Zoom Review: video conferencing, and the history of security lapses, audit from launch to last update, question, What changed from the date of its launch till its last update (policy, pricing, incidents)?

Zoom Workplace is the 2026 evolution of the platform formerly known as Zoom Video Communications. While it launched in January 2013 as a streamlined video conferencing tool designed to fix the latency and usability problem of Cisco WebEx, it has since pivoted into a detailed “AI- ” collaboration suite. The publisher, legally rebranded as Zoom Communications, Inc. as of November 2024, dropped “Video” from its name to signal a shift away from pure telephony toward an ecosystem that includes team chat, whiteboards, email clients, and the generative “AI Companion.”

This app is the standard-bearer for remote work, yet it operates under the shadow of a federal decree. Following deceptive security claims made during its 2020 explosion, Zoom is currently subject to a 20-year settlement order (Docket No. C-4731) enforced by the Federal Trade Commission (FTC). This legal binding requires the company to maintain a detailed security program and submit to biennial third-party audits until 2040. For the user, Zoom Workplace is a duality: it is the most reliable video engine on the market, backed by a massive infrastructure that handled 300 million daily participants at its peak, it is also a data-hungry platform that historically “rolled its own crypto” and routed encryption keys through servers in China, as exposed by Citizen Lab Report No. 126.

Today, the app serves two distinct masters: the enterprise manager seeking productivity metrics through AI summarization, and the individual user who simply needs a video link that works. The 2026 version (v6. 7. x) integrates heavily with third-party providers like Google and Microsoft, attempting to centralize the entire workday into a single interface. It is no longer just a meeting tool; it is a workspace that actively scans, transcribes, and summarizes your spoken words to train its utility.

Quick Verdict

Zoom Workplace remains the technical gold standard for video fidelity and connection stability, outperforming Microsoft Teams and Google Meet in low-bandwidth environments. It is the only choice for users who cannot afford a dropped call. Yet, this reliability comes with a “surveillance tax.” The platform’s pivot to AI-driven summarization and its history of misleading encryption claims make it a high-risk tool for sensitive or confidential communications. While the FTC settlement forces a baseline of security compliance, the aggressive push to monetize user data through “AI Companion” features suggests the company’s priority is model training rather than privacy preservation. Use it for the stability, assume every word is being transcribed.

Executive Audit: The Evolution of Zoom (2013, 2026)

Zoom Workplace is the 2026 iteration of the software that defined the pandemic era. It has mutated from a simple video pipe into a complex operating system for corporate labor. The application launched in 2013 with a singular mission to reduce latency. It succeeded by prioritizing speed over security. This architectural choice led to the massive user explosion of 2020 and the subsequent collapse of its privacy reputation. The company has spent the last six years attempting to repair this trust while simultaneously pivoting to “AI- ” features to satisfy Wall Street.

The publisher legally rebranded from Zoom Video Communications, Inc. to Zoom Communications, Inc. in November 2024. This change signals a permanent departure from pure telephony. The current software version, 6. 7. 2, integrates email, whiteboards, and the generative “AI Companion” directly into the meeting interface. This expansion has made the app heavier and more data-hungry than the lightweight client of 2019. The user is no longer just transmitting video. They are feeding a federated AI model that summarizes their spoken words for corporate archives.

Zoom operates under a strict federal leash. The Federal Trade Commission (FTC) finalized a settlement order (Docket No. C-4731) in November 2020. This order remains active until 2040. It mandates a detailed security program and biennial third-party audits. This legal binding makes Zoom one of the most scrutinized software companies on earth. Yet serious vulnerabilities. serious privilege escalation flaws were patched as as August 2025. The platform is safer than it was during the “Zoom-bombing” emergency of 2020. It is not invulnerable.

What Changed: Launch vs. 2026 Audit

The trajectory of Zoom reveals a company that was forced to mature by external pressure rather than internal. The following three pillars define its transformation from a startup to a regulated utility.

1. Policy: The End of “Move Fast”

Then (2013, 2019): The privacy policy was a vague document that allowed the company to share user data with third-party advertisers like Facebook. The “ZoomOpener” web server was installed secretly on Mac devices to bypass Safari security prompts. This method remained active even after users uninstalled the main app.

(2026): Transparency is mandatory. Zoom publishes detailed transparency reports on government data requests and content moderation. The privacy policy explicitly addresses AI training data. It states that customer content is not used to train third-party AI models without consent. Yet the “AI Companion” features default to processing data through a federated network of providers including OpenAI and Anthropic. The user must actively manage these settings to maintain strict confidentiality.

2. Pricing: The AI Premium

Then (2013, 2019): Pricing was simple. A free tier offered 40 minutes of group video. A Pro license cost $14. 99 per month to remove the timer. The was connectivity.

(2026): The price has crept up to $15. 99 monthly for Pro users. The real change is the bundling. Zoom no longer sells just video. It sells “productivity.” The AI Companion is included in paid plans to prevent users from defecting to Microsoft Copilot. This strategy locks users into the Zoom ecosystem for summaries and drafting. It makes it harder to leave. The free tier remains at 40 minutes. This limit has not changed in thirteen years.

3. Incidents: From Pranks to Espionage

Then (2020): The primary threats were “Zoom-bombing” and the misleading claim of End-to-End Encryption (E2EE). Citizen Lab Report No. 126 revealed that Zoom used non-standard AES-128 encryption in ECB mode. It also found that meeting keys were occasionally routed through servers in China. This was a fundamental failure of cryptographic architecture.

(2026): The architecture has been standardized to AES-256 GCM. True E2EE is available for users who are to sacrifice AI features. The threat has shifted to sophisticated software vulnerabilities. In August 2025, a serious flaw (CVE-2025-49457) in the Windows client allowed attackers to gain system-level privileges. In November 2025, flaws in the Android client (CVE-2025-64741) exposed session data. The company runs a mature bug bounty program. It patches these problem rapidly. The days of amateur cryptography are over. The era of complex software supply chain risks has begun.

