Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Twilio is authorized to process name, email address, phone number, meeting or webinar subject, meeting ID, start date and time, and meeting summaries for the purpose of delivering Zoom service notifications including phone authentication, meeting invites, and AI feature requests, with processing in the United States and European Union under SCCs.
This analysis describes what Zoom's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Meeting summaries and meeting subjects are among the data categories Twilio may process for notification delivery; these categories may contain substantive business or sensitive information, and their inclusion in notification infrastructure creates a disclosure pathway beyond the core meeting experience.
Under this provision, Twilio may process meeting subjects and meeting summaries as part of notification delivery, in addition to standard contact identifiers such as name, email, and phone number. This applies to all Zoom notifications including AI feature enablement requests, not only transactional authentication messages.
Cross-platform context
See how other platforms handle Twilio Notification Data Processing and similar clauses.
Compare across platforms →Monitoring
Zoom has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"For notifications from Zoom such as those related to the services, phone authentication, meeting invites, meeting summaries and requests to enable AI features, Twilio may process the following data: Name Email address Phone number Meeting or webinar subject Meeting/webinar ID Meeting date and start time Meeting summary United States, European Union SCCsExcerpt from Zoom's Sub-Processors
1) REGULATORY LANDSCAPE: This provision engages GDPR for EU data subjects whose meeting metadata including subjects and summaries are processed by Twilio in the United States under SCCs. Meeting subjects and summaries may constitute personal data under GDPR if they identify individuals or describe their activities; in some contexts they may contain confidential business information subject to additional contractual protections. The EU-US Data Privacy Framework is a separate transfer mechanism not referenced in this document; the document relies solely on SCCs for Twilio US transfers. 2) GOVERNANCE EXPOSURE: Medium. The inclusion of meeting summaries and meeting subjects as data categories processed by a notification vendor is operationally distinct from typical notification metadata such as name and email. Organizations that have not accounted for Twilio as a subprocessor processing meeting content metadata should update their Records of Processing Activities accordingly. 3) JURISDICTION FLAGS: EU and EEA organizations should assess whether SCC-based transfers of meeting summary data to Twilio in the US are supported by adequate supplementary measures, particularly given the sensitivity of meeting content. California organizations should assess CCPA service provider compliance for meeting metadata processed by Twilio. The November 2025 addition of the European Union as a Twilio processing location may reduce but does not eliminate transfer exposure for some data flows. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that Twilio's role as a notification subprocessor, including its access to meeting summary and subject data, is reflected in their Zoom DPA. Organizations with contractual confidentiality obligations regarding meeting content should assess whether notification delivery through Twilio is consistent with those commitments. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should update Records of Processing Activities to reflect Twilio's access to meeting summary and subject data. Privacy notices should disclose that notification delivery involves third-party processing of meeting metadata. Organizations should review Twilio's GDPR Whitepaper referenced in the document as part of vendor due diligence.
Meeting summaries and meeting subjects are among the data categories Twilio may process for notification delivery; these categories may contain substantive business or sensitive information, and their inclusion in notification infrastructure creates a disclosure pathway beyond the core meeting experience.
Under this provision, Twilio may process meeting subjects and meeting summaries as part of notification delivery, in addition to standard contact identifiers such as name, email, and phone number. This applies to all Zoom notifications including AI feature enablement requests, not only transactional authentication messages.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zoom.