FTC Settlement: Zoom’s End-to-End Encryption Claims

The Federal Trade Commission (FTC) reached a settlement with Zoom Video Communications in November 2020 over allegations that the company misled users about its encryption practices, including claiming it offered end-to-end encryption when it did not. Zoom agreed to implement a comprehensive security program and to stop misrepresenting its security and privacy features, but it did not pay a monetary fine.

Background: What Zoom Claimed vs. What It Did

Zoom’s marketing and privacy materials, particularly before the COVID-19 pandemic surge, used the phrase “end-to-end encryption” to describe its video calls. In reality, Zoom used Transport Layer Security (TLS) to encrypt data between the user’s device and Zoom’s servers, but it could access the decrypted content on its own infrastructure. True end-to-end encryption (E2EE) means only the communicating users can decrypt the data, not the service provider.

The FTC complaint detailed that Zoom had claimed in its privacy policy and in statements from its CEO that meetings were end-to-end encrypted, while its engineers knew the company could decrypt meeting content. The FTC also alleged that Zoom had falsely claimed to provide 256-bit AES encryption, when it actually used 128-bit keys for some connections, and that it had failed to disclose that it installed a local web server on Macs to bypass browser security prompts.

The FTC Settlement Terms

The settlement, announced on November 9, 2020, required Zoom to:

• Implement a comprehensive information security program with regular third-party assessments.
• Refrain from misrepresenting its privacy and security features, including encryption levels.
• Use reasonable security measures to protect user data.
• Notify users and the FTC if a data breach occurs.

Notably, the FTC did not impose a civil penalty. The agency’s authority under Section 5 of the FTC Act allows it to seek injunctive relief but not fines for first-time violations in this context. Zoom also agreed to a 20-year consent decree, which gives the FTC ongoing oversight.

How Zoom’s Encryption Actually Worked

Before the settlement, Zoom used TLS 1.2 with AES-128-GCM for most connections, and AES-256 for some. TLS protects data in transit between the user and Zoom’s servers, but Zoom’s servers hold the decryption keys. That means Zoom (or anyone who compromised its servers) could access meeting content. This is fundamentally different from E2EE, where only the endpoints have the keys.

In October 2020, Zoom began rolling out true end-to-end encryption for meetings, but it initially limited it to paid accounts and required users to verify their phone numbers. This rollout came after the FTC’s investigation was already underway. The E2EE feature now uses the Signal Protocol (developed by Signal Foundation) to encrypt audio and video between participants, so Zoom cannot decrypt the content.

Common Misconceptions About the Settlement

Many people assume the FTC fined Zoom millions of dollars. It did not. The settlement was purely injunctive, meaning Zoom had to change its practices but paid no penalty. This is a common outcome when the FTC uses its “unfair or deceptive acts or practices” authority rather than a specific privacy law with statutory fines.

Another misconception is that the settlement proved Zoom’s encryption was completely broken. TLS is a strong, standard encryption for data in transit. The problem was the labeling: calling something “end-to-end” when the provider holds the keys is misleading. The FTC’s action was about truth in advertising, not about the absolute security of the encryption.

How to Verify Encryption Claims Yourself

If you want to know whether a service truly uses E2EE, look for:

• Whether the provider can access your data. If they can reset your password or read your messages, it’s not E2EE.
• Whether the provider publishes a whitepaper or security documentation describing their encryption protocol.
• Whether an independent audit has been performed.
• Whether the encryption keys are generated on your device and never leave it.

For Zoom specifically, you can check the meeting settings: E2EE meetings show a green shield icon with a padlock, and the meeting ID is not visible to Zoom’s servers. You can also verify the encryption key fingerprint between participants.

Comparison: Zoom vs. Other Video Conferencing Tools

Zoom’s E2EE is now available to all users, but it requires enabling in settings. By default, Zoom still uses TLS (which it calls “encryption in transit”). Other platforms handle encryption differently:

• Microsoft Teams uses TLS in transit and at rest, but does not offer E2EE for most calls.
• Google Meet uses TLS and encryption at rest, but not E2EE.
• Signal, Wire, and FaceTime (with certain settings) use E2EE by default.

For most business and personal calls, TLS is sufficient. E2EE is critical if you’re discussing highly sensitive information and want to ensure the provider cannot access it.

Frequently Asked Questions

Did Zoom pay a fine in the FTC settlement?

No. The settlement did not include a monetary penalty. Zoom agreed to implement a security program and to stop misrepresenting its encryption, but the FTC did not impose a fine. This is because the FTC’s action was based on Section 5 of the FTC Act, which does not allow civil penalties for first-time violations in this context.

Is Zoom now truly end-to-end encrypted?

Yes, but only when you enable the E2EE setting in your Zoom account. By default, Zoom uses TLS encryption in transit, which protects data between your device and Zoom’s servers, but Zoom can access the content. E2EE uses the Signal Protocol and prevents Zoom from seeing the content. You must turn it on for each meeting or set it as the default in your settings.

What is the difference between TLS and end-to-end encryption?

TLS (Transport Layer Security) encrypts data between your device and the service’s server. The server can decrypt the data. End-to-end encryption (E2EE) encrypts data on your device and only the recipient’s device can decrypt it. The service provider cannot access the content. Zoom used TLS and called it E2EE, which was misleading.

Can the FTC settlement affect me as a Zoom user?

The settlement requires Zoom to improve its security practices and to be accurate in its marketing. As a user, you benefit from better security and clearer information. However, the settlement does not provide compensation to individual users. If you believe Zoom harmed you, you would need to pursue a separate legal action.

How do I enable end-to-end encryption in Zoom?

Go to Zoom’s web portal, navigate to Settings > Security, and toggle on “Allow use of end-to-end encryption.” Then, when scheduling a meeting, choose the E2EE option. All participants must have E2EE enabled and be on a compatible client (desktop or mobile app). You can verify E2EE is active by seeing the green shield icon in the meeting.

Does the settlement require Zoom to offer E2EE?

No. The settlement does not mandate E2EE. It only requires Zoom to stop misrepresenting its security features and to implement a security program. Zoom added E2EE voluntarily after the investigation, likely in response to public pressure and to differentiate itself from competitors.

Related

• Fine-Tuning Large Language Models: A Practical Guide
• Claude API vs OpenAI API: Pricing and Trade-Offs
• Composition vs Superposition in Neural Networks