New Research: How Zoom's Data Policies Allow It To Pivot to Advertising

As the coronavirus crisis built to pandemic levels in early March, a relatively unknown tech company confronted a defining opportunity. Zoom Video Communications, a fast-growing enterprise videoconferencing platform with roots in both Silicon Valley and China, had already seen its market cap grow from under $10 billion to nearly double that. As the coronavirus began dominating news reports in the western press, Zoom announced its first full fiscal year results as a public company. The company logged $622.7 million in revenue, up 88% from the year before. Zoom's high growth rate and "software as a service" business model guaranteed fantastic future profits, and investors rewarded the company by driving its stock up even further. On March 5th, the day after Zoom announced its earnings, the company's stock jumped to $125, more than double its price on the day of its public offering eleven months before. Market analysts began issuing bullish guidance, and company executives noted that as the coronavirus spread, more and more customers were sampling Zoom's easy-to-use video conferencing platform.

But as anyone paying attention to business news for the past month knows, it's been a tumultuous ride for Zoom ever since. As the virus forced the world inside, demand for Zoom's services skyrocketed, and the company became a household name nearly overnight. Zoom's "freemium" model - which offers a basic version of its platform for free, with more robust features available for a modest monthly subscription fee - allowed tens of millions of new users to sample the company's wares. Initially, Zoom was a hit with this new user base - stories of Zoom seders, Zoom cocktail parties, and even Zoom weddings gave the company a consumer-friendly vibe. Just like Google or Facebook before it, here was the story of a scrappy Valley startup with just the right product at just the right time. According to the company, Zoom's monthly users leapt from 10 million to more than 200 million - an unimaginable increase of 2,000 percent in just one month.

Just as quickly, however, Zoom became the subject of controversy. Like Google and Facebook before it, Zoom's success as a product comes from its unwavering focus on convenience. Zoom makes it as easy as possible to use its platform. Employing invisible technical tricks, Zoom engineers made the platform easy to install, easy to share, and ... easy to hack. Press reports about "Zoom bombing" began dominating the headlines, and as reporters dug in, so did reports of significant (and long ignored) security failings. Large corporations, state governments, and school districts banned the company's products. Media outlets began to investigate the company's Chinese roots - only to discover that the young firm had mistakenly routed user sessions through its servers in mainland China. Zoom responded quickly, freezing product development and focusing entirely on fixing critical security issues. The company then updated its privacy policies, bowing to criticism that it might leverage user data in a manner similar to Google and Facebook (more on that below).

But with China and the United States entering a third year of an increasingly heated trade war, and blaming each other for the origin of the novel coronavirus, Zoom finds itself in an extraordinary position that no amount of crisis communications can overcome. Zoom's founder and CEO, Eric Yuan, is a Chinese ex-pat and naturalized American citizen. More than 700 of his 2,500+ employees live and work in China. Until March of this year, Yuan was held up as an example of the best that global capitalism can offer - an ingenious immigrant who bootstrapped his way to America and leveraged hard work, smarts, and venture financing into a multi-billion dollar fortune.

Now Zoom's brand - and its future - live under storm clouds of suspicion. In just four weeks, the company has inherited the full force of the American "techlash." And the companies previously at the center of that storm - in particular the "Big Four" of Apple, Facebook, Google and Amazon - are happy to pass along that unpleasant mantle.

So what might Zoom do next?

* * *

As some readers know, I've been a student of the "Big Four" for more than two decades. For the past 18 months, that study has focused on the terms of service and privacy policies of the Big Four. Thanks to the work of researchers and faculty at Columbia's School of International Public Affairs and Graduate School of Journalism, we've published a study of the underlying architecture of the Big Four's core policies, a visualization we call "Mapping Data Flows." This tool breaks down and compares each company's privacy and data use policies, with a goal of giving both ordinary consumers and academic researchers insight into the architecture of control currently dominating our economy's relationship to data.

Given its very recent and extraordinary rise as a consumer tool, we decided to apply this approach to Zoom's terms of service and privacy policy as well. You can find our initial findings here.

As with every research project, our study of Zoom's policies began with a working hypothesis. One of the most interesting findings from our initial study of the Big Four was how similar their policies were - they all collect vast sums of data, and their terms of service allow them nearly unlimited usage of that data. And of course, all four granted themselves the right to collect, process, and employ user data for the purpose of pursuing advertising businesses - a multi-hundred billion dollar industry driving what Harvard scholar Shoshana Zuboff calls "surveillance capitalism." We therefore asked ourselves two questions: First, would Zoom's current terms of service and privacy policies allow them to join the Big Four in the pursuit of an advertising business? And second, given Zoom is (or was) a business facing, as opposed to a consumer-facing platform, would its privacy policies and terms of use be markedly different from the Big Four?

The short answer to that first question is yes. And for the second? That'd be a no. As the first image below demonstrates, Zoom collects a ton of data, and its policies are quite similar to those of its Big Four cousins.

But exploring that first question - whether Zoom might become an advertising-driven business - yielded even more interesting insights:

As the above illustration from our new visualization demonstrates, our research shows that nearly all data collected from Zoom user sessions may be used for the purpose of advertising. Despite the clarification of Zoom's privacy policies posted on March 29th around usage of data from user sessions, nothing material changed in its actual policies. Indeed, the company writes that "We are not changing any of our practices. We are updating our privacy policy to be more clear, explicit, and transparent."

To be clear, Zoom does not currently run an advertising business along the lines of Facebook, Google, Apple, or Amazon's (and yes, both Apple and Amazon have significant data-driven advertising businesses, they just don't like to talk about them). So why, in its own policies, does Zoom reserve the right to use all collected data for the purpose of "advertising"?

As any lawyer will tell you, words are slippery things. Certainly in the context of Zoom's current business, the word "advertising" covers the company's role as an advertiser - as a brand that uses data to market to current and potential customers using platforms like Google or Facebook. But a careful reading of the company's policies reveal how easily the same words could allow the company to pivot from advertiser on other platforms to provider of platform advertising, should the company wish to. In other words, there's nothing stopping Zoom from joining the Big Four as a major player in the provision of advertising services, should it wish.

How might Zoom do such a thing? And