conferencing

You are currently browsing the archive for the conferencing category.

The gentle lawgiver

December 6, 2021 in conferencing, Identity, iiw, Obituary | 2 comments

This is about credit where due, and unwanted by the credited. I speak here of Kim Cameron, a man whose modesty was immense because it had to be, given the size of his importance to us all.

See, to the degree that identity matters, and disparate systems getting along with each other matters—in both cases for the sakes of each and all—Kim’s original wisdom and guidance matters. And that mattering is only beginning to play out.

But Kim isn’t here to shake his head at what I just said, because (as I reported in my prior post) he passed last week.

While I expect Kim’s thoughts and works to prove out over time, the point I want to make here is that it is possible for an open and generous person in a giant company to use its power for good, and not play the heavy doing it. That’s the example Kim set in the two decades he was the top architect of Microsoft’s approach to digital identity and meta systems (that is, systems that make disparate systems work as if just one).

I first saw him practice these powers at the inaugural meeting of a group that called itself the Identity Gang. That name was given to the group by Steve Gillmor, who hosted a Gillmor Gang podcast (here’s the audio) on the topic of digital identity, on December 31, 2004: New Years Eve. To follow that up, seven of the nine people in that podcast, plus about as many more, gathered during a break at Esther Dyson‘s PC Forum conference in Scottsdale, Arizona, on March 20, 2005. Here is an album of photos I shot of the Gang, sitting around an outside table. (The shot above is one of them.) There was a purpose to the meeting: deciding what we should do next, for all of the very different identity-related projects we were working on—and for all the other possible developments that also needed support.

Kim was the most powerful participant, owing both to his position at Microsoft and for having issued, one by one, Seven Laws of Identity, over the preceding months. Like the Ten Commandments, Kim’s laws are rules which, even if followed poorly, civilize the world.

Kim always insisted that his Laws were not carved on stone tablets and that he was no burning bush, but those laws were, and remain, enormously important. And I doubt that would be so without Kim’s 200-proof Canadian modesty.

The next time the Identity Gang met was in October of that year, in Berkeley. By then the gang had grown to about a hundred people. Organized by Kaliya (IdentityWoman) Young, Phil Windley, and myself (but mostly the other two), the next meeting was branded Internet Identity Workshop (IIW), and it has been held every Fall and Spring since then at the Computer History Museum (and, on three pandemic occasions, online), with hundreds, from all over the world, participating every time.

IIW is an open space workshop, meaning that it consists entirely of breakouts on topics chosen and led by the participants. There are no keynotes, no panels, no vendor booths. Sponsor involvement is limited to food, coffee, free wi-fi, projectors, and other graces that carry no other promotional value. (Thanks to Kim, it has long been a tradition for Microsoft to sponsor an evening at a local restaurant and bar.) Most importantly, the people attending from big companies and startups alike are those with the ability to engineer or guide technical developments that work for everyone and not for just those companies.

I’m biased, but I believe IIW is the most essential and productive conference of any kind, in the world. Conversations and developments of many kinds are moved forward at every one of them. Examples of developments that might not be the same today but for IIW include OAuth, OpenID, personal clouds, picos, SSI, VRM, KERI, and distributed ledgers.

I am also sure that progress made around digital identity would not be the same (or as advanced) without Kim Cameron’s strong and gentle guidance. Hats off to his spirit, his laws, and his example.

 

 

Home is where one’s butt is

July 13, 2020 in california, conferencing, Digital Life, Family, Friends, Social, Travel | Permalink

I don’t want to explain why we’re bivouac’d at a friend’s house in San Marino. What matters, for the purpose of this post, is that we wouldn’t be here if it weren’t for the Covid-19 pandemic.

But hey, it’s a nice house in a nice town. My only complaint is that there’s nothing resembling an office desk or chair here. I’ve coped by collecting my ass and my electronics within an arrangement of mostly antique furniture. That’s what you see in the screenshot above. (From my most recent Floss Weekly podcast.) The rest of the house looks kinda like the set of Knives Out.

I start with this setting because a friend asked me to write my own version of what Francine @Hardaway published today in Releasing My Former Life. (It’s a good piece. Go read it. I also thank Francine for turning me on to #Clubhouse. It is reportedly invite-only and apparently website-less, but I’m hoping she or a reader can get me one. Or two.)

So, what to report?