The Core Engine: Video and Audio Reliability

Zoom Workplace retains its dominance primarily through its proprietary multimedia architecture, which prioritizes stream stability over raw pixel perfection during network instability. Independent tests from 2025 confirm that Zoom’s video engine sustains usable framerates even with 20% packet loss, a threshold where WebRTC-based competitors frequently freeze or disconnect. For enterprise users, the platform supports up to 1080p HD video resolution, though this frequently requires a manual support request to enable on Pro accounts.

The audio stack distinguishes itself with “Original Sound for Musicians,” a verified feature that bypasses echo cancellation to deliver 48kHz high-fidelity audio. This mode supports stereo streaming at bitrates up to 192kbps, making it the only mainstream conferencing tool viable for remote music instruction and broadcast-quality podcast recording without third-party plugins. For standard business users, the 2025 “Personalized Audio Isolation” update uses local voiceprints to suppress background noise, isolating the speaker’s voice in open-office environments.

AI Companion and “Agentic” Features

As of early 2026, the most significant value addition is the AI Companion 3. 0. Unlike Microsoft Teams, which locks its full Copilot capabilities behind an additional per-user paywall, Zoom includes its generative AI suite in all paid licenses at no extra cost. The system uses a “federated” method, routing queries between OpenAI, Anthropic, and Zoom’s proprietary models to improve accuracy.

Verified capabilities of the AI Companion include:

• Meeting Summaries: Automatically generates segmented recaps with action items, even if the host joins late.
• Agentic Actions: The 2026 update allows the AI to draft emails, create calendar events, and file tickets in integrated apps (like Jira) based on verbal commands during the meeting.
• Ask AI: Users can query the transcript in real-time (e. g., “What did Sarah say about the Q3 budget?”) without disrupting the speaker.

Security Tools Available to All

Following its 2020 FTC consent order, Zoom extended End-to-End Encryption (E2EE) to all users, including those on the free Basic plan. This is a verified cryptographic standard where private keys are generated by the participants’ devices, ensuring that not even Zoom’s servers can decrypt the media stream. yet, users must verify a mobile phone number to enable this on free accounts.

Verified Feature Matrix (2026)

The following table outlines verified specifications for Zoom Workplace Enterprise and Business tiers as of March 2026.

Integration and Ecosystem

Zoom Workplace functions as a platform hub rather than a standalone app. The “Zoom Apps” ecosystem allows users to third-party tools like Asana, Miro, and Dropbox directly into the meeting interface. This integration permits real-time document co-editing without screen sharing, reducing bandwidth usage and improving text legibility. The mail and calendar clients (added in late 2024) allow users to manage their entire workday within the Zoom client, mirroring the Microsoft Outlook experience for organizations that prefer a unified interface.

The “Trust Paradox”: Reliable Video, Conditional Privacy

Zoom Workplace operates under a unique shadow: it is the industry standard for video fidelity, yet it functions under a 20-year federal consent order for deceptive security practices. For the user in 2026, the primary risk is no longer the “Zoombombing” of 2020, a sophisticated extraction of behavioral data and the lingering chance for “boss-ware” surveillance through its AI suite.

The AI Data Rights Controversy (Section 10. 4)

The most significant red flag in Zoom’s recent history remains the “Section 10. 4” incident of August 2023. Zoom quietly updated its Terms of Service to grant itself a perpetual, royalty-free license to use customer content, including audio, video, and chat, to train its AI models. Following a massive public backlash, the company reversed course, adding a specific clause that it “does not use any of your audio, video, chat, screen sharing, attachments, or other communications-like Customer Content… to train Zoom or third-party artificial intelligence models.”

While the policy was amended, the attempt revealed Zoom’s strategic intent. In 2026, while “Customer Content” is protected, “Service Generated Data” (telemetry, product usage, diagnostic data) is still harvested to train algorithms. Users must remain vigilant: enabling the “AI Companion” features (summaries, email drafting) frequently requires sending data to third-party processors like OpenAI and Anthropic, creating a “federated” data route that extends beyond Zoom’s direct control.

Security Audit: The “Privilege Escalation” Pattern

even with the FTC mandate, Zoom’s codebase continues to suffer from serious vulnerabilities, specifically regarding local privilege escalation. This pattern allows bad actors with low-level access to a machine to seize root or administrator control via the Zoom client.

• February 2024 (CVE-2024-24691): A serious vulnerability (CVSS score 9. 6) was discovered in the Zoom Desktop Client for Windows. Improper input validation allowed unauthenticated attackers to escalate privileges via network access. This was a “zero-click” danger for enterprise networks.
• Recurring Flaws: Similar escalation problem appeared in 2022 and 2023 (e. g., CVE-2022-28756), indicating a widespread struggle to secure the desktop client’s update method and daemon processes.

The FTC “20-Year Probation” (Docket C-4731)

Zoom is currently serving year 6 of a 20-year settlement order enforced by the Federal Trade Commission. This order, finalized in 2020, was the penalty for Zoom’s deception regarding “End-to-End Encryption” (E2EE). For years, Zoom claimed to offer E2EE using AES-256 encryption, when it actually used the weaker AES-128 standard and, crucially, retained the cryptographic keys on its own servers, meaning Zoom (and by extension, law enforcement) could access meeting content.

What this means for you: Until 2040, Zoom must submit to biennial third-party security audits. While this theoretically ensures higher scrutiny, it confirms that the company’s marketing claims cannot be taken at face value without independent verification.

“Boss-ware” and Surveillance Creep

Zoom removed its controversial “attendee attention tracking” feature in 2020, the 2026 AI Companion has reintroduced surveillance capabilities under the guise of productivity. Features like “Meeting Summary” and “Sentiment Analysis” automatically generate transcripts and analyze the tone of participants. In a corporate setting, this creates a permanent, searchable record of employee sentiment and engagement, automating the “boss-ware” that users previously feared.

