(Still) Not Using Zoom

Dear client,

Setting aside the challenges of using Zoom under ChromeOS and Linux, I have mostly been declining invitations to Zoom calls because of the terms they introduced from April 2023 in section 10 of their Terms of Service which seemed to force every user, with no opt-out to the Terms available and with recourse only via arbitration, to agree that Zoom could (whether they currently do or not):

  1. Train their AI on anything uploaded or created on Zoom (including transcripts and recordings) and use the consequent model for absolutely anything;
  2. Have indefinite and ownership-equivalent rights to do so in the future and
  3. Be indemnified by me if it turns out someone else owns the IP or has their rights infringed (for example to confidential materials everyone on the call is entitled to review).

Following public complaints they first tried to apply “you poor children don't understand” tactics and adding to the Terms to say they wouldn't do this (but leaving the terms that said they could intact), and then when that didn't fix anything they rolled back the whole thing again as if they were not using AI and it was not their fault that the whole thing happened..

Given Zoom did this once and were essentially unapologetic, they could do it again any time so I try to avoid using their service and will most likely just dial in by phone if I have to join your call.

I prefer Jitsi instead; it has equivalent functionality, is platform independent, is open source and can be self-hosted.

Details

In the terms in effect when I originally wrote this, “data, content, files, documents, or other materials” that you use in a Zoom session (“Customer Input”), as well as recordings and transcripts, and any other glitter Zoom sprinkles over them, is called “Customer Content”.

10.4(ii) then sees you granting a broad license to Customer Content “for the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software, or Zoom’s other products, services, and software, or any combination thereof”. 10.5 explains that this may well be carried out by a third party.

If the stuff you shared belongs to someone else, 10.6 sees you agreeing “you are solely responsible for the Customer Content” and notably for getting consent from third parties and providing notices according to whatever laws happen to be applicable to the combination of people involved. Marking things as confidential doesn't help – 17.1 makes clear that “Customer Content is not Customer Confidential Information” (i.e. is not treated by Zoom as shared in confidence).

In addition to all this, in 10.6 you “represent and warrant that you have the right to upload Customer Input and for Zoom to provide, create, or make available any Customer Content to you, and that such use or provision by you, your End User, or Zoom does not violate or infringe any rights of any third party.”  So according to 25(i) & (iii) you are basically indemnifying them if they train their AI with someone else's IP you happen to have – for example, a client brief you are discussing internally, or a legal case you are working on under privilege.

There is no opt-out or scope control to use in the Terms for AI training. Zoom's COO says the actual use of the AI features is opt-in, but that doesn't seem relevant as the Terms grant Zoom these permissions regardless and the Customer Content exists whether you use the AI features or not.

Conclusion

My non-lawyer read suggests this is an exceptionally risky thing for anyone to agree if they are in possession of IP or under NDA concerning someone else's secrets, and I will be avoiding Zoom (even if they revert the terms – can't take the chance on future changes like this).

Update: Around 17:00 UTC on August 7 the ToS were changed to append the following text to 10.4:

“Notwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.”

Given how easy it would have been to make that say “...will not use any Customer Input...” there is presumably still an issue here, even without the observation that “consent” is doing a lot of heavy lifting there.

Update: The ToS were once again changed on August 11 to roll back the whole AI thing and add a note saying they will not train any AI on Customer Content. Maybe it's all over? I'll be cautious about Zoom in future...

Notes, Tags & Mentions

To discuss this post please reply from Mastodon etc. (search for the URL) & include @webmink@meshed.cloud as WriteFreely still doesn't display replies. More.