data report card

Data Report Card · Zoom

Zoom Data Report Card

C
6.5/12 Policy grade · Video conferencing · Zoom Communications, Inc.
§ Enforcement action

§ This grade reflects a 1.5-point deduction (severity 1, reduced after 6 years with no further verified action) for a verified regulatory action: 8/12 before the deduction − 1.5 = 6.5/12 → C. The record is below.

Help me make a request →
Reviewed Jun 2026 · policies are checked weekly for changes  ·  stated — every cell is read from Zoom's published policy; none has been tested (run by us) yet.
2Accessstated
Zoom offers an in-product self-service data export under Account > Data & Privacy; a download link is emailed within 30 days of the request, so access is scored at the self-serve level.
Zoom Support — Managing your data (KB0057736) · accessed Jun 2026 ↗
1Portabilitystated
The self-service export produces a single downloadable archive; Zoom's documentation does not confirm multiple structured machine-readable formats (JSON/CSV), so portability is scored at the single-format level.
Zoom Support — Managing your data (KB0057736) · accessed Jun 2026 ↗
Connects to apps: Yes. Zoom's developer platform uses OAuth 2.0 authorization-code flow: a consumer grants a user-managed app access with an access_token plus refresh_token and can revoke it, so agent access is scored at the full level. Zoom — OAuth (authorization-code flow, refresh tokens) · accessed Jun 2026 ↗
1Frictionstated
Export is self-serve but the download link arrives within 30 days and the archive expires after 90 days; members on paid multi-license accounts must route requests through the account owner, placing friction at the moderate level.
Zoom Support — Managing your data (KB0057736) · accessed Jun 2026 ↗
1Deletionstated
Regular members on managed accounts cannot independently delete their data and must contact the account owner; only account owners and admins can request deletion, so deletion is materially gated and scored at the partial level.
Zoom Support — Managing your data (KB0057736) · accessed Jun 2026 ↗
1Sells / sharesstated
Zoom states it does not "sell" personal data "governed by this Privacy Statement" in the conventional sense — a scope its 17 September 2026 update added, alongside "Sales of business contact related data may occur through our Zoom Common Room offering", which carries its own privacy statement. Within this statement’s scope Zoom uses advertising and analytics trackers on its website that constitute cross-context behavioral advertising; it provides a "Your Privacy Choices" opt-out and honors Global Privacy Control, so sharing is scored at the opt-out level.
Zoom — Privacy Statement · accessed Jun 2026 ↗
2Trains AIstated
After its 2023 terms-of-service backlash Zoom's published position is that it does not use audio, video, chat, screen-sharing, attachments, or other communications-like Customer Content to train Zoom or third-party AI models; AI Companion features are admin-enabled and off by default, so model-training use is scored at the does-not-train level.
Zoom — AI Companion privacy & security · accessed Jun 2026 ↗
§Enforcement action — deducts 1.5 points (severity 1, reduced after 6 years with no further verified action); Policy grade without the penalty: C (8/12)verified
The US FTC issued a consent order against Zoom in November 2020 (behavioral remedies, no monetary penalty) for misrepresenting its end-to-end encryption and security practices; Zoom separately agreed to an $85 million class-action settlement in 2021 over sharing user data with Facebook and Google via embedded SDKs, the same encryption claims, and "Zoombombing."
US Federal Trade Commission · 9 Nov 2020 ↗
Reviewed Jun 2026 from Zoom's Support KB, Privacy Statement, and AI privacy pages. All cells "stated", not tested. Zoom provides an in-product self-service data export (link emailed within 30 days) but gates deletion for regular members behind the account owner, uses website ad/analytics trackers with an opt-out, and — after its 2023 terms backlash — now states unequivocally that it does not use Customer Content (audio, video, chat, screen shares, attachments) to train Zoom or third-party AI models.

Events

Breaches, policy changes, and export-format changes we’ve recorded at Zoom — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →

17 Sep 2026Zoom narrowed its no-sell statement. It previously read "We do not sell your personal data in the conventional sense"; it now reads "We do not sell your personal data governed by this Privacy Statement in the conventional sense", followed by "Sales of business contact related data may occur through our Zoom Common Room offering." Zoom's own update note, dated 17 September 2026, states the change clarifies that this Privacy Statement does not cover sales of business contact data.policy change
On the events page →

Grade history

Every change to this company’s grade since it was first published, and why. All grade changes →

18 Sep 2026Sells / shares your datanote

Score unchanged (1). Zoom narrowed its no-sell statement on 17 September 2026: "We do not sell your personal data in the conventional sense" became "We do not sell your personal data governed by this Privacy Statement in the conventional sense", with sales of business contact data moved to the separately-documented Zoom Common Room offering (published as ev-2026-0015). The rationale now states that scope rather than quoting the old unqualified sentence. The cell still rests on cross-context behavioral advertising trackers with a working "Your Privacy Choices" opt-out and Global Privacy Control support, which is the opt-out rung under R3.

How to request your data from Zoom

  1. Go to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0057736 — Zoom's data-request entry point.
  2. In-product Account > Data & Privacy export; deletion for managed-account members routes through the account owner.
  3. Expected wait: self-serve export, download link emailed within 30 days (archive expires ~90 days); member deletion gated behind account owner; consumer OAuth API available — Zoom's stated turnaround (we haven't independently timed a request yet).
  4. No self-serve option, or want a formal request? Contact Zoom — Data & Privacy: https://www.zoom.com/en/trust/privacy/.

These steps reflect Zoom's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.

Help me make a request →