foot because lots of businesses use zoom and I know most want or are required to use privacy preserving programs.

I wonder if a deceptive marketing post explaining a privacy policy change could be considered material if there was a lawsuit.

I wonder if you could found out when they violate their own terms.

I actually consider the act of doublespeak potentially insinuating ill intent.

What you and what you say need to be consistent to preserve user trust and then being inconsistent shows mismanagement by senior leadership or even potentially intent to deceive or spin the situation while still implementing the policy. It’s the PR classic do one thing say another.

Edit: Oh, and then this hits almost at the same time…

https://www.sfgate.com/tech/article/zoom-return-to-office-an...

>I actually consider the act of doublespeak potentially insinuating ill intent

I agree with this sentiment and it feels like a heuristic at this point.

I think it comes from a decade of watching when corporate officers get caught red handed then try and denial of service the bad press with their jingoistic pablum.

> I agree with this sentiment and it feels like a heuristic at this point.

Well I might just take that heuristic and do some basic sentiment analysis to rank companies on their doublespeak.

If you do I’d love to see the results

This doublespeak should result in huge fines, but there's lobbying instead

And corrupt officials that accept the lobbying, which is the bad bit.

"It's not corruption, it's lobbying", the "it's not a bug, it's a feature" of politics.

Well, the practice of being able to take your case to the government is a great one. The government - already paid for with free money from non-government people working - is the one letting itself be corruptable.

Exactly the point of my last comment no one will ever use this service again. Taking a hard NO on this forever.

Speaking of pinky promises:

> We will not use ... protected health information, to train our artificial intelligence models without your consent.

> We routinely enter into ... legally required business associate agreements (BAA) with our healthcare customers. Our practices and handling of ... protected healthcare data are controlled by these separate terms and applicable laws.

To my understanding there is nothing in the separate terms (BAA) or applicable laws (HIPAA) that actually guarantees this.

I don't want to assume malice but if in good faith I would have expected an updated BAA with an explicit declaration regarding data access and disclosure in a legally-binding fashion rather than a promissory blogpost vaguely referencing laws that don't themselves inherently restrict the use of PHI for training by Zoom.

It would really only require a single term.

They have added:

> Notwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.

The BAA (https://explore.zoom.us/docs/en-us/baa.html) looks the same. Did you mean to the TOS (which is subject to change as has now happened twice)?

The BAA still states: Zoom shall not Use and/or Disclose the Protected Health Information except as otherwise limited in this Agreement ... for the proper management and administration of Zoom ... Zoom will only use the minimum necessary Protected Health information necessary for the proper management and administration of Zoom’s business specific purposes

As discussed in my comments on yesterday's post "proper management and administration" is vague language copied from HHS and can be construed as improving products as described in a legal analysis I quoted. I would also hazard a guess that a provider signing this agreement could be construed to have implied consent.

Nevertheless, it would not be hard to explicitly state that this does not include training models in the only truly legally binding agreement at play. An explicit declaration was also recommended in said legal analysis.

For me, that BAA doc flashes up and immediately redirects me to the homepage.

Strange, only seems to be happening to me on mobile.

This should work: https://web.archive.org/web/20230808072418/https://explore.z...

Doesn't the TOS already count as consent?

That is where I am stuck.

Until the TOS clearly says otherwise, as far as I can see, the TOS at least implies this:

1. We will not use your data to train AI without your consent.

2. By accepting these TOS, you give your consent to everything in this long list (which includes training AI).

In Europe/UK, it is established law that agreeing to TOS is not consent for everything in it, especially when referring to the use of personal data for things that aren't strictly necessary to do what the user has asked, and also especially given that in order for it to be consent freely given then there must be no difference in service depending on whether consent is given or not.

However, many companies reckon they'll get away with it, the enforcement is not universal and rapid, and I don't trust Zoom as far as I can throw it on this particular score.

But the TOS says:

> You agree to grant and hereby grant Zoom a perpetual, worldwide, non-exclusive, … [rest already quoted several times in the thread]

so that promise to not do it without consent is meaningless as they have consent from anyone who has agreed to the ToS which anyone using the service/product has done.