Well, in pre-pandemic times my wife and I were on the road at least a third of the time, so we’re used to operating out of hotel rooms, conference spaces and seats by the gates of departing flights at airports. So living in places other than home is not odd for us. It is odd to go around wearing masks in public while keeping our distance, as if everyone had just farted; but we hardly go out at all. We provision the kitchen here with runs to Trader Joe’s or Costco on days when they open early for geezers, and that only happens every couple weeks or so. Also, this region isn’t one of those in denial of the pandemic. People here tend to have Fauci-compliant public health practices.

In the early mornings or late evenings, when it’s not 95° outside, I do venture out for walks of 2-3 miles or more in the neighborhood. The roads are wide here, and the pedestrian traffic is light, so I leave the mask off most of the time. There are also lots of amazing trees and gardens, so I’ll pause to admire those and post occasional photos of interesting stuff on Instagram. (This kind of thing, by the way, comprises almost my entire experience of Instagram.)

While paying work has taken a hit, I remain overcommitted to all the obligations I had before the pandemic arrived, plus a couple new ones, such as the Floss Weekly podcast. It bothers me that I’m not as efficient or as effective in that work as I’d like, but being bothered about it isn’t the same as being depressed or anxious. It just kinda sucks.

Other stuff…

  1. Dorothy Parker said (or is said to have said) that she preferred the company of younger men “because their stories are shorter.” I am mindful of that. I also know it’s way too easy to talk about infirmities that accumulate, lengthen and get more complicated with age. So I avoid writing, thinking or talking about being old, even though it keeps me up at night, mostly because I have to pee.
  2. I’m optimistic about the long-run future, though the short run will surely get worse before it gets better. (Bad things happen when people die at wartime rates and large hunks of the economy are turned off.) I could say more about that, but I won’t, because—
  3. There is far more than enough political writing and talk. Sure, I fantasize about speaking up, because I do think I have some useful things to say. I just don’t expect what I say to make a bit of difference. The noise level is so high right now, and the effect level of any given tweet or post is so low, that I’m disinclined to say much. Add that to what I said here in 2014 and here two months ago, and you’ll see why I’d mostly rather work on other stuff.

The main thing for me right now is Customer Commons. If it succeeds, it will be the most leveraged thing I’ve ever done, meaning the best for the world. If you’re interested in helping, drop me an email. First name at last name dot com. Thanks.

 

 

From meat space to meet space

April 9, 2020 in adtech, Business, conferencing, Events, iiw, unconferencing | Permalink

We’re 19 days away from our 30th Internet Identity Workshop, by far the best Open Space unconference I know. (Okay, I’m biased, since I’m one of its parents.) For the first time since 2006, it won’t be happening at the Computer History Museum, which (as you might expect) is closed for awhile. C’est la quarantaine. Instead we’re doing it here…

…where nearly all meetings happen these days. (HT to @hughcards for that portrait of the Internet.)

We’re actually excited about that, because we get to pioneer at unconferencing online in meet space, much as we did with unconferencing offline in meat space.

Since you’ll ask, we’ll be doing this with QiqoChat, an online community, meeting and event platform that is integrated with Zoom, which has been in the news lately. As you probably know by now, much of that news has been bad. (Top item this morning: US Senate tells members not to use Zoom.)

I suppose I played a part in that, with Zoom needs to clean up its privacy act (which got huge traffic) and the three posts that followed: More on Zoom and Privacy, Helping Zoom, and Zoom’s new privacy policy.

After the last of those, I spoke with Erik Yuan, Zoom’s CEO, who had reached out and seemed very receptive to my recommendations. Mostly those were around getting rid of tracking on Zoom’s home pages. This is jive that marketing likes and the privacy policy can’t help but cover—which, optically speaking, makes it look like everything Zoom does involves tracking for marketing purposes. The company hasn’t acted on those recommendations yet, but I know it’s been busy. What I read here and here from the Citizen Lab is encouraging. So, we’ll see.

Let’s also remember that Zoom isn’t the only conferencing platform. (The Guardian lists a few among many options. One not mentioned but worth considering: Jitsi, which is open source.)

