In the Matter of Zoom Video Communications, Inc.

Zoom Video Communications, Inc. (Zoom) (defendant) offered a videoconferencing platform that allowed users to engage in one-on-one and group video calls. The platform became extremely popular during the social-distancing period of the COVID-19 pandemic. During meetings, users could engage in chat messaging and screen sharing. Users could also record meetings and share them with others. The Zoom platform routinely collected information from users, such as users’ names, email addresses, general location, birthdate, device features, and internet connection. Zoom also collected information related to meetings themselves, such as a meeting’s date, duration, and participants. Further, meeting recordings were generally stored in Zoom’s cloud storage for a fixed period. Zoom made many representations regarding the security of its platform, and those representations were undoubtedly significant in influencing users’ choice of which videoconferencing platform to use. However, some of Zoom’s representations were false. For example, Zoom routinely represented that it used end-to-end encryption for meeting communications, ensuring that only call participants could access the call’s contents. In fact, Zoom did not provide end-to-end encryption for most of its platform. Zoom also falsely represented that it used 256-bit encryption to secure call contents and that meeting recordings were stored in an encrypted state when in Zoom’s cloud storage. Additionally, in 2018, Zoom updated its app for Mac computers to install a webserver onto users’ computers to circumvent a new security and privacy safeguard Apple had deployed in its default internet browser, Safari. The Zoom update neither notified users that it was installing a webserver that circumvented Safari’s protections nor included any security measures to replace the ones being circumvented. The Federal Trade Commission (FTC) (plaintiff) filed a complaint against Zoom, alleging that Zoom’s conduct amounted to unfair or deceptive practices violating § 5 of the FTC Act. Negotiations resulted in the entry of a consent order agreed to by the parties.