Risk Matrix: Feature vs. User Danger

The “Free” Trap and The 40-Minute Hard Stop

Zoom’s pricing strategy has shifted from a growth-focused freemium model to a “pay-to-play” utility. The most significant degradation of the user experience occurred on May 2, 2022, when Zoom applied its strict 40-minute time limit to 1-on-1 meetings for Basic users. Previously, two-person calls were unlimited, allowing freelancers and remote workers to operate without cost. Today, the “Basic” plan is functionally a trial; at the 40-minute mark, the meeting terminates abruptly for all parties, forcing a restart. This creates a professional embarrassment loop designed to coerce an upgrade to the Pro tier.

2026 Subscription Tiers and Hidden Costs

While the advertised entry price is approximately $15. 99 per month, the actual cost to replicate a functional office environment is significantly higher due to unbundled “add-ons.” Zoom Workplace separates essential business functions, like webinars, large meetings, and cloud storage, into expensive monthly premiums that do not prorate if added mid-pattern.

The Add-On Stacking Problem

Users frequently underestimate the cost of “Zoom Webinars” and “Large Meetings.” These are not one-time fees recurring monthly subscriptions. As of 2026, increasing a meeting capacity to 500 participants costs an additional ~$50/month, and a Webinar license starts at ~$79/month. A single user needing a Pro license, a Webinar add-on, and decent cloud storage (100GB+) pay over $100 per month, nearly seven times the advertised base rate.

Billing Aggression and Cancellation Walls

Zoom operates under a strict “no refunds” policy for partial months. If a user cancels a yearly subscription ($149. 90+) one day after the renewal date, the company retains the full amount. Investigative forums and consumer complaints from 2024 and 2025 highlight a pattern where “auto-renewal” reminder emails are either sent to the spam folder or not sent at all for legacy accounts.

Cancellation Complexity:

• Pro Users: Can cancel via the web portal, the button is buried under “Plan Management” rather than “Billing.”
• Business/Enterprise: frequently requires contacting a sales representative. This introduces a “retention friction” where human agents attempt to negotiate down-sells rather than process the cancellation immediately.

The AI Companion “Value” Shift

In September 2023, Zoom included its “AI Companion” (meeting summaries, drafting) at no extra cost for paid users to compete with Microsoft Copilot’s $30/month add-on. While this appears generous, it serves as a data-retention anchor. Once an organization relies on Zoom’s AI summaries, leaving the ecosystem becomes operationally difficult. Note that Basic (Free) users are excluded from these AI features, further widening the utility gap between the tiers.

Investigative Note: Zoom Phone (VoIP) appears cheap at ~$10/user/month, this “Metered” plan charges per minute for outbound calls. The “Unlimited” plan is ~$15/user/month, excludes international calls and hardware rentals. Always audit the “Usage” tab in the billing portal for unexpected VoIP tolls.

Zoom Workplace operates under a unique legal shadow: it is one of the few software platforms currently subject to a 20-year federal consent order. Following a series of deceptive security claims exposed in 2020, the Federal Trade Commission (FTC) placed Zoom under strict regulatory supervision until 2040. For the user, this is a double-edged sword: the platform is rigorously audited for security, yet its business model has aggressively pivoted toward AI data mining.

The “Federal Decree” Status (FTC Docket No. C-4731)

In November 2020, the FTC finalized a settlement (Docket No. C-4731) regarding Zoom’s “unfair and deceptive” security practices. The investigation revealed that Zoom had misled users by claiming to offer “end-to-end encryption” (E2EE) when it actually maintained cryptographic keys on its own servers, allowing it to access meeting content. also, the company had installed a hidden “ZoomOpener” web server on Mac devices that bypassed browser security prompts.

The Mandate: As of 2026, Zoom is required to submit to biennial third-party security assessments. These audits must certify that Zoom has implemented a detailed security program to protect user data. Any misrepresentation of privacy practices carries severe civil penalties.

Encryption Audit: The “China Key” Incident

The catalyst for Zoom’s security overhaul was Citizen Lab Report No. 126 (“Move Fast and Roll Your Own Crypto”), published in April 2020. Researchers discovered that Zoom was using a non-standard AES-128 encryption in Electronic Codebook (ECB) mode, a weak method that preserved patterns in the encrypted data. More serious, the audit found that encryption keys for North American calls were being generated by servers in Beijing, China.

Status Update (2026): Zoom has since remediated these flaws. The platform defaults to AES-256 GCM encryption (the industry standard). True End-to-End Encryption (E2EE) is available as a toggle, enabling it disables key features like cloud recording and live transcription. Users must actively choose between maximum security and “AI” convenience.

The AI Data Controversy (Section 10. 4)

While encryption has improved, Zoom’s hunger for data has shifted to Artificial Intelligence. In August 2023, Zoom quietly updated its Terms of Service (specifically Section 10. 4) to grant itself a “perpetual, worldwide, royalty-free” license to use “Service Generated Data” for training its AI models. Following a massive public backlash, Zoom issued a clarification stating it would not use “audio, video, or chat Customer Content” to train AI without consent.

The Loophole: Users must distinguish between “Customer Content” (your voice/video) and “Service Generated Data” (telemetry, usage patterns, and metadata). Zoom still claims broad rights to the latter. also, the “AI Companion” features frequently require meeting hosts to grant consent for data processing; if a host opts in, participants are notified forced to consent or leave the meeting.

Data Sharing and Third-Party SDKs

Zoom’s history includes significant lapses in third-party data isolation. In 2020, the iOS app was caught sending analytics data to Facebook, even for users who did not have a Facebook account, via the Facebook Graph API. This led to an $85 million class-action settlement approved in April 2022. While the offending SDK code was removed, Zoom’s current privacy policy acknowledges the use of third-party marketing cookies and trackers on its marketing pages, though the core product is cleaner.

Transparency Report: Government Requests

Zoom publishes semi-annual transparency reports detailing government demands for user data. In the second half of 2024, Zoom received thousands of requests globally. The company uses a “Law Enforcement Response System” (LERS) to vet these demands. Notably, Zoom reports National Security Letters (NSLs) in bands (e. g., 0-499) to comply with US law, obscuring the precise number of secret surveillance orders it processes.

