For EEA, Swiss, and UK users, Zoom identifies five legal bases for processing personal data as a controller: contractual necessity, consent (specifically for advertising cookies), legal obligation, vital interests, and legitimate interests. The legitimate interests basis covers product development, security, marketing, and compliance with non-EEA legal obligations.
This analysis describes what Zoom's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the GDPR legal bases Zoom asserts for its processing activities as a controller, which is a core compliance disclosure under GDPR Article 13 and 14. The use of legitimate interests as a basis for marketing communications, product development, and compliance with non-EEA laws may be subject to balancing test requirements and data subject objection rights under GDPR Article 21.
This new provision provides transparency regarding GDPR legal bases for processing, which is legally required but was not previously disclosed in the privacy statement.
View full change record →This provision establishes that EEA, Swiss, and UK users have data subject rights corresponding to the legal basis under which their data is processed, including the right to object to processing based on legitimate interests and the right to withdraw consent for advertising cookies. Under this clause, users in these jurisdictions can exercise rights including access, erasure, rectification, restriction, and portability by submitting requests through the designated privacy rights portal.
Cross-platform context
See how other platforms handle GDPR Legal Bases for Processing and similar clauses.
Compare across platforms →"We only use your information in a lawful, transparent, and fair manner. Depending on the specific personal data concerned and the factual context, when Zoom processes personal data as a controller for individuals in regions such as the EEA, Switzerland, and the UK, we rely on the following legal bases as applicable in your jurisdiction: As necessary for our contract... Consistent with specific revocable consents... As necessary to comply with our legal obligations... To protect your vital interests or those of others... As necessary for our (or others') legitimate interests, unless those interests are overridden by your interests or fundamental rights and freedoms.Excerpt from Zoom's Privacy Statement
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the GDPR legal bases Zoom asserts for its processing activities as a controller, which is a core compliance disclosure under GDPR Article 13 and 14. The use of legitimate interests as a basis for marketing communications, product development, and compliance with non-EEA laws may be subject to balancing test requirements and data subject objection rights under GDPR …
This provision establishes that EEA, Swiss, and UK users have data subject rights corresponding to the legal basis under which their data is processed, including the right to object to processing based on legitimate interests and the right to withdraw consent for advertising cookies. Under this clause, users in these jurisdictions can exercise rights including access, erasure, rectification, restriction, and …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zoom.