OTI Urges FTC to Strengthen Consent Agreement with Zoom

In comments filed with the Federal Trade Commission on Monday, OTI urged the agency to strengthen its proposed consent agreement with Zoom. Zoom misrepresented the level of encryption used on its video calls, deceiving users into believing that their communications were private and secure. The proposed agreement requires Zoom to implement a comprehensive security program, but does not require Zoom to implement a privacy program, pay a monetary penalty, or provide any notice or remedies to affected users. Commissioners Slaughter and Chopra both dissented from the agency’s decision.

OTI told the FTC that the proposed agreement is insufficient to address the severity of Zoom’s misrepresentations about encryption, and that the agency’s overall enforcement system fails to protect user privacy and security. OTI agrees with Commissioner Slaughter that “protecting a consumer’s privacy and providing strong data security are closely intertwined, and when we solve only for one we fail to secure either.” OTI also agrees with Commissioner Chopra that the FTC should take steps to restore the agency’s enforcement credibility, including reconsidering its reliance on third-party assessors to monitor compliance with consent orders.

OTI has continually advocated for strong encryption, focusing especially on the important role it plays in protecting consumer privacy. However, without confidence that a product’s encryption features are accurately represented, users cannot trust that their information is actually being protected. Zoom’s deceptive actions undermined that confidence and negatively impacted its millions of users.

The following quote can be attributed to Andi Wilson Thompson, senior policy analyst at New America’s Open Technology Institute:

“Strong encryption is crucial to protecting Zoom users’ privacy and security. The company’s prior misrepresentation of their product’s encryption features was an unacceptable breach of user trust, especially at a time when our ability to communicate in person is significantly limited by a global pandemic. We are now relying even more heavily on video chat, so the privacy encrypted communications provide is more important than ever.”

The following quote can be attributed to Christine Bannan, policy counsel at New America’s Open Technology Institute:

“The FTC should modify its enforcement strategy to focus on providing remedies to affected users and deterring future wrongdoing. The proposed consent agreement with Zoom achieves neither goal.”