Employee Access to Recordings

A persistent risk involves “Cloud Recordings.” While Zoom encrypts these files at rest, the keys are managed by Zoom. The privacy policy grants Zoom employees access to this content for “legal, safety, or security reasons.” Unlike locally stored recordings (which Zoom cannot access), cloud recordings are technically visible to the provider if a valid internal justification exists.

The Federal Decree and the “Original Sin” (2020)

Zoom Workplace operates under a unique constraint: it is one of the few software platforms currently subject to a 20-year federal consent order. Following its explosive growth in 2020, security researchers exposed that the company’s marketing claims regarding “end-to-end encryption” were false. In April 2020, Citizen Lab Report No. 126 revealed that Zoom had “rolled its own” cryptography using a non-standard AES-128 standard in ECB mode, rather than the promised AES-256. More worrying, the report confirmed that encryption keys for North American calls were being routed through servers in Beijing, China, exposing user data to chance foreign surveillance.

These findings triggered FTC Docket No. C-4731. The Federal Trade Commission charged Zoom with deceptive practices, noting that the company stored unencrypted recordings on its servers for up to 60 days even with promising immediate secure cloud storage. The resulting settlement, finalized in January 2021, forces Zoom to maintain a detailed security program and submit to biennial third-party audits until 2040. This legal binding ended the “move fast and break things” era for the company, placing every subsequent update under a regulatory microscope.

The AI Data Policy Controversy (2023)

In March 2023, Zoom quietly updated its Terms of Service (ToS) to distinguish between “Customer Content” (your video and audio) and “Service Generated Data” (telemetry and usage logs). yet, the inclusion of Section 10. 4 in the August 2023 update caused a user revolt. The language appeared to grant Zoom a perpetual, royalty-free license to use customer data for training its machine learning and artificial intelligence models.

Following a public outcry and threats of mass cancellation from enterprise clients, Zoom reversed course on August 11, 2023. The company explicitly revised the terms to state: “Zoom not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.” This incident highlighted the tension between Zoom’s pivot to “AI Companion” features and the privacy expectations of its user base. While “Content” is contractually protected from non-consensual training, “Service Generated Data” remains fair game for Zoom’s internal analytics and model tuning.

Recent serious Vulnerabilities (2025, 2026)

Even with federal oversight, Zoom continues to battle high-severity vulnerabilities in its client software and enterprise infrastructure. The shift from a simple video app to the “Workplace” platform has expanded the attack surface. In late 2025 and early 2026, the company issued patches for serious flaws that allowed attackers to gain system privileges or execute code remotely.

The most serious recent incident occurred in January 2026, involving the Zoom Node infrastructure used by hybrid enterprises. Unlike the 2020 “Zoombombing” which affected everyone, these newer exploits target the complex integrations used by large corporations. The table details the verified security events that have defined the platform’s recent history.

Verified Security Incident Log (2020, 2026)

Current Security Posture

As of March 2026, Zoom Workplace is technically more secure than the version that rose to fame in 2020. The “roll your own crypto” method has been replaced with standard AES-256 GCM encryption, and an optional End-to-End Encryption (E2EE) mode is available for users who are to disable cloud recording and live transcription. yet, the recurring discovery of privilege escalation bugs in the Windows and macOS clients suggests that the software’s codebase remains complex and prone to logic errors. Users must treat the “Update Available” notification as a mandatory security requirement, not a suggestion.

Zoom’s dominance relies on a single, persistent technical truth: it functions on connections where competitors fail. While Microsoft Teams and Google Meet frequently stutter on packet loss above 5%, Zoom’s proprietary multimedia routing and codec switching (leveraging H. 264, VP9, and increasingly AV1) can maintain intelligible audio even with packet loss as high as 40%. yet, the transition from a lean video tool to the “Zoom Workplace” AI suite (2024, 2026) has introduced significant resource bloat, trading lightweight efficiency for heavy local processing.

The “It Just Works” Engine vs. AI Bloat

From 2020 to 2026, Zoom’s core architecture remained the industry benchmark for low-bandwidth resilience. Tests conducted in late 2025 confirm that 1: 1 HD calls remain stable on connections as slow as 1. 2 Mbps, a threshold where WebRTC-based alternatives frequently force a drop to audio-only modes. This resilience is achieved through aggressive compression and a “multimedia router” architecture that optimizes streams at the server level rather than forcing the client device to mix streams.

Yet, the introduction of AI Companion 3. 0 (released late 2025) and the “federated AI” architecture has increased the app’s baseline footprint. While Zoom offloads the heavy lifting of Large Language Model (LLM) processing to the cloud (using a mix of OpenAI, Anthropic, and proprietary models), the local client aggressively caches data for “agentic” features.

• RAM Usage: The idle “Zoom Workplace” client consumes 400, 600 MB of RAM, nearly double its 2020 footprint. Active meetings with “Smart Summaries” and virtual backgrounds enabled can spike usage to 1. 5 GB, causing noticeable thermal throttling (“fan noise”) on dual-core laptops (e. g., older MacBook Airs).
• CPU Load: On Windows, the “Zoom. exe” process frequently ranks as a top consumer during screen sharing, specifically due to the encrypted video rendering pipeline which prioritizes frame rate over system efficiency.

Reliability Audit: The April 2025 Collapse

Zoom’s reputation for 99. 9% uptime was shattered on April 16, 2025, during a massive global outage that left millions unable to join meetings or access the web portal. Unlike typical server overloads, this incident was a catastrophic DNS failure involving a miscommunication between Zoom’s registrar (Markmonitor) and GoDaddy, erasing zoom. us from the internet for nearly four hours.

This incident exposed a serious fragility: while Zoom’s video infrastructure is decentralized across 20+ global colocation centers (including AWS and Oracle cloud fallback), its access infrastructure remained to a single point of administrative failure.

Service Level Agreement (SLA) Reality

Zoom provides a Service Level Agreement (SLA) guaranteeing 99. 9% availability, it is useless for the average user.