Back to IIW. As it says here,

  • We will have an Opening Circle each day where we set the agenda
  • People will propose and host sessions, and sessions will be held in breakout spaces
  • After the end of sessions for the day, we’ll do a Closing Circle with Open Gifting ~ just like we always do
  • We will still hold Demo Sessions and the Tech Sandbox Fair
  • We will still publish the Book of Proceedings with notes from all the sessions
  • And, since we can’t have a celebratory cake, we’re planning on a Commemorative T-shirt for everyone, that is included with registration
  • We won’t have Rich, our favorite barista, or a snack table, but we will still have the same high-quality discussions and working sessions that make IIW a unique event

Also,

  • If you’re already registered for IIW, then you’re set. The only thing to do is cancel any travel plans.
  • If you haven’t registered yet, please do so at: https://iiw30.eventbrite.com

So help us make it happen for the first time, and better than ever thereafter.

And let’s hope this quarantine thing is over in time for our next IIW, which will be in both meat and meet space, next October, from the 20th to the 22nd.

 

Zoom’s new privacy policy

March 30, 2020 in adtech, advertising, Business, conferencing, data, education, marketing, problems | 4 comments

Yesterday (March 29), Zoom updated its privacy policy with a major rewrite. The new language is far more clear than what it replaced, and which had caused the concerns I detailed in my previous three posts:

  1. Zoom needs to clean up its privacy act,
  2. More on Zoom and privacy, and
  3. Helping Zoom

Those concerns were shared by Consumer Reports, Forbes and others as well. (Here’s Consumer Reports‘ latest on the topic.)

Mainly the changes clarify the difference between Zoom’s services (what you use to conference with other people) and its websites, zoom.us and zoom.com (which are just one site: the latter redirects to the former). As I read the policy, nothing in the services is used for marketing. Put another way, your Zoom sessions are firewalled from adtech, and you shouldn’t worry about personal information leaking to adtech (tracking based advertising) systems.

The websites are another matter. Zoom calls those websites—its home pages—”marketing websites.” This, I suppose, is so they can isolate their involvement with adtech to their marketing work.

The problem with this is an optical one: encountering a typically creepy cookie notice and opting gauntlet (which still defaults hurried users to “consenting” to being tracked through “functional” and “advertising” cookies) on Zoom’s home page still conveys the impression that these consents, and these third parties, work across everything Zoom does, and not just its home pages.

And why call one’s home on the Web a “marketing website”—even if that’s mostly what it is? Zoom is classier than that.

My advice to Zoom is to just drop the jive. There will be no need for Zoom to disambiguate services and websites if neither is involved with adtech at all. And Zoom will be in a much better position to trumpet its commitment to privacy.

That said, this privacy policy rewrite is a big help. So thank you, Zoom, for listening.

 

Helping Zoom

March 29, 2020 in adtech, advertising, Business, conferencing, marketing, Pandemic, problems, Technology, VRM | 3 comments

[This is the third of four posts. The last of those, Zoom’s new privacy policy, visits the company’s positive response to input such as mine here. So you might want to start with that post (because it’s the latest) and look at the other three, including this one, after that.]

I really don’t want to bust Zoom. No tech company on Earth is doing more to keep civilization working at a time when it could so easily fall apart. Zoom does that by providing an exceptionally solid, reliable, friendly, flexible, useful (and even fun!) way for people to be present with each other, regardless of distance. No wonder Zoom is now to conferencing what Google is to search. Meaning: it’s a verb. Case in point: between the last sentence and this one, a friend here in town sent me an email that began with this:

That’s a screen shot.

But Zoom also has problems, and I’ve spent two posts, so far, busting them for one of those problems: their apparent lack of commitment to personal privacy:

  1. Zoom needs to cleanup its privacy act
  2. More on Zoom and privacy

With this third post, I’d like to turn that around.

I’ll start with the email I got yesterday from a person at a company engaged by Zoom for (seems to me) reputation management, asking me to update my posts based on the “facts” (his word) in this statement:

Zoom takes its users’ privacy extremely seriously, and does not mine user data or sell user data of any kind to anyone. Like most software companies, we use third-party advertising service providers (like Google) for marketing purposes: to deliver tailored ads to our users about Zoom products the users may find interesting. (For example, if you visit our website, later on, depending on your cookie preferences, you may see an ad from Zoom reminding you of all the amazing features that Zoom has to offer). However, this only pertains to your activity on our Zoom.us website. The Zoom services do not contain advertising cookies. No data regarding user activity on the Zoom platform – including video, audio and chat content – is ever used for advertising purposes. If you do not want to receive targeted ads about Zoom, simply click the “Cookie Preferences” link at the bottom of any page on the zoom.us site and adjust the slider to ‘Required Cookies.’

