## Facts

- Zoom provided a cloud-based videoconferencing platform with chat, screen sharing, and meeting recording, including an optional cloud recording feature.
- Zoom collected user identifiers and technical data (e.g., name, email, general location, device and network information) and meeting metadata (e.g., dates, durations, participants).
- The FTC alleged Zoom misrepresented that meetings were protected by “end-to-end encryption,” implying only participants held the keys needed to decrypt content; the FTC alleged Zoom retained cryptographic keys on its servers, permitting Zoom access to meeting content.
- The FTC alleged Zoom overstated encryption strength by claiming 256-bit encryption when it at times used lower levels (e.g., 128-bit keys).
- The FTC alleged Zoom represented cloud recordings were stored encrypted in secure cloud storage immediately after meetings, but recordings were sometimes stored unencrypted on Zoom servers for up to 60 days before transfer to encrypted storage.
- The FTC alleged that a 2018 macOS update installed a local web server without adequate disclosure, bypassed Safari safeguards meant to require user confirmation before launching external apps, and created a vulnerability enabling third parties to cause users to join meetings without knowledge or consent.
- The matter proceeded through an administrative complaint and a consent agreement process, with public comments submitted; the FTC then issued a final decision and order resolving the matter by consent, without litigation on the merits.

## Issues

1. Whether Zoom’s statements about end-to-end encryption, encryption strength, and cloud-recording security were deceptive acts or practices under § 5(a) of the FTC Act.
2. Whether Zoom’s undisclosed installation and use of a local web server on macOS, and the associated security risks, constituted unfair acts or practices under § 5(a) of the FTC Act.
3. What injunctive and compliance remedies were appropriate to prevent future misrepresentations and reduce security and privacy risks.

## Decision

- The FTC accepted the consent agreement and issued a final Decision and Order (Feb. 1, 2021).
- Zoom did not admit or deny the substantive allegations but agreed to comply with injunctive provisions.
- The order prohibited misrepresentations about privacy and security practices, including encryption-related claims and protection of user information from unauthorized access.
- The order required Zoom to implement and maintain a comprehensive information security program with specified components (e.g., risk assessment, vulnerability management, secure development practices, and employee training).
- The order required controls over access, retention, and deletion of users’ personal information, limiting access to personnel and service providers with a need to perform duties.
- The order required independent, third-party assessments of the security program for a long-term compliance period.

## Legal Principles

- Under § 5 of the FTC Act, materially misleading security representations—such as claims about end-to-end encryption, encryption strength, or secure storage—can constitute deceptive acts or practices.
- Practices that increase security or privacy risks through nontransparent software design choices that circumvent platform safeguards may constitute unfair acts or practices when likely to cause substantial injury not reasonably avoidable and not outweighed by benefits.
- A consent order may impose forward-looking compliance obligations, including prohibitions on misrepresentations, mandated security programs, and independent assessments, even where the respondent neither admits nor denies liability.

## Conclusion

The FTC resolved the proceeding through a consent order requiring Zoom to stop misrepresenting its security and privacy protections—especially encryption-related claims—and to operate a comprehensive, independently assessed information security program designed to reduce the risk of unauthorized access and related consumer harm.


In re Zoom Video Commc’ns, Inc., FTC Dkt. No. C-4731 (F.T.C. Feb. 1, 2021)