14 ms·
How Zoom’s terms of service and practices apply to AI features
- berbec 3y agoThis is a nice statement, but the TOS is the important part, not what this marketing piece says. > You agree to grant and hereby grant Zoom a perpetual, worldwide, non-exclusive, royalty-free, sublicensable, and transferable license and all other rights required or necessary to redistribute, publish, import, access, use, store, transmit, review, disclose, preserve, extract, modify, reproduce, share, use, display, copy, distribute, translate, transcribe, create derivative works, and process Customer Content and to perform all acts with respect to the Customer Content. > (ii) for the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software, or Zoom’s other products, services, and software, or any combination thereof
- mplewis 3y agoThe TOS has been updated to state the following: > Notwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.
- deleted 3y ago[deleted]
- dr_monster 3y agoApparently the TOS can be edited at any time to say anything without notice. It’s worth mentioning that per this agreement they can still do almost anything else with that data. They could put your face up on a billboard if they wanted to. I’m out. I was a paying user. Can’t run fast enough from ever doing business with them again.
- sleepybrett 3y agoHow about analyze all the meetings from company x in order to insider trade or perform some other kind of corporate sabatoge.
- nomel 3y ago> or perform some other kind of corporate sabatoge. Webex seems to be the "corporate" video conference service, when secrets are a concern, from my experience.
- gnfargbl 3y agoWhich provider will you be moving to, and have you checked that their ToS are more acceptable?
- Simorgh 3y agoThis is the question! Is there anything anyone would recommend on security grounds? Enterprise may resonate with something with Signal level e2ee. Has anyone tried Element IO, as an example, in a commercial setting? Asking for a friend.
- fsflover 3y agohttps://news.ycombinator.com/item?id=37021910 https://news.ycombinator.com/item?id=37021910
- freedude 3y agojitsi https://meet.jit.si/ https://meet.jit.si/
- aftbit 3y agoIf you don't need the "advanced" zoom features, I can highly recommend Jitsi. Free public service and you can self-host if you need it. We have been running a fully remote company with 90% of meetings via Jitsi since COVID with great success. I recommend Chrome over Firefox though, as FF's WebRTC support is behind Google's.
- littlestymaar 3y ago> without your consent. †but we'll prompt you an overly long privacy policy including such consent whose acceptation is just a checkbox you tick the first time your join a call without even paying attention (nor choice)
- pseudosavant 3y ago"...will not use...to train..." (emphasis mine) They'll do inference all day long, but not train without consent. Only being slightly paranoid here, but they could still analyze all of the audio for nefarious reasons (insider trading, identifying monetizable medical information from doctor's on Zoom, etc). Think of the marketing data they could generate for B2B products because they get to "listen" and "watch" every single meeting at a huge swath of companies. They'll know whether people gripe more about Jira than Asana or Azure Devops, and what they complain about.
- btown 3y agoThis is really important, and I would further emphasize the word our. Zoom doesn't need permission to "train" their own in-house artificial intelligence model when it can just transmit/sublicense that data to someone else who will train a model, or to an internal team who will use it (perhaps in few-shot prompts at scale, which is not technically training a model!) for "consulting services" in the broadest sense that that team can imagine. I generally feel like the general slowdown of capital availability in our industry will lead/is leading to companies doing a lot more desperate things with data than they've ever done before. If a management team doesn't think they'll survive a bad couple of quarters (or that they won't hit performance cliffs that let them keep their jobs or bonuses), all of a sudden there's less weight placed on the long-term trust of customers and more on "what can we do that is permissible by our contract language, even if we lose some customers because of it." That's the moment when a slippery ethical slope comes into play for previously trustworthy companies. So any expansion of a TOS in today's age should be evaluated closely.
- bonestamp2 3y ago> If a management team doesn't think they'll survive a bad couple of quarters (or that they won't hit performance cliffs that let them keep their jobs or bonuses) Agreed, and these kinds of short-term incentives are one of the problems with American companies. On the flip side... Japanese companies think about products in decades -- the product line has to make money 10 years from now. Some old European brands think about their brand in centuries -- this product made today has to be made with a process and materials that will make people in 100 years think that we made our products at the highest quality that was available to us at the time.