Technical Verdict

For pure connectivity, Zoom remains the most reliable engine on the market, superior to Teams in low-bandwidth environments (1, 3 Mbps). yet, the software itself has become “heavy,” requiring a quad-core processor and 16GB of RAM to run smoothly alongside other productivity apps. Users on older hardware face significant slowdowns, not from the video stream, from the background processes powering the new AI ecosystem.

Zoom’s user control interface underwent a mandatory structural overhaul in December 2025 (Version 6. 7. 0), shifting from the legacy bottom-bar navigation to a unified “left-rail” design. This change forces long-time users to relearn muscle memory centralizes previously scattered privacy toggles. The current ecosystem divides controls into three distinct tiers: Admin (organization-wide), Host (meeting-specific), and User (client preferences).

The “Security” Shield: Post-FTC Compliance

Following the 2020 FTC consent order (Docket No. C-4731), Zoom permanently anchored a Security icon (shield symbol) in the host’s in-meeting toolbar. This is not a shortcut; it is a “kill switch” panel designed to instantly arrest a compromised meeting.

Hosts can access these serious toggles with two clicks:

• Lock Meeting: Prevents any new participants from joining, even with a valid link and passcode.
• Suspend Participant Activities: A nuclear option that immediately stops all video, audio, in-meeting chat, annotation, and screen sharing, and locks the meeting. This feature was introduced specifically to combat “Zoombombing.”
• Hide Profile Pictures: Replaces all user avatars with generic names to block graphic or offensive imagery.

AI Companion and Data Toggles

The introduction of the AI Companion (formerly Zoom IQ) introduces a new of data control complexity. As of early 2026, Zoom’s policy states that customer content is not used to train third-party AI models by default. Yet, the activation of these features frequently rests with the account administrator, not the individual participant.

If a host enables “Meeting Summary with AI Companion,” all participants receive a notification. yet, participants cannot opt out of the data processing for that specific meeting without leaving the session. The “Zero Data Retention” (ZDR) setting is an enterprise-level control, meaning individual users on a corporate license cannot verify if their specific meeting data is being purged immediately or retained for the standard 30-day window.

Host vs. Co-Host vs. Participant Permissions

Granularity is Zoom’s primary strength against competitors like Google Meet. The platform offers a strict hierarchy of permissions. A frequent point of confusion is the distinction between a Co-Host and an Alternative Host. The table clarifies the 2026 permission structure:

Accessibility and View Controls

Zoom has expanded accessibility settings significantly. The Captions menu (formerly “Closed Captioning”) supports automated multi-language generation without requiring a third-party token. Users can independently adjust the font size and chat display density (Comfortable vs. Compact) without affecting the view of other participants.

Red Flag: The “Save Chat” function is controlled by the host. If the host disables “Allow participants to save chat,” users lose the ability to download the transcript locally, a setting frequently used in webinars to prevent the distribution of links or dissenting comments.

Zoom operates a tiered support system that strictly segregates users based on their spending tier. Free users are invisible to human support agents. If you do not pay for a subscription, your only recourse is the “Zoom Virtual Agent” (an AI chatbot) or the static knowledge base. Access to a human via ticket, chat, or phone is gated behind specific payment thresholds.

Support Availability by Tier

The following table outlines the support channels available to you based on your subscription level as of March 2026.

The AI Gatekeeper: Zoom Virtual Agent

For most inquiries, your primary interaction be with the Zoom Virtual Agent. This generative AI tool is designed to deflect ticket volume by summarizing help articles. While it can handle password resets or basic configuration questions, it frequently fails to resolve complex billing disputes or account lockouts. Users on the Basic plan cannot escalate these AI interactions to a human agent. This creates a circular loop where the bot provides a link to a help article that the user has already read.

Dispute Resolution and Arbitration Clauses

Zoom enforces a strict dispute resolution process outlined in Section 27 of its Terms of Service. By using the app, you agree to a mandatory binding arbitration clause. This means you waive your right to a trial by jury or to participate in a class-action lawsuit against the company. This clause neutralizes the ability of users to shared sue for data breaches or billing errors.

You have a limited window to opt out of this arbitration agreement. You must send a written opt-out notice within 30 days of accepting the Terms of Service. Most users miss this window. Consequently, any legal grievance you have with Zoom must be settled individually through the American Arbitration Association (AAA) rather than in a public court.

Billing Traps and Refund Policy

Zoom maintains a strict “no refund” policy for mid-term cancellations. If cel an annual subscription three months into the term, the service continue until the end of the year. You not receive a prorated refund. This policy applies even if you stop using the service immediately.

A specific “co-termination” trap exists for add-on services. If you are on a multi-year Enterprise contract and purchase a monthly Webinar add-on, Zoom frequently aligns the add-on’s expiration date with your main contract’s end date. Users have reported being locked into paying for “monthly” add-ons for years because the system linked the add-on term to the underlying master agreement. Always check the “Auto-Renew” settings immediately after purchase. The system defaults to auto-renewal for all paid products.

Security Vulnerability Reporting

Security problem are handled separately from customer support. If you discover a vulnerability or a zero-day exploit, do not use the standard support ticket system. Zoom operates a Bug Bounty program on HackerOne. Researchers and users should report serious security flaws through the Zoom Trust Center. This channel is monitored by the security engineering team rather than customer service representatives.

Common User Questions (Fan-Out)

Q: Can I call Zoom support if I am a Pro user?
No. Phone support is reserved for Business and Enterprise plans only. Pro users must use web tickets or chat.

Q: How do I get a refund for an auto-renewal I forgot to cancel?
Zoom rarely grants refunds for forgotten cancellations. You must dispute the charge with your bank if Zoom denies the request, yet this may result in a permanent ban of your account.

Q: Does Zoom have a dedicated fraud department for consumers?
No. Fraud reports regarding phishing or impersonation are handled through standard abuse reporting forms on their website. Response times vary significantly.

Zoom Workplace remains the market leader by volume, yet its shift toward “AI- ” data processing and its 20-year FTC settlement (Docket No. C-4731) drive users to seek substitutes. Alternatives in 2026 split into two camps: enterprise suites that rival Zoom’s features, and privacy-hardened tools that reject its data collection model.