I don’t think this squares with what Zoom says in the “Does Zoom sell Personal Data?” section of its privacy policy (which I unpacked in my first post, and that Forbes, Consumer Reports and others have also flagged as problematic)—or with the choices provided in Zoom’s cookie settings, which list 70 (by my count) third parties whose involvement you can opt into or out of (by a set of options I unpacked in my second post). The logos in the image above are just 16 of those 70 parties, some of which include more than one domain.

Also, if all the ads shown to users are just “about Zoom,” why are those other companies in the picture at all? Specifically, under “About Cookies on This Site,” the slider is defaulted to allow all “functional cookies” and “advertising cookies,” the latter of which are “used by advertising companies to serve ads that are relevant to your interests.” Wouldn’t Zoom be in a better position to know your relevant (to Zoom) interests, than all those other companies?

More questions:

  1. Are those third parties “processors” under GDPR, or “service providers by the CCPAs definition? (I’m not an authority on either, so I’m asking.)
  2. How do these third parties know what your interests are? (Presumably by tracking you, or by learning from others who do. But it would help to know more.)
  3. What data about you do those companies give to Zoom (or to each other, somehow) after you’ve been exposed to them on the Zoom site?
  4. What targeting intelligence do those companies bring with them to Zoom’s pages because you’re already carrying cookies from those companies, and those cookies can alert those companies (or others, for example through real time bidding auctions) to your presence on the Zoom site?
  5. If all Zoom wants to do is promote Zoom products to Zoom users (as that statement says), why bring in any of those companies?

Here is what I think is going on (and I welcome corrections): Because Zoom wants to comply with GDPR and CCPA, they’ve hired TrustArc to put that opt-out cookie gauntlet in front of users. They could just as easily have used Quantcast‘s system, or consentmanager‘s, or OneTrust‘s, or somebody else’s.

All those services are designed to give companies a way to obey the letter of privacy laws while violating their spirit. That spirit says stop tracking people unless they ask you to, consciously and deliberately. In other words, opting in, rather than opting out. Every time you click “Accept” to one of those cookie notices, you’ve just lost one more battle in a losing war for your privacy online.

I also assume that Zoom’s deal with TrustArc—and, by implication, all those 70 other parties listed in the cookie gauntlet—also requires that Zoom put a bunch of weasel-y jive in their privacy policy. Which looks suspicious as hell, because it is.

Zoom can fix all of this easily by just stopping it. Other companies—ones that depend on adtech (tracking-based advertising)—don’t have that luxury. But Zoom does.

If we take Zoom at its word (in that paragraph they sent me), they aren’t interested in being part of the adtech fecosystem. They just want help in aiming promotional ads for their own services, on their own site.

Three things about that:

  1. Neither the Zoom site, nor the possible uses of it, are so complicated that they need aiming help from those third parties.
  2. Zoom is the world’s leading sellers’ market right now, meaning they hardly need to advertise at all.
  3. Being in adtech’s fecosystem raises huge fears about what Zoom and those third parties might be doing where people actually use Zoom most of the time: in its app. Again, Consumer Reports, Forbes and others have assumed, as have I, that the company’s embrasure of adtech in its privacy policy means that the same privacy exposures exist in the app (where they are also easier to hide).

By severing its ties with adtech, Zoom can start restoring people’s faith in its commitment to personal privacy.

There’s a helpful model for this: Apple’s privacy policy. Zoom is in a position to have a policy like that one because, like Apple, Zoom doesn’t need to be in the advertising business. In fact, Zoom could follow Apple’s footprints out of the ad business.

And then Zoom could do Apple one better, by participating in work going on already to put people in charge of their own privacy online, at scale. In my last post. I named two organizations doing that work. Four more are the Me2B Alliance, Kantara, ProjectVRM, and MyData.

I’d be glad to help with that too. If anyone at zoom is interested, contact me directly this time. Thanks.

 

 

 

More on Zoom and privacy

March 28, 2020 in advertising, conferencing, marketing, problems, Social | 5 comments

[This is the second of four posts. The last of those, Zoom’s new privacy policy., visits the company’s positive response to input such as mine here. So you might want to start with that post (because it’s current) and look at the other three, including this one, after that.]