- stefan_ 3y agoThat still allows them to broadcast your meeting in a feature film of their choice. No, this is insane. The only reasonable option here is (1) end-to-end encryption or (2) ephemeral storage purely for the provision of the service.
- singleshot_ 3y agoA very powerful example of the difference between the words “will” and “shall.” Hats off to zoom for the free contract drafting lesson! [edit: thanks to HN commenter lolinder for the actual lesson].
- lolinder 3y ago> You can use "will" to create a promise--a contractual obligation. See Bryan A. Garner, A Dictionary of Modern Legal Usage 941-942 (2d ed., Oxford U. Press 1995). When used in this way, "will" is not merely stating a future event, it is creating a promise to perform: > > Landlord will clean and maintain all common areas. > In most basic contracts, I recommend using "will" to create obligations, as long as you are careful to be sure any given usage can't be read as merely describing future events. I'm generally against "shall" because it is harder to use correctly and it is archaic. https://law.utexas.edu/faculty/wschiess/legalwriting/2005/05/shall-vs-will.html https://law.utexas.edu/faculty/wschiess/legalwriting/2005/05...
- singleshot_ 3y agoSo, I get that you’re downvoting and contradicting, but are you sure we don’t agree? Let’s put it this way: I was observing precisely what you copied and pasted: this is a perfectly valid way to write a contract if you subsequently want to be able to argue either side. Was zoom careful to be sure any usage can’t be read as merely describing future events? Will ambiguity exist until this agreement is tested ?
- lolinder 3y agoGiven that they use "Zoom will" 21 times in the document to clearly refer to their obligations—including 4 times in the paragraph entitled "10.5 Our Obligations Over Your Customer Content"—I seriously doubt they're counting on or will get points for any ambiguity. Meanwhile not once do they use "Zoom shall". It's pretty clearly just a stylistic choice and not anything sneaky. Edit: They even use "will" in the all-important phrase "you will pay Zoom". Surely you don't think they meant to be sneaky in that usage, and that is merely meant as a prediction of future events?
- fbdab103 3y agoDoes that mean they could sell the data and let someone else train their AI model without consent?
- fabbari 3y agoInteresting that they limited the clause to only audio, video and chat. Looking at their definition of Customer Content it means that they can use, for example, documents you shared, transcripts, a very nebulous ‘outputs’ and visual displays. So they can create a transcript of the conversation and train with it. Or train on any document you may have shared during a Zoom meeting. I woukd have preferred the exception - if that was the intent - to enumerate the components of the Customer Content that they want to use for training. 10.1 Customer Content. You or your End Users may provide, upload, or originate data, content, files, documents, or other materials (collectively, “Customer Input”) in accessing or using the Services or Software, and Zoom may provide, create, or make available to you, in its sole discretion or as part of the Services, certain derivatives, transcripts, analytics, outputs, visual displays, or data sets resulting from the Customer Input (together with Customer Input, “Customer Content”);
- nabakin 3y agoIt's gone. They removed this part. https://www.diffchecker.com/RLiqgAaA/ https://www.diffchecker.com/RLiqgAaA/
- nabakin 3y agoAaaand now it's back
- deleted 3y ago[deleted]
- gchamonlive 3y ago> redistribute, publish, import, access, use, store, transmit, review, disclose, preserve, extract, modify, reproduce, share, use, display, copy, distribute, translate, transcribe, create This is very Technologic
- PaulDavisThe1st 3y agoIt's missing "pickle" and "ferment", but I guess there's not enough culinary influence at Zoom HQ.
- robertlagrant 3y agoThey should use more Python.
- denton-scratch 3y agoThey're also allowed to use it twice. Also, they can distribute it, and then redistribute it.
- Imnimo 3y agoYeah, if the TOS says one thing, and a blogpost pinky-promises another, only one of those two actually counts as far as I'm concerned.
- Animats 3y agoThe AI part isn't the bad part. It's the "use for marketing", like gMail. One implication is that lawyers can no longer use Zoom for anything which is attorney-client privileged.