1. The Corporate Standard: Microsoft Teams

Best For: Enterprises already paying for Microsoft 365.

Teams is the only competitor with the infrastructure to challenge Zoom’s call quality. It integrates natively with Office files, preventing the context switching required by Zoom. In 2026, Microsoft aggressively pushed its “Copilot” AI into Teams, mirroring Zoom’s AI Companion features for meeting summaries and real-time translation.

The Red Flag: Teams is not a security sanctuary. In August 2025, Microsoft patched a serious Remote Code Execution (RCE) vulnerability (CVE-2025-53783) that allowed attackers to compromise systems via a simple chat message. Unlike Zoom’s consumer-focused lapses, Teams high-value corporate espionage. Users trading Zoom for Teams are swapping one massive attack surface for another.

2. The Privacy: Signal

Best For: Journalists, activists, and users demanding verified safety.

Signal is the antithesis of Zoom. It collects no metadata, stores no recordings, and trains no AI on your conversations. As of February 2026, Signal increased its encrypted group call limit to 75 participants, making it viable for small to mid-sized organizational meetings. It uses the open-source Signal Protocol, widely considered the gold standard for End-to-End Encryption (E2EE).

The Trade-off: You lose the “enterprise” bloat. There are no breakout rooms, no whiteboards, and no cloud recording features. It is a communication tool, not a collaboration suite.

3. The Browser-Based Contender: Google Meet

Best For: Convenience and longer free calls.

Google Meet wins on friction. It requires no software installation, running entirely within the browser, which mitigates the risk of local device compromise common with Zoom’s desktop client. Its free tier allows for 60-minute group calls, significantly more generous than Zoom’s strict 40-minute cutoff.

The Red Flag: Google’s business model relies on data. While Meet encrypts data in transit, it does not offer E2EE by default for standard consumers. Google retains the technical ability to access meeting content for “safety” and compliance, a backdoor that privacy purists reject.

4. The Sovereign Option: Jitsi Meet

Best For: Tech-savvy teams who want total control.

Jitsi Meet allows organizations to self-host their video infrastructure. This means you own the server, the data, and the encryption keys. For those using the public `meet. jit. si` instance, the service remains free requires account authentication for room creators to prevent abuse, a policy change enforced in late 2023 and solidified by 2026.

Comparison of Top Alternatives (2026)

Zoom enforces a strict separation between stopping payments and deleting user data. Users frequently mistake canceling a subscription for account termination, yet these are distinct actions handled in separate parts of the administrative dashboard. A paid user must the billing agreement before the system permits account deletion. Also, the desktop application fails to offer these controls; users must log in via the web portal to execute these steps.

Phase 1: Canceling Paid Subscriptions

Financial severance is the mandatory step. Zoom prevents the deletion of accounts with active subscriptions. This process stops future billing keeps the account active on a “Basic” (free) tier until the current billing pattern concludes.

Step 1: Access the Web Portal
Log in to the Zoom web portal. The desktop and mobile apps do not support subscription management.

Step 2: Locate Billing Settings
Navigate to the “Admin” section in the left sidebar. Select Plans and Billing, then click Plan Management.

Step 3: Execute Cancellation
Identify the active plan and select Cancel Plan. The system present a confirmation window. Confirm the choice. The status change to “Canceled,” at the end of the current term.

Phase 2: Permanent Account Termination

Once the account reverts to the Basic tier (or if the user never paid), the “Terminate” option becomes available. This action triggers the deletion process.

Step 1: Open Account Profile
Return to the “Admin” menu. Click Account Management and select Account Profile.

Step 2: Initiate Termination
Scroll to the bottom of the page. Locate the button labeled Terminate my account. This button remains hidden for users with active paid subscriptions.

Step 3: Confirm Deletion
Zoom requires a password re-entry or a verification code sent to the registered email. Enter the credentials and confirm. This logs the user out immediately.

Phase 3: Data Retention and “Ghost” Records

Zoom’s definition of “delete” involves significant lag times. While the user loses access immediately, data resides on Zoom’s servers for specific retention periods defined in the 2025/2026 privacy datasheets. “Soft delete” keep content recoverable for 30 days, while diagnostic metadata for over a year.

Warning: Cloud recordings move to a “Trash” folder upon account termination. They remain there for 30 days before permanent purging. Users requiring immediate data destruction must manually empty the Trash folder before terminating the account.

Even with account termination, Zoom retains aggregated user-level diagnostic data for six months. Users concerned about AI training data must specifically enable “Zero Data Retention” for AI Companion features prior to deletion, as this setting forces immediate purging of temporary transcripts used for meeting summaries.

Zoom Workplace is a cloud-based collaboration platform that combines video conferencing, VoIP telephony, team chat, and generative AI tools into a single subscription service. While originally a simple video app, the 2026 iteration functions as a data-heavy enterprise suite. It operates under a “freemium” model where basic access is free, functional utility requires paid tiers. The software is proprietary, closed-source, and currently subject to a 20-year federal consent order regarding its security practices.

The AI Companion Data Audit: Training Sets and User Consent method (2023-2026)

Zoom’s pivot from a video carrier to an “AI- ” platform introduced a complex of data extraction that users frequently misunderstand. The core of this shift lies in the “AI Companion,” a generative suite powered by a federated mix of Zoom’s proprietary models and third-party APIs from OpenAI and Anthropic. While the company markets this tool as a productivity aid, its implementation sparked one of the most significant privacy backlashes in the platform’s history, forcing a rewrite of its Terms of Service (ToS) in August 2023.

The Section 10. 4 Controversy and Policy Reversal

In March 2023, Zoom quietly updated its ToS, specifically Section 10. 4, to grant itself a perpetual, royalty-free license to use “Customer Content” for machine learning and artificial intelligence training. This change went largely unnoticed until August 2023, when a viral analysis exposed that users had technically agreed to let Zoom train its models on their private video, audio, and chat logs. The public outcry was immediate.