Zoom needs to clean up its privacy act, which I posted yesterday, hit a nerve. While this blog normally gets about 50 reads a day, by the end of yesterday it got more than 16000. So far this morning (11:15am Pacific), it has close to 8000 new reads. Most of those owe to this posting on Hacker News, which topped the charts all yesterday and has 483 comments so far. If you care about this topic, I suggest reading them.

Also, while this was going down, as a separate matter (with a separate thread on Hacker News), Zoom got busted for leaking personal data to Facebook, and promptly plugged it. Other privacy issues have also come up for Zoom. For example, this one.

But I want to stick to the topic I raised yesterday, which requires more exploration, for example into how one opts out from Zoom “selling” one’s personal data. This morning I finished a pass at that, and here’s what I found.

First, by turning off Privacy Badger on Chrome (my main browser of the moment) I got to see Zoom’s cookie notice on its index page, https://zoom.us/. (I know, I should have done that yesterday, but I didn’t. Today I did, and we proceed.) It said,

To opt out of Zoom making certain portions of your information relating to cookies available to third parties or Zoom’s use of your information in connection with similar advertising technologies or to opt out of retargeting activities which may be considered a “sale” of personal information under the California Consumer Privacy Act (CCPA) please click the “Opt-Out” button below.

The buttons below said “Accept” (pre-colored a solid blue, to encourage a yes), “Opt-Out” and “More Info.” Clicking “Opt-Out” made the notice disappear, revealing, in the tiny print at the bottom of the page, linked text that says “Do Not Sell My Personal Information.” Clicking on that link took me to the same place I later went by clicking on “More Info”: a pagelet (pop-over) that’s basically an opt-in notice:

By clicking on that orange button, you’ve opted in… I think. Anyway, I didn’t click it, but instead clicked on a smaller and less noticeable “advanced settings” link off to the right. This took me to a pagelet with this:

The “view cookies” links popped down to reveal 16 CCPA Opt-Out “Required Cookies,” 23 “Functional Cookies,” and 47 “Advertising Cookies.” You can’t separately opt out or in of the “required” ones, but you can do that with the other 70 in the sections below. It’s good, I suppose, that these are defaulted to “Out.” (Or seem to be, at least to me.)

So I hit the “Submit Preferences” button and got this:

All the pagelets say “Powered by TrustArc,” by the way. TrustArc is an off-the-shelf system for giving companies a way (IMHO) to obey the letter of the GDPR while violating its spirit. These systems do that by gathering “consents” to various cookie uses. I’m suppose Zoom is doing all this off a TrustArc API, because one of the cookies it wants to give me (blocked by Privacy Badger before I disabled that) is called “consent.trustarc.com”).

So, what’s going on here?

My guess is that Zoom is doing marketing from the lead-generation playbook, meaning that most of its intentional data collection is actually for its own use in pitching possible customers, or its own advertising on its own site, and not for leaking personal data to other parties.

But that doesn’t mean you’re not exposed, or that Zoom isn’t playing in the tracking-based advertising (aka adtech) fecosystem, and therefore is to some degree in the advertising business.

Seems to me, by the choices laid out above, that any of those third parties (up to 70 of them in my view above) are free to gather and share data about you. Also free to give you “interest based” advertising based on what those companies know about your activities elsewhere.

Alas, there is no way to tell what any of those parties actually do, because nobody has yet designed a way to keep track of, or to audit, any of the countless “consents” you click on or default to as you travel the Web. Also, the only thing keeping those valves closed in your browser are cookies that remember which valves do what (if, in fact, the cookies are set and they actually work).

And that’s only on one browser. If you’re like me, you use a number of browsers, each with its own jar of cookies.

The Zoom app is a different matter, and that’s mostly where you operate on Zoom. I haven’t dug into that one. (Though I did learn, on the ProjectVRM mailing list, that there is an open source Chrome extension, called Zoom Redirector, that will keep your Zoom session in a browser and out of the Zoom app.)

I did, however, dig down into my cookie jar in Chome to find the ones for zoom.us. It wasn’t easy. If you want to leverage my labors there, here’s my crumb trail:

  1. Settings
  2. Site Settings
  3. Cookies and Site Data
  4. See all Cookies and Site Data
  5. Zoom.us (it’s near the bottom of a very long list)

The URL for that end point is this: chrome://settings/cookies/detail?site=zoom.us). (Though dropping that URL into a new window or tab works only some of the time.)