- jonplackett 3y agoHow does this add up with E2EE? They claim they can’t read anything passing through the server. Is there some other way they’ll get access? https://support.zoom.us/hc/en-us/articles/360048660871-End-to-end-E2EE-encryption-for-meetings#:~:text=Zoom's%20E2EE%20offering%20uses%20public,have%20the%20necessary%20decryption%20key https://support.zoom.us/hc/en-us/articles/360048660871-End-t....
- thesimon 3y agoE2EE is not the default mode for Zoom.
- bananapub 3y agoe2ee is not the default, and is incompatible with some of their other features like "cloud recordings". they also got caught being malicious and/or dumb in the past (https://www.businessinsider.com/china-zoom-data-2020-4 https://www.businessinsider.com/china-zoom-data-2020-4) so there's no reason to bother with them now.
- 14 3y agoI have not had a chance to read up on this yet but does zoom not have a paid version or corporate version that would not follow under these same TOS? If not it seems crazy like a shot in the foot because lots of businesses use zoom and I know most want or are required to use privacy preserving programs.
- ethbr0 3y ago> You agree to grant and hereby grant Zoom [...] license and all other rights required or necessary to [...] create derivative works [...] > [...] for the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software, or Zoom’s other products, services, and software, or any combination thereof [...] Those two clauses, coupled with the current murky state of AI-from-copyrighted-material, should make everyone run screaming from Zoom as a product that can be entrusted with confidential information.
- happytiger 3y agoWe can drop them from all of our portfolio companies and I personally can as well. But what are the best alternatives at the moment? Zoom is very popular…
- willsmith72 3y agoI find google meet pretty good. The zoom desktop client kills my mac, but the web client doesn't have great performance. Meet performs better in the browser for me
- nightpool 3y agoEvery time I try to use Meet in an up to date Google Chrome MacBook, it makes my entire browser stutter. And it's much worse than the Zoom desktop client when it comes to audio cancelling and visual quality
- robertlagrant 3y agoIf you use Slack their video calling is pretty good these days, at least for internal calls.
- cbsmith 3y agoThe marketing piece explains why you might want them to let them have these rights. The TOS are what you're giving up in exchange.
- flower-giraffe 3y agoIt is perhaps a sign of how pervasive the assumption that a subscriber is an asset rather than a stakeholder that they have thought it is reasonable for a commercial communication service to claim copyright on private communications of their subscribers. Can you imagine the response to telephone company saying they can use your voicemail messages for their own purposes.
- neltnerb 3y agoIt is illuminating to do a search for the word "consent" in the document, considering they say that they will not use things without it. Seems like it might be worth them including, IANAL. Otherwise can't they just change it in the website UI...? They don't promise any particular process for acquiring consent, but sure declare you give it to them for many many other things.
- walrus01 3y ago> but the TOS is the important part, You think a TOS that's biased towards the company, or the customer, has any legal effect on a Chinese domestic corporation that's subject to the laws and regulations of the Ministry of State Security? Really?
- wfme 3y agoThe terms have since been updated. It's still an interesting lesson in spin when the change they made looks like this https://diffcheck.io/y-_v1LkBYyk4WBueHX https://diffcheck.io/y-_v1LkBYyk4WBueHX
- esperent 3y agoIt's very hard to read that on mobile. What changed?
- wodenokoto 3y agoIf my hours of watching legal eagle on YouTube qualifies me to give legal advice for a country I don’t even live in then yes, that marketing statement can have very real influence on how a court is willing to interpret the agreement between Zoom and its users.
- mikro2nd 3y agoFunny how people have been granting pretty much the same batch of rights to Microsoft for decades when they used Skype, and nobody minded. In addition Skype's ToS granted MS a licence to any and all IP you might discuss during a Skype call.[1] I wonder why no businesses were bothered by that...? [1] ...decades ago, I don't know how it reads now, can't be arsed to check.
- gmerc 3y agoTimes have changed. AI invokes existential dread.
- raverbashing 3y agoThey have amended the TOS with this statement: > Notwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.
- dolmen 3y agoThe main point is that "You agree" is the customer, not the end user. Which means that in the case where Zoom is provided to you by your employer, they claim that the employer consent is just what matters. Once more "Fuck GDPR".
