Zoom is a work-from-home privacy disaster waiting to happen
Just because you're working from home doesn't mean your boss isn't still keeping tabs on your every mouse click.
In recent days, thanks in part to the social-distancing measures made necessary by the coronavirus outbreak, converts to the work-from-home life are being forced to contend with the widely used videoconferencing service Zoom. There's just one problem: It's not exactly privacy-friendly.
Long the bane of remote workers, Zoom is equipped with numerous settings that even many of its longtime users may not know about. Take, for example, the "attendee attention tracking" feature. According to Zoom, if enabled, this feature allows hosts of conference calls — i.e. your boss — to monitor participants' computers.
"Hosts can see an indicator in the participant panel of a meeting or webinar if an attendee does not have Zoom Desktop Client or Mobile App in focus for more than 30 seconds," explains the company. "'In focus' means the user has the Zoom meeting view is open and active."
In other words, say you're in a long and boring conference call with a boss who's droning on about some nonsense. You, like most people, probably would be inclined to leave the sound on and pull up Twitter (or an article like this one) to better occupy your time. If the meeting host has attendee attention tracking enabled, they would be notified of that.
We reached out to Zoom in an effort to determine whether meeting participants are notified if and when hosts enable attendee attention tracking, but received no immediate response. To play it safe, workers should use their personal devices when ignoring their employers during Zoom calls (or, really, in general).
"Does Zoom sell Personal Data? Depends what you mean by 'sell.'"
Zoom also offers paid subscribers the ability to record meetings to the cloud. A recorded meeting, as you might imagine, comes with added privacy risks. For example, an executive not even on that Zoom meeting could later listen back — or even keyword search a written transcript of that call — at a later date.
What's more — and this may seem obvious, but it's worth mentioning — recorded meetings also store typed chat messages and allow the meeting host to "Receive a TXT file with the transcript of in-meeting chat messages."
Notably, Zoom's support page notes that "for webinars, the saved chat will only include messages from the host and panelists to all participants." What that suggests, but doesn't clarify, is that for non-webinar/standard meetings, your person-to-person chat messages would be later sent to your boss after a call recorded to the cloud.
We reached out to Zoom for clarification on this point, but received no immediate response. As mentioned above, if you're going to talk shit, it's best to use a personal device and a service like Signal.
And then there's the issue of what Zoom does with your personal data. Zoom's privacy page addresses some questions a potential user might have. Alas, its answers are not exactly reassuring.
"Does Zoom sell Personal Data?" asks one subhead. "Depends what you mean by 'sell,'" is literally the next sentence. Gulp.
"We do not allow marketing companies, advertisers, or anyone else to access Personal Data in exchange for payment," continues the privacy policy. "So in our humble opinion, we don’t think most of our users would see us as selling their information, as that practice is commonly understood."
Which, OK, that sounds pretty good. However, there's more:
That said, Zoom does use certain standard advertising tools which require Personal Data (think, for example, Google Ads and Google Analytics). We use these tools to help us improve your advertising experience (such as serving advertisements on our behalf across the Internet, serving personalized ads on our website, and providing analytics services). Sharing Personal Data with the third-party provider while using these tools may fall within the extremely broad definition of the "sale" of Personal Data under certain state laws because those companies might use Personal Data for their own business purposes, as well as Zoom’s purposes.
In other words, even if you can make the argument that Zoom isn't selling customers' personal data — an argument which, to be clear, Zoom is making — the company still admits it shares some of your data with third parties and that privacy sticklers might argue that such activity counts as selling.
So do with that what you will.
SEE ALSO: 7 Slack privacy settings you should enable now
As more of those who can work from home are told to do so, technologies like Zoom are going to play a vital role in keeping companies productive and employees connected. It would be a shame, however, if that connection came at the expense of workers' privacy.