I found 22 cookies in there. Here they are:

_zm_cdn_blocked
_zm_chtaid
_zm_client_tz
_zm_ctaid
_zm_currency
_zm_date_format
_zm_everlogin_type
_zm_ga_trackid
_zm_gdpr_email
_zm_lang
_zm_launcher
_zm_mtk_guid
_zm_page_auth
_zm_ssid
billingChannel
cmapi_cookie_privacy
cmapi_gtm_bl
cred
notice_behavior
notice_gdpr_prefs
notice_preferences
slirequested
zm_aid
zm_cluster
zm_haid

Some have obvious and presumably innocent meanings. Others … can’t tell. Also, these are just Zoom’s cookies. If I acquired cookies from any of those 70 other entities, they’re in different bags in my Chrome cookie jar.

Anyway, my point remains the same: Zoom still doesn’t need any of the advertising stuff—especially since they now (and deservedly) lead their category and are in a sellers’ market for their services. That means now is a good time for them to get serious about privacy.

As for fixing this crazy system of consents and cookies (which was broken when we got it in 1994), the only path forward starts on your side and mine. Not on the sites’ side. What each of us need is our own global way to signal our privacy demands and preferences: a Do Not Track signal, or a set of standardized and easily-read signals that sites and services will actually obey. That way, instead of you consenting to every site’s terms and policies, they consent to yours. Much simpler for everyone. Also much more like what we enjoy here in the physical world, where the fact that someone is wearing clothes is a clear signal that it would be rude to reach inside those clothes to plant a tracking beacon on them—a practice that’s pro forma online.

We can come up with that new system, and some of us are working on exactly that. My own work is with Customer Commons. The first Customer Commons term you can proffer, and sites can agree to, is called #P2B1(beta), better known as #NoStalking. it says this:

nostalking

By agreeing to #NoStalking, publishers still get to make money with ads (of the kind that have worked since forever and don’t involve tracking), and you know you aren’t being tracked, because you have a simple and sensible record of the agreement in a form both sides can keep and enforce if necessary.

Toward making that happen I’m also involved in an IEEE working group called P7012 – Standard for Machine Readable Personal Privacy Terms.

If you want to help bring these and similar solutions into the world, talk to me. (I’m first name @ last name dot com.) And if you want to read some background on the fight to turn the advertising fecosystem back into a healthy ecosystem, read here. Thanks.

Zoom needs to clean up its privacy act

March 27, 2020 in adtech, advertising, Business, conferencing, privacy, problems | 5 comments

zoom with eyes

[21 April 2020—Hundreds of people are arriving here from this tweet, which calls me a “Harvard researcher” and suggests that this post and the three that follow are about “the full list of the issues, exploits, oversights, and dubious choices Zoom has made.” So, two things. First, while I run a project at Harvard’s Berkman Klein Center, and run a blog that’s hosted by Harvard, I am not a Harvard employee, and would not call myself a “Harvard researcher.” Second, this post and the ones that follow—More on Zoom and Privacy, Helping Zoom, and Zoom’s new privacy policy—are focused almost entirely on Zoom’s privacy policy and how its need to explain the (frankly, typical) tracking-based marketing tech on its home page gives misleading suggestions about the privacy of Zoom’s whole service. If you’re interested in that, read on. (I suggest by starting at the end of the series, written after Zoom changed its privacy policy, and working back.) If you want research on other privacy issues around Zoom, look elsewhere. Thanks.]

As quarantined millions gather virtually on conferencing platforms, the best of those, Zoom, is doing very well. Hats off.

But Zoom is also—correctly—taking a lot of heat for its privacy policy, which is creepily chummy with the tracking-based advertising biz (also called adtech). Two days ago, Consumer Reports, the greatest moral conscience in the history of business, published Zoom Calls Aren’t as Private as You May Think. Here’s What You Should Know: Videos and notes can be used by companies and hosts. Here are some tips to protect yourself. And there was already lots of bad PR. A few samples:

There’s too much to cover here, so I’ll narrow my inquiry down to the “Does Zoom sell Personal Data?” section of the privacy policy, which was last updated on March 18. The section runs two paragraphs, and I’ll comment on the second one, starting here:

… Zoom does use certain standard advertising tools which require Personal Data…

What they mean by that is adtech. What they’re also saying here is that Zoom is in the advertising business, and in the worst end of it: the one that lives off harvested personal data. What makes this extra creepy is that Zoom is in a position to gather plenty of personal data, some of it very intimate (for example with a shrink talking to a patient) without anyone in the conversation knowing about it. (Unless, of course, they see an ad somewhere that looks like it was informed by a private conversation on Zoom.)