- littlestymaar 3y ago> As part of our commitment to transparency and user control Bold claim for a company that already lost a class action for deliberately lying to its users.
- dylan604 3y agoIt's like a drug addict that only went to rehab to avoid jail and is not really wanting to stop. That next relapse is just right there waiting for them.
- littlestymaar 3y agoExcept the drug addict has an actual excuse for getting back to it: addiction is a medical condition, whereas here it's just lack of any kind of decency.
- DueDilligence 3y ago.. just today, we decided to cancel our K12 contract with zoom. All 350+ workstations.
- robertlagrant 3y agoMoving to what?
- yread 3y agoWhat is K12? Kindergarten?
- bluefishinit 3y ago> Section 10.2 covers that there is certain information about how our customers in the aggregate use our product — telemetry, diagnostic data, etc. This is commonly known as service generated data. We wanted to be transparent that we consider this to be our data so that we can use service generated data to make the user experience better for everyone on our platform. Well, I consider that to be my data and actually it is since I canceled our company's Zoom account when they adjusted their TOS. I'll take my data elsewhere.
- lolinder 3y agoJust out of curiosity—did you cancel the account in April when they changed the terms, or in August when people finally noticed?
- bluefishinit 3y agoAugust, when I saw the changes. I have to admit I'm not babysitting all of our vendor's TOS so am glad these things get surfaced on HN.
- motoxpro 3y agoYou don't use any service that has analytics or internal error reporting? So no AWS, GCP, Cloudflare, MS Office, etc?
- bluefishinit 3y agoI can't help but use AWS but I definitely don't use that other stuff. That it's laden with spyware is one of the main reasons. Especially for video communication, I'm not going to let some 3rd party spy on me and my business if I don't have to.
- janalsncm 3y agoIt would be great if there was a tool that could compare TOS of many services and tell me what changed since the last version. Basically diff the two. There’s already tosdr.org but I’m not sure they have that feature.
- deleted 3y ago[deleted]
- tagami 3y agoPut that right in the TOS.
- codexb 3y agoIt was a poor choice on their part. Some large employers were already on the fence about dropping zoom in favor of teams, and this is just going to push them over the edge.
- smrtinsert 3y agoJokes on them, I'm already streaming my AI avatar.
- autoexec 3y agoZoom was proved as being dishonest and untrustworthy years ago (https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...) but companies never cared about the privacy of the people they forced to use the software and all the security problems and leaks that followed still didn't discourage people from using it. I doubt their mining of personal data for AI will stop people from using it either. Although there are a ton of alternatives out there they are all "too hard" or something, so since Zoom mostly works OK most of the time and is dead simple to use it will continue to win out over everything else. My position on Zoom hasn't changed since 2020: Anyone using Zoom will continue to get exactly what they deserve.
- ChrisMarshallNY 3y agoWell, there's a couple of reasons that people use it: 1) Until recently, Zoom's video/audio quality knocked everyone else's into a cocked hat. I don't think that's the case, anymore. Looks like a lot of folks got off their butts, and improved their quality, but I haven't seen this mentioned anywhere, by anyone. 2) Everyone else is using it. #2 is a biggie. Monopoly inertia is pretty hard to overcome, for people not in the tech industry (we'll change on a whim). Zoom is not easy to use. Its settings are a mess, but everyone is used to dealing with the Zoom pain, and don't want to switch. We can be remarkably cavalier in dismissing non-tech folks, but I learned to stop doing that, many years ago. We're not the only smart people in the world. People (in general) don't like getting sidetracked by their tools. They want to get a job done, and how they get it done is not irrelevant, but not that important to them. They develop and refine a workflow, which is usually heavily informed by their choice of tools, and that "wears a groove." They don't want to switch grooves; even if they are not enjoying their tool. Most tech folks, on the other hand love tools. I had an employee that would stop his main project, and design a massive subsystem, just to make a simple command-line process a few seconds shorter. I had to keep on my toes. He was the best engineer I've ever worked with, but it was a chore to keep him focused. Non-tech types are seldom like that, and we can sometimes miss it. These are the folks that use our products, and we don't actually gain anything by disrespecting them, even when they really piss us off. TL;DR: Want people to stop using Zoom? Produce something better, and make it something that non-tech folks will love. That means easy to use, forget-about-it UX, and extremely high quality.
