Data Report Card · Zoom
Zoom Data Report Card
Video conferencing · Zoom Communications, Inc.
§ Enforcement action
Data
Practices
Practices
2Access1Portability1Friction1Deletion1Sells2Trains AI
=
C
§
6.5/12
Agent
Readiness
Readiness
2Access
1Portability
2API access
=
B
5/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
§ This grade reflects a 1.5-point deduction (severity 1, reduced after 6 years with no further verified action) for a verified regulatory action: 8/12 on data practices − 1.5 = 6.5/12 → C. The record is below.
Reviewed Jun 2026 · policies are checked weekly for changes · stated — every cell is read from Zoom's published policy; none has been tested (run by us) yet.
2Accessstated
Zoom offers an in-product self-service data export under Account > Data & Privacy; a download link is emailed within 30 days of the request, so access is scored at the self-serve level.
Zoom Support — Managing your data (KB0057736) · accessed Jun 2026 ↗1Portabilitystated
The self-service export produces a single downloadable archive; Zoom's documentation does not confirm multiple structured machine-readable formats (JSON/CSV), so portability is scored at the single-format level.
Zoom Support — Managing your data (KB0057736) · accessed Jun 2026 ↗1Frictionstated
Export is self-serve but the download link arrives within 30 days and the archive expires after 90 days; members on paid multi-license accounts must route requests through the account owner, placing friction at the moderate level.
Zoom Support — Managing your data (KB0057736) · accessed Jun 2026 ↗1Deletionstated
Regular members on managed accounts cannot independently delete their data and must contact the account owner; only account owners and admins can request deletion, so deletion is materially gated and scored at the partial level.
Zoom Support — Managing your data (KB0057736) · accessed Jun 2026 ↗1Sells / sharesstated
Zoom states it does not "sell" personal data in the conventional sense but uses advertising and analytics trackers on its website that constitute cross-context behavioral advertising; it provides a "Your Privacy Choices" opt-out and honors Global Privacy Control, so sharing is scored at the opt-out level.
Zoom — Privacy Statement · accessed Jun 2026 ↗2Trains AIstated
After its 2023 terms-of-service backlash Zoom's published position is that it does not use audio, video, chat, screen-sharing, attachments, or other communications-like Customer Content to train Zoom or third-party AI models; AI Companion features are admin-enabled and off by default, so model-training use is scored at the does-not-train level.
Zoom — AI Companion privacy & security · accessed Jun 2026 ↗§Enforcement action — deducts 1.5 points (severity 1, reduced after 6 years with no further verified action); data practices without the penalty scored C (8/12)verified
The US FTC issued a consent order against Zoom in November 2020 (behavioral remedies, no monetary penalty) for misrepresenting its end-to-end encryption and security practices; Zoom separately agreed to an $85 million class-action settlement in 2021 over sharing user data with Facebook and Google via embedded SDKs, the same encryption claims, and "Zoombombing."
US Federal Trade Commission · 9 Nov 2020 ↗2API access — feeds Agent Readiness, not the /12stated
Zoom's developer platform uses OAuth 2.0 authorization-code flow: a consumer grants a user-managed app access with an
Zoom — OAuth (authorization-code flow, refresh tokens) · accessed Jun 2026 ↗access_token plus refresh_token and can revoke it, so agent access is scored at the full level.Reviewed Jun 2026 from Zoom's Support KB, Privacy Statement, and AI privacy pages. All cells "stated", not tested. Zoom provides an in-product self-service data export (link emailed within 30 days) but gates deletion for regular members behind the account owner, uses website ad/analytics trackers with an opt-out, and — after its 2023 terms backlash — now states unequivocally that it does not use Customer Content (audio, video, chat, screen shares, attachments) to train Zoom or third-party AI models.
How to request your data from Zoom
- Go to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0057736 — Zoom's data-request entry point.
- In-product Account > Data & Privacy export; deletion for managed-account members routes through the account owner.
- Expected wait: self-serve export, download link emailed within 30 days (archive expires ~90 days); member deletion gated behind account owner; consumer OAuth API available — Zoom's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Zoom — Data & Privacy: https://www.zoom.com/en/trust/privacy/.
These steps reflect Zoom's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.