Zoom Privacy Security: Risks & Settings

Zoom privacy and security depend on a few core settings you control, not just on Zoom’s own safeguards. This article explains the main risks, the built-in protections you should enable, and the practical steps to keep meetings and data private.

How Zoom Handles Your Data

Zoom collects account information (name, email, billing details), meeting metadata (times, durations, participant counts), and, when you use certain features, content like recordings, transcripts, and chat logs. The company states it does not sell personal data, but it does use some data for service improvement and targeted advertising on its own platforms. For meetings, Zoom uses end-to-end encryption (E2EE) as an optional mode; the default is AES-256 encryption in transit, which means Zoom can technically access meeting content if compelled or if there is a security breach.

Your data may be processed on servers in various regions, depending on your account type and the data center selected by the host. For enterprise plans, you can choose a specific data residency region, but free and Pro accounts are typically assigned to the region nearest the host. This matters for compliance with GDPR or other local privacy laws, so check your account settings to see where your data is stored.

Common Zoom Privacy Risks

• Zoombombing: Uninvited users join a public or poorly protected meeting and share disruptive or offensive content.
• Meeting recording without consent: Hosts or participants can record sessions, and if the recording includes chat or shared screens, it may capture private information.
• Data breaches: In 2020, Zoom faced scrutiny for sending meeting data to Facebook and for a vulnerability that allowed websites to join a camera without permission. These were patched, but they highlight that third-party integrations and app permissions can introduce risks.
• Phishing and fake meeting links: Attackers create fake Zoom login pages to steal credentials, or send links that install malware.
• Chat and file sharing: Participants can share files or links that contain malicious content, and chat logs are stored unless you disable them.

Key Security Settings to Enable

To reduce the most common risks, adjust these settings in your Zoom web portal (zoom.us/profile/setting) or in the desktop app:

1. Require a meeting password: This is on by default for new meetings, but double-check that it is enabled. Without a password, anyone with the meeting ID can join.
2. Enable the waiting room: This lets the host admit participants one by one, so you can verify who is entering. You can also make it mandatory for all participants except those from your account.
3. Disable “Join before host”: If this is off, participants cannot enter until the host arrives, reducing the chance of an empty meeting being hijacked.
4. Restrict screen sharing to host: Set screen sharing to “Host Only” in the meeting settings to prevent attendees from sharing unwanted content.
5. Lock the meeting once it starts: After all expected participants have joined, use the Security button to lock the meeting so no one else can enter.
6. Turn off file transfer and annotations: If you don’t need them, disable these features to reduce the risk of malware or disruptive drawing.
7. Disable “Allow removed participants to rejoin”: This prevents someone you’ve removed from coming back.

End-to-End Encryption vs. Standard Encryption

Zoom’s default encryption (AES-256) protects data in transit, but Zoom holds the decryption keys, so it can technically access content if required by law or if its servers are compromised. End-to-end encryption (E2EE) is a stronger option: only the meeting participants have the keys, and Zoom cannot decrypt the content. However, E2EE disables some features like cloud recording, live transcription, and phone dial-in. To enable E2EE, go to your web portal, navigate to Settings > Security, and turn on “End-to-end encryption.” Then, when scheduling a meeting, select the E2EE option. Both parties must have E2EE enabled for it to work.

How to Choose the Right Settings for Your Meeting

Consider the sensitivity of your meeting. For a public webinar or a large team meeting, you might prioritize ease of access and use a password plus waiting room. For a confidential board meeting or a therapy session, enable E2EE, disable recording, and restrict screen sharing. For a class or workshop, you might want participants to share screens, so you can allow that but require host approval. Always check the participant list periodically and remove any unknown users.

Common Mistakes and Misconceptions

A common misconception is that a meeting ID is like a phone number—if someone has it, they can join. That is true if the meeting has no password and no waiting room. Another mistake is assuming that the waiting room is foolproof; a host must actively admit participants, and if they click “Admit All” without checking, an intruder can slip in. Also, many people forget that chat messages are stored by default, even after the meeting ends. If you don’t want a record of the chat, disable chat or set it to “Host only” during the meeting.

Another error is ignoring the “Security” button in the meeting toolbar. It gives you quick toggles for waiting room, lock meeting, and remove participant. Use it as a first response if something goes wrong.

Costs and Privacy Trade-offs

Zoom’s free plan includes most security features, but it lacks some administrative controls like single sign-on (SSO) and advanced encryption options. Paid plans (Pro, Business, Enterprise) add more granular settings, such as data residency, custom encryption keys, and compliance certifications (e.g., HIPAA for healthcare). For personal use, the free tier is generally sufficient if you apply the settings above. For business, the paid tiers offer better control over data and user management. Always review Zoom’s privacy policy for the latest details on data retention and sharing.

Alternatives to Zoom

If Zoom’s privacy model doesn’t meet your needs, consider alternatives:

• Jitsi Meet: Open-source, free, and offers E2EE by default. You can self-host for full control.
• Signal: Primarily a messaging app, but it supports group calls with E2EE.
• Microsoft Teams: Offers E2EE for one-on-one calls, but group calls use standard encryption.
• Google Meet: Uses encryption in transit, but not E2EE; it integrates with Google Workspace.

Each has its own privacy trade-offs, so choose based on your threat model and feature needs.

Frequently Asked Questions

Can the host see if I am recording the meeting?

No, the host is not notified when a participant starts a local recording. However, the host can disable local recording in the settings, and some meeting types (like webinars) may not allow it. Always ask for consent before recording, as it may be illegal in some jurisdictions.

Does Zoom sell my data?

Zoom states it does not sell personal data. However, it may share data with service providers and use it for advertising on its own platforms. For example, it may use cookies to track your activity for marketing purposes, but you can control this in your browser or Zoom settings.

Is Zoom safe for therapy or medical sessions?

Zoom offers a HIPAA-compliant plan for healthcare providers, which includes a Business Associate Agreement (BAA). For individual therapy, you should use a provider that offers this plan or use a platform specifically designed for telehealth. Always verify that your therapist uses a compliant service.

What should I do if a stranger joins my meeting?

Immediately use the Security button to remove the participant, then lock the meeting. If they disrupt, you can also disable screen sharing and chat. After the meeting, change your meeting ID and enable the waiting room for future sessions.

Does Zoom work in China?

Zoom has a separate app for users in mainland China, and data is stored on servers in China. If you are concerned about privacy, be aware that the Chinese version is subject to local laws. For international meetings, hosts outside China can use the global version, but participants in China may need to use the local app.

Related

• Bantam Ammo-Saving Guide for Arc Raiders
• Core Lightning Security Check: Was Your Node Exposed?
• JEV Trading: What the Demo Can and Can’t Tell You