- karaterobot 3y agoAhh, so they're pulling the old "You can leave the meeting if you don't like becoming part of our training data" routine, and that's what they mean by consent.
- synaesthesisx 3y agoI wonder if they allow opting-out. My last company was in the healthcare space, and we used Zoom for all internal communication. Often this could contain sensitive information (PII etc) which would likely be a privacy violation if exposed.
- kevdev 3y agoYeah medical info and HIPAA was the first thing I thought of when I saw this. My company doesn’t deal with medical data but I can’t imagine any company dealing with PII wants to use Zoom now.
- haldujai 3y agoYou'd be surprised how often companies use PHI (legally) and healthcare provider networks don't care. The few with smarter lawyers and IT departments, usually academic, do but a majority of all of the new "AI" health tech products I've heard about pitched to hospitals use customer PHI for product development.
- dolmen 3y agoThe GDPR page of Zoom is just a joke: https://explore.zoom.us/en/gdpr/ https://explore.zoom.us/en/gdpr/ They basically claim that the customer (the one who signs the contract, not the Zoom user) who hosts the meeting is responsible for GDPR compliance by defining the right account settings. So if you are invited on a call you basically have no rights.
- kornhole 3y agoNextcloud Talk has no TOS AFAIK. It is FOSS and self-hosted. Nextcloud AI tools run on your instance with the exception of the optional OpenAI plugin app. They are developing further FOSS AI models to replace those. https://www.youtube.com/watch?v=14gSiyAl9Fw https://www.youtube.com/watch?v=14gSiyAl9Fw
- ddtaylor 3y agoI love Nextcloud. What will eventually happen is that Zoom (and other services in this model) will cause some problem that is so catastrophic that companies realize the true risk of being so deeply entrenched into these toxic one-sided relationships and then will begin to adopt more self-hosted tools.
- sean_hogle 3y agoZoom's lawyers are trying to pull a fast one with these revised Terms. The new sentence on user consent being required to train AIs applies only to "Customer Content," not "Service Generated Data." In sec. 10.4, Zoom says "... Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent." Customer Content is defined in 10.1 and is broadly worded. But the first sentence of sec. 10.2 clearly states that "Customer Content" does NOT include "Service Generated Data." Therein lies the rub. "Service Generated Data" = "any telemetry data, product usage data, diagnostic data, and similar content or data that Zoom collects or generates in connection with your or your End Users’ use of the Services ...." (sec. 10.2). Zoom is allowed to use Service Generated Data for any purpose (sec. 10.2) because it is not "Customer Content." This "clarification" does nothing meaningful to assuage the serious data privacy concerns posed by Zoom's use of captured user video content.
- slt2021 3y agoare Embeddings (text-emb, visual-emb, etc) of Customer Content service generated data? This might be a loophole Zoom is trying to use - while they technically not using customer data (Zoom client not sending video stream to train AI), but zoom client can process data locally and send only embeddings (numeric vectors without ties to customer PII data) and it still will be customer data
- discoverIT 3y agoDrawing from my experience in the eDiscovery field, I want to emphasize that there's no necessity for video or audio content. Rather, a tool can be developed to convert all audio into a text layer. This text layer can be extracted from the local files sourced from platforms like Zoom. Subsequently, AI/ML can be employed to process and analyze this data, providing valuable insights that compromises companies' intellectual property and sensitive information.
- graeme 3y agoWhat are the equivalent terms for Microsoft Teams?
- barbazoo 3y agoAnd Google Meet
- AndrewKemendo 3y agoNope We’re not buying it The days of the “corporate responsibility” letter are over. Nothing you say will be believed if it conflicts with your bottom line. There’s saying in Texas…won’t be fooled again
- lightedman 3y agoToo late, what you publicly advertised online and what you have in the TOS are conflicting and false advertising. But this is par for the course for Zoom.