A person whose personal data is being shed on Zoom doesn’t know that’s happening because Zoom doesn’t tell them. There’s no red light, like the one you see when a session is being recorded. If you were in a browser instead of an app, an extension such as Privacy Badger could tell you there are trackers sniffing your ass. And, if your browser is one that cares about privacy, such as Brave, Firefox or Safari, there’s a good chance it would be blocking trackers as well. But in the Zoom app, you can’t tell if or how your personal data is being harvested.

(think, for example, Google Ads and Google Analytics).

There’s no need to think about those, because both are widely known for compromising personal privacy. (See here. And here. Also Brett Frischmann and Evan Selinger’s Re-Engineering Humanity and Shoshana Zuboff’s In the Age of Surveillance Capitalism.)

We use these tools to help us improve your advertising experience (such as serving advertisements on our behalf across the Internet, serving personalized ads on our website, and providing analytics services).

Nobody goes to Zoom for an “advertising experience,” personalized or not. And nobody wants ads aimed at their eyeballs elsewhere on the Net by third parties using personal information leaked out through Zoom.

Sharing Personal Data with the third-party provider while using these tools may fall within the extremely broad definition of the “sale” of Personal Data under certain state laws because those companies might use Personal Data for their own business purposes, as well as Zoom’s purposes.

By “certain state laws” I assume they mean California’s new CCPA, but they also mean the GDPR. (Elsewhere in the privacy policy is a “Following the instructions of our users” section, addressing the CCPA, that’s as wordy and aversive as instructions for a zero-gravity toilet. Also, have you ever seen, anywhere near the user interface for the Zoom app, a place for you to instruct the company regarding your privacy? Didn’t think so.)

For example, Google may use this data to improve its advertising services for all companies who use their services.

May? Please. The right word is will. Why wouldn’t they?

(It is important to note advertising programs have historically operated in this manner. It is only with the recent developments in data privacy laws that such activities fall within the definition of a “sale”).

While advertising has been around since forever, tracking people’s eyeballs on the Net so they can be advertised at all over the place has only been in fashion since around 2007, which was when Do Not Track was first floated as a way to fight it. Adtech (tracking-based advertising) began to hockey-stick in 2010 (when The Wall Street Journal launched its excellent and still-missed What They Know series, which I celebrated at the time). As for history, ad blocking became the biggest boycott, ever by 2015. And, thanks to adtech, the GDPR went into force in 2018 and the CCPA 2020,. We never would have had either without “advertising programs” that “historically operated in this manner.”

By the way, “this manner” is only called advertising. In fact it’s actually a form of direct marketing, which began as junk mail. I explain the difference in Separating Advertising’s Wheat and Chaff.

If you opt out of “sale” of your info, your Personal Data that may have been used for these activities will no longer be shared with third parties.

Opt out? Where? How? I just spent a long time logged in to Zoom  https://us04web.zoom.us/), and can’t find anything about opting out of “‘sale’ of your personal info.” (Later, I did get somewhere, and that’s in the next post, More on Zoom and Privacy.)

Here’s the thing: Zoom doesn’t need to be in the advertising business, least of all in the part of it that lives like a vampire off the blood of human data. If Zoom needs more money, it should charge more for its services, or give less away for free. Zoom has an extremely valuable service, which it performs very well—better than anybody else, apparently. It also has a platform with lots of apps with just as absolute an interest in privacy. They should be concerned as well. (Unless, of course, they also want to be in the privacy-violating end of the advertising business.)

What Zoom’s current privacy policy says is worse than “You don’t have any privacy here.” It says, “We expose your virtual necks to data vampires who can do what they will with it.”

Please fix it, Zoom.

As for Zoom’s competitors, there’s a great weakness to exploit here.

Next post on the topic: More on Zoom and Privacy.