Zoom

Is Zoom safe?

Yes, for most people and most meetings. Zoom was the poster child for bad security in 2020, and the FTC found it had misled users about encryption. Since then it has added end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, made passcodes and waiting rooms standard and stopped most zoombombing. We score it 71/100, well above most social apps but below privacy-first tools such as Signal.

Two caveats. End-to-end encryption is not on by default. And in 2026 the most common Zoom threat does not come from Zoom at all: it is a fake meeting link.

What the FTC found

In November 2020 the FTC settled a complaint against Zoom without a fine but with a 20-year order requiring a full security program. The allegations were specific. Since at least 2016, Zoom had advertised "end-to-end, 256-bit encryption" when it actually used a lower level of protection and held the keys. Some cloud recordings were kept unencrypted on its servers for up to 60 days, despite claims they were encrypted immediately. And a July 2018 Mac update had secretly installed a web server, ZoomOpener, which bypassed a Safari safeguard and could reinstall Zoom after users deleted it.

A separate US class action over zoombombing and data sharing with Facebook, Google and LinkedIn ended with an $85 million settlement in 2021.

Encryption today

Mode	Who can access content	What you lose
Standard (default)	You, other participants, and in principle Zoom	Nothing
End-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary	Only participants	Cloud recording, live transcription, AI Companion, joining by phone

Zoom added end-to-end encryption in October 2020 and post-quantum key exchange in 2024. For a medical, legal or sensitive personal conversation, turn it on. For a team stand-up, the default is fine for most people.

Where your call travels also changed after 2020. In April that year, researchers at the University of Toronto's Citizen Lab found that some meetings outside China had their encryption keys issued by servers in China. Zoom called it a mistake, fixed the routing and now lets paid account administrators choose which data-centre regions their meetings can pass through. If your organisation handles sensitive data, check that setting.

What Zoom collects

Apple's privacy label lists no data used to track you across other companies. Email, name and user ID are used for Zoom's own marketing. Messages, photos and videos, audio, user ID and diagnostics feed analytics, and precise and coarse location are used for app features. In August 2023 Zoom faced a backlash over terms of service that seemed to allow AI training on customer content. It rewrote them and now says it does not use audio, video, chat, screen sharing or attachments to train AI models.

The fake-invite problem

Criminals copy Zoom's look because people trust it. Two documented campaigns in 2026:

• February. Netcraft found fake Zoom and Google Meet pages that tricked people into installing remote-access software, giving attackers control of their computers.
• June. Switzerland's National Cyber Security Centre warned of fake Zoom invitations that open a realistic page with a pop-up demanding an urgent update. The page uses a "browser-in-the-browser" fake window, complete with a false address bar. The "update" installs remote-access tools or malware.

A related trick abuses Zoom's genuine remote control feature: an attacker posing as an interviewer or investor asks to share your screen, then requests control.

How to use Zoom safely

1. Join from the installed Zoom app or by typing the meeting ID, not from a link you did not expect.
2. Never download an "update" from a meeting page. The real app updates itself.
3. If you host, keep the waiting room and passcode on, and limit screen sharing to the host.
4. Turn off remote control in your Zoom web settings if you never use it.
5. For sensitive calls, enable end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary in your account settings and choose it when scheduling.
6. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for your Zoom account.

How we scored it

Scams and harmful content (76) and security (74) are Zoom's strongest factors now that the 2020 flaws are fixed, though end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary still needs switching on. The regulatory record (62) reflects the FTC order and the $85 million settlement. For private one-to-one calls, WhatsApp and Signal encrypt end to end by default.