- rukuu001 3y ago> For AI, we do not use audio, video, or chat content for training our models without customer consent. Don't we provide consent when we agree to the TOS? And we can't use the product without doing that?
- westcort 3y ago[flagged]
- andreagrandi 3y agoQuestion (I may know the answer), if the call is end to end encrypted, how can they use users content?
- layer8 3y agoZoom is not E2EE by default, and when E2EE is enabled, many Zoom features are not available, including presumably the new AI features.
- dolmen 3y ago> how can they use users content? Read the TOS again. They are only speaking about customer consent. Not "user". If you are not the one signing the contract or are just invited to a call (not hosting) you basically have no rights to define settings such as any form of opt-out (assuming they exist).
- TheCapeGreek 3y agoTo pile on the alternative recommendations: I've enjoyed using Whereby[0] in the past. I also somehow keep forgetting about them in these discussions until someone reminds me. The main thing of it for me is it's been more reliable than Jitsi (though I do need to give Jitsi another try) and doesn't need to be self-hosted. [0]https://whereby.com/ https://whereby.com/
- 1vuio0pswjnm7 3y agoZoom is getting desperate. They have been in decline since the end of the pandemic. That's what the analysts are saying.
- Lio 3y agoWhat I really want to know is, can I as someone compelled to use Zoom as an employee can opt-out of Zoom training their AI on my voice, image and data? If my employer is the "customer" what say, if any, do I have as an individual? By participating in a call am I giving Zoom permission to do things like train deep fakes of me? This is all too Blackmirrory for my liking.
- sneak 3y agoYou're not compelled; you get to choose your employer. It's much the same as the issue that was raised a few days ago, where your employer instructs or expects you to lie. The only way they have to "force" you is to threaten dismissal; this is insufficient to justify the terms "compel" or "force". A police officer holding a Glock can compel you. Your boss cannot.
- dolmen 3y agoResigning with a 3 months notice period would not fix the issue anyway. I would still have to use Zoom for that period. I had the same issue when my EU-based employer was sold to an US company. My personal data suddenly went from EU to US-based HR systems without my consent. Resigning would not have fixed anything. My personal data will be in the US forever.
- sneak 3y agoYou don't even need to resign - you just simply refuse to use Zoom.
- deleted 3y ago[deleted]
- sherlock_h 3y agoSeems like they are addressing it heads-on
- gruez 3y agoCalled it a few days ago: https://news.ycombinator.com/item?id=37022827 https://news.ycombinator.com/item?id=37022827 It's baffling how many people in previous threads thought a company that gets most of its money from enterprise/business clients, will burn all their reputation by surreptitiously using client data to train their AI.
- tailspin2019 3y agoGiven the company’s history, it doesn’t seem very baffling at all… > Zoom has agreed to pay $85 million to settle claims that it lied about offering end-to-end encryption and gave user data to Facebook and Google without the consent of users. The settlement between Zoom and the filers of a class-action lawsuit also covers security problems [0] > Mac update nukes dangerous webserver installed by Zoom [1] > The 'S' in Zoom, Stands for Security - uncovering (local) security flaws in Zoom's macOS client [2] [0] https://arstechnica.com/tech-policy/2021/08/zoom-to-pay-85m-for-lying-about-encryption-and-sending-data-to-facebook-and-google/ https://arstechnica.com/tech-policy/2021/08/zoom-to-pay-85m-... [1] https://arstechnica.com/information-technology/2019/07/silent-mac-update-nukes-dangerous-webserver-installed-by-zoom/ https://arstechnica.com/information-technology/2019/07/silen... [2] https://objective-see.org/blog/blog_0x56.html https://objective-see.org/blog/blog_0x56.html
- hackernewds 3y agoThat seems an intentional business decision where expected value of fine < perceived benefit. $85M is little
- TheRealPomax 3y ago$85M may be nothing to Apple, Facebook, or Google, but to Zoom it's a substantial amount. Their quarterly net income for Q1 2023 was only 15.4M. (Even if revenue was much higher. Revenue doesn't tell you anything about how well a company can take a financial hit)
- 3y ago