{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"deed3507-de9d-4d32-a03a-a43b250f9a21","screeningDate":"2026-09-24T16:32:38.121Z","publicationGate":"published","company":{"id":"59438443-572b-47a4-a4ac-f0091158e154","name":"Zoom","slug":"zoom","industry":"Cloud/SaaS"},"policy":{"id":"0ec3d4b4-79d4-4e2e-8a66-60dde69a5c10","name":"Privacy Statement","type":"privacy","jurisdiction":"Global","sourceUrl":"https://www.zoom.com/en/trust/privacy/privacy-statement/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-24T16:32:38.104Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"ae8f30d854f985a13f13d7e11a5efa5bf4d6f06927e5cefe9b60979ea986ba57","capturedAt":"2026-07-28T22:39:45.945Z"},"current":{"version":3,"sha256":"fc85564f79365a46b8ad700c95c6445840426d47b79b0bb1e951fd863d1cf8af","capturedAt":"2026-09-24T16:32:38.109Z"}},"assessment":{"summary":"The Zoom Privacy Statement was updated with a new date, but no actual policy changes were found, meaning existing data practices continue.","overallRisk":"Medium","overallScore":7,"previousPublicChange":{"id":"66fcf7ee-a113-43fa-bd57-4cb533e1fe0c","overallRisk":"Medium","overallScore":4,"screeningDate":"2026-07-28T22:39:45.952Z"},"scoreDelta":3,"direction":"higher","reasons":[{"icon":"warning","textEn":"Extensive data collection across many categories remains unchanged.","textIt":"L'ampia raccolta di dati in molte categorie rimane invariata.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad sharing with various third parties, including marketing partners, persists.","textIt":"La vasta condivisione con varie terze parti, inclusi i partner di marketing, persiste.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Account owners retain significant control over user data and settings.","textIt":"I titolari degli account mantengono un controllo significativo sui dati e sulle impostazioni degli utenti.","deltaScore":0,"evidenceQuote":"Account Owner: An account owner is the organization or individual that signs up for a Zoom account. Typically, an account owner designates one or more people (called an “administrator”) to manage their account and can grant privileges to us","evidenceSide":"old","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"}],"keyPoints":[{"textEn":"The policy's 'Last updated' date changed from July 27, 2026, to September 17, 2026.","textIt":"La data di 'Ultimo aggiornamento' della politica è cambiata dal 27 luglio 2026 al 17 settembre 2026.","sentiment":"neutral"},{"textEn":"No substantive changes were identified in the provided policy text, indicating consistent data practices.","textIt":"Nessuna modifica sostanziale è stata identificata nel testo della politica fornito, indicando pratiche sui dati coerenti.","sentiment":"neutral"},{"textEn":"Zoom explicitly states it does not use customer content (audio, video, chat) to train its AI models.","textIt":"Zoom dichiara esplicitamente di non utilizzare i contenuti dei clienti (audio, video, chat) per addestrare i suoi modelli di IA.","sentiment":"positive"},{"textEn":"Extensive personal data, including usage and device information, is collected and shared with third parties.","textIt":"Vengono raccolti e condivisi con terze parti dati personali estesi, incluse informazioni sull'utilizzo e sul dispositivo.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Zoom must ensure their data processing activities comply with GDPR, especially regarding data processing agreements with Zoom and international data transfers. Account owner controls are crucial for managing user privacy settings and compliance.","complianceNoteEn":"GDPR Articles 28, 44-49"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's extensive data collection and broad third-party sharing pose a medium risk under GDPR, requiring clear consent and defined retention periods. Biometric data processing for 'Enhanced Features' demands explicit consent, aligning with GDPR's strict rules on sensitive data.","complianceNoteEn":"GDPR Articles 6, 9, 13, 28"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using Zoom must ensure their operations comply with a patchwork of international privacy regulations. Data processing agreements and robust internal policies are essential to mitigate risks associated with cross-border data transfers and third-party sharing.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, individuals face medium risk due to extensive data collection and sharing, which may vary in legality and transparency across jurisdictions. The explicit exclusion of customer content from AI training is a positive, but overall data handling requires vigilance.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises must navigate various state privacy laws, ensuring their use of Zoom aligns with data processing agreements and consumer rights. Managing account owner controls is vital for compliance with data sharing and retention requirements.","complianceNoteEn":"State Privacy Laws (e.g., CPRA, VCDPA)"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users in the US, particularly California, retain rights under CCPA/CPRA regarding data access, deletion, and opting out of data sharing. The collection of biometric data for 'Enhanced Features' requires careful consideration under state-specific biometric privacy laws.","complianceNoteEn":"CCPA/CPRA, BIPA (IL)"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/deed3507-de9d-4d32-a03a-a43b250f9a21","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"97587447f383acc9e992a2847e52d28b7536a595069b484b16169f450037e7b3"}