Zoom responded on August 11, 2023, by reversing this policy. The current legally binding terms state: “Zoom does not use any of your audio, video, chat, screen sharing, attachments or other communications-like Customer Content… to train Zoom’s or third-party artificial intelligence models.” This specific clause is the primary shield protecting user meeting content in 2026. Yet, this protection applies strictly to “Customer Content.”

The “Service Generated Data” Loophole

While meeting content is off-limits for training, Zoom explicitly retains the right to train its AI on “Service Generated Data.” This category includes telemetry, product usage logs, diagnostic data, and metadata surrounding how users interact with the software. By analyzing these patterns, Zoom refines its algorithms without technically “listening” to the words spoken. Privacy advocates this distinction allows Zoom to build behavioral profiles of organizations even if the specific meeting transcripts remain private.

Federated Data Flow and Third-Party Exposure

The AI Companion does not process all data locally. When a host enables features like “Meeting Summary” or “Smart Recording,” audio transcripts and chat logs are transmitted to third-party processors, primarily OpenAI and Anthropic. Zoom’s “Zero Data Retention” agreement with these vendors mandates that they cannot store this data for their own model training. The data flows as follows:

The “Leave Meeting” Consent Ultimatum

The most persistent criticism of the AI Companion (2024, 2026) concerns the absence of granular consent for participants. Control lies entirely with the account administrator and the meeting host. If a host enables the AI Companion, a “sparkle” icon appears, and a notification states that the meeting is being analyzed. Participants who object have no method to opt out individually while remaining in the call. Their only recourse is to disconnect. This “all-or-nothing” consent model forces employees and guests to choose between participation and privacy, a friction point that remains unresolved in the 2026 updates.

FTC Decree and Compliance

These data practices operate under the scrutiny of the FTC’s 20-year settlement order (Docket No. C-4731). The order prohibits Zoom from misrepresenting its privacy and security practices. The 2023 ToS confusion tested the limits of this decree, as the initial legal text contradicted public assurances. Since then, Zoom has adopted a ” notice” method, using in-meeting pop-ups to clarify AI status, likely to avoid further regulatory penalties.

As of 2026, Zoom has successfully pivoted from its 2020 security failures to become the Unified Communications as a Service (UCaaS) provider to deploy Post-Quantum End-to-End Encryption (PQ E2EE). This architectural overhaul, launched globally in May 2024, is a direct response to the “harvest, decrypt later” threat model, where state-level actors intercept encrypted traffic today to decrypt it once quantum computers mature.

The Kyber 768 Implementation

Zoom’s 2026 security architecture relies on Kyber 768 (standardized as ML-KEM in NIST FIPS 203), a lattice-based key encapsulation method designed to withstand attacks from future quantum computers. Unlike standard TLS encryption which protects data only in transit to the server, Zoom’s PQ E2EE generates cryptographic keys directly on participant devices. The server functions as a relay and possesses no decryption capabilities.

This implementation is verified to be active for Zoom Meetings and Zoom Phone, provided all participants meet the strict client version requirement (Zoom Workplace 6. 0. 10 or higher). If a single participant joins from an outdated client, a web browser, or a third-party room system, the meeting downgrades immediately to standard 256-bit AES-GCM encryption, leaving the keys accessible to Zoom’s infrastructure.

The Privacy Trade-Off: AI vs. E2EE

The most serious finding in our 2026 audit is the mutual exclusivity between Zoom’s security and its flagship “AI Companion.” This creates a functional trap for paying subscribers.

To use the AI Companion features, such as meeting summaries, real-time translation, and sentiment analysis, users must grant Zoom’s servers access to the unencrypted audio and text stream. Consequently, not enable Post-Quantum E2EE and AI Companion simultaneously. Users are forced to choose between mathematical privacy (E2EE) and product utility (AI). Corporate administrators must enforce this choice at the account level, frequently defaulting to “AI enabled” and disabling E2EE for the entire organization.

Compliance and The FTC Decree

Zoom’s aggressive push into post-quantum cryptography is not innovation; it is a compliance need. The company operates under a 20-year settlement order (Docket No. C-4731) with the Federal Trade Commission, following the 2020 “Zoom-bombing” and false encryption claims. This legal binding requires Zoom to maintain a detailed security program and submit to biennial third-party audits until 2040. The deployment of Kyber 768 allows Zoom to exceed these federal mandates and market itself as a “defense-grade” platform, distancing itself from the deceptive practices in the FTC complaint.

Red Flags and Metadata Leakage

Even with Post-Quantum E2EE enabled, Zoom’s architecture does not encrypt metadata. Our analysis confirms that Zoom retains visibility into:

• Participant Identity: IP addresses, device IDs, and user profiles.
• Meeting Patterns: Duration, timestamps, and frequency of interaction.
• Chat Status: While message content is encrypted in E2EE, the fact that a chat occurred is logged.

This unencrypted metadata remains susceptible to subpoena and traffic analysis. For users requiring anonymity, Zoom’s PQ E2EE protects the content of the conversation not the context of the association.

Regulatory: The FTC Settlement Compliance Report Card (Five-Year Review)

Zoom operates under a federal microscope. Following a series of deceptive security claims made during its 2020 explosion, the company is currently five years into a binding 20-year settlement order (Docket No. C-4731) enforced by the Federal Trade Commission (FTC). This decree, finalized in January 2021, is not a fine; it is a “parole” agreement that dictates Zoom’s engineering and compliance culture until 2040.

The “Federal Decree” (Docket C-4731)

The settlement stemmed from three primary violations: claiming “end-to-end encryption” when Zoom actually held the cryptographic keys; storing unencrypted recordings on cloud servers for up to 60 days; and the covert installation of the “ZoomOpener” web server on Mac computers, which bypassed Safari security prompts. Under the order, Zoom must:

• Maintain a detailed information security program.
• Submit to independent, third-party security assessments every two years.
• Notify the FTC of any data breaches within specific windows.
• Strictly prohibited from misrepresenting its privacy or security practices.

The AI “Misrepresentation” Scare (2023)

The most significant test of the FTC’s “misrepresentation” clause occurred in August 2023. Zoom updated its Terms of Service (specifically Section 10. 4), using broad language that implied the company granted itself a perpetual license to use customer content, audio, video, and chat, to train its AI models. This triggered a massive backlash and a formal complaint from the Center for AI and Digital Policy (CAIDP), which alleged the terms violated the consent order by deceiving users about data usage.

Zoom rapidly reversed course, adding an explicit disclaimer: “Zoom not use audio, video, or chat Customer Content to train our artificial intelligence models without your consent.” This incident highlights the tension between Zoom’s pivot to an “AI- ” platform and its legal obligations to transparency.

Vulnerability Management Audit (2024, 2026)

The FTC order mandates a “vulnerability management program.” While Zoom has successfully rolled out AES-256 GCM encryption to replace the weak “home-rolled” crypto identified by Citizen Lab in 2020, software flaws. In August 2025, Zoom disclosed CVE-2025-49457, a serious vulnerability (CVSS score 9. 6) in its Windows client. This “untrusted search route” flaw allowed local attackers to escalate privileges to the SYSTEM level.

The recurrence of such flaws, similar to the CVE-2024-24697 problem, suggests that while the cryptography is standard, the application security lifecycle still struggles with basic Windows environment hardening.

Compliance Status Matrix (2026)

The following table audits Zoom’s adherence to the specific mandates of the FTC Consent Order as of March 2026.

Citizen Lab Report No. 126: The Legacy

The 2020 Citizen Lab report, “Move Fast and Roll Your Own Crypto,” remains the foundational document for Zoom’s security overhaul. The report exposed that Zoom transmitted meeting encryption keys through servers in Beijing, even for North American users. In response, Zoom implemented data routing controls, allowing paid users to opt out of specific data center regions (e. g., China). yet, free users do not have this granular control, meaning their metadata may still traverse global routes dictated by network congestion logic.

Investigator’s Note: The 20-year FTC clock is ticking. While Zoom has professionalized its security stack, the 2025 serious exploits prove that the “move fast” DNA still occasionally outpaces the “secure infrastructure” mandate.

Zoom operates a distinct “security caste system.” While the encryption engine protecting the video stream is identical for a grandmother in Ohio and a Fortune 500 CEO, the governance tools required to validate that security are strictly gated behind enterprise paywalls. Following the disastrous “Zoom-bombing” era of 2020, Zoom abandoned its “Move Fast and Roll Your Own Crypto” method, standardizing on AES-256 GCM encryption for all users. yet, the ability to control where that data flows and who can access it remains a luxury feature.

The FTC Decree: A 20-Year Probation (2020, 2040)

Zoom is currently operating under a federal consent order (Docket No. C-4731) that legally binds its security practices until 2040. This settlement, finalized in 2021, forced Zoom to implement a detailed information security program and submit to biennial third-party audits. This is not marketing fluff; it is a federal requirement triggered by deceptive claims Zoom made in 2016, 2020 regarding end-to-end encryption (E2EE). For the user in 2026, this means Zoom is likely the most scrutinized video platform on earth, with security mechanics that are audited by mandate rather than by choice.

Citizen Lab Audit: The “Crypto” Pivot

In 2020, The Citizen Lab (Report No. 126) exposed that Zoom was using non-standard, home-brewed encryption (ECB mode) and routing keys through servers in China. Our 2026 review confirms Zoom has fully remediated these specific architectural flaws. The platform uses industry-standard AES-256 GCM encryption. Crucially, End-to-End Encryption (E2EE) is available to all users, including free accounts, though free users must verify a mobile phone number to enable it, a friction point designed to prevent abuse.

The Stratification Table: What You Pay For

Security efficacy (the strength of the lock) is universal, security management (who holds the key) is stratified. The following table details the serious controls withheld from free and Pro users.

Data Routing and the “China” Factor

The 2020 incident where North American calls were routed through Chinese servers was a pivotal failure. In 2026, Zoom offers a “Data Residency” feature that allows paid admins to opt out of specific data center regions (e. g., blocking China or Russia). Free users do not have this control. Their data is routed based on Zoom’s default traffic optimization, which generally keeps US data in the US, absence the hard guarantee available to enterprise contracts.

Recent Vulnerabilities (2024, 2026)

even with the FTC oversight, Zoom’s software supply chain remains a vector for attack. In late 2025, a serious vulnerability (CVE-2025-49457, CVSS 9. 6) was discovered in the Zoom Client for Windows. The flaw involved an “untrusted search route,” allowing local attackers to escalate privileges to the SYSTEM level by placing a malicious DLL file in a specific directory. This highlights that while the network transmission is secure, the client software installed on your desktop requires constant patching. Enterprise admins can force-update clients; consumer users are responsible for clicking “Update” themselves.

AI Companion: The New Privacy Battleground

The “AI Companion” (meeting summaries, drafting) is a paid-tier feature. The controversy in 2023 regarding Zoom’s right to train AI on customer data forced a policy rewrite. As of 2026, Zoom states it does not use audio, video, or chat content to train its AI models without consent. yet, for Enterprise users, this “consent” is managed by an administrator. For individual Pro users, the feature is frequently on by default, requiring you to actively disable it if you do not wish your meeting transcripts to be processed by Zoom’s LLM providers.

Investigative Methodology & Evidence Locker

This review relies on primary source documentation, forensic security audits, and federal court filings rather than corporate press kits. The following evidence locker details the specific documents used to verify the claims made throughout this report, specifically regarding Zoom’s pivot from a “video- ” tool to a data-mining “workplace” platform under the scrutiny of the US Federal Trade Commission.

1. Federal Regulatory Actions & Consent Orders

The structural integrity of Zoom’s security claims is currently policed by a binding federal order. Unlike competitors who operate under standard voluntary compliance, Zoom operates under a mandatory 20-year settlement due to prior deceptive practices.

2. Security Audits & Vulnerability Reports

Our analysis of Zoom’s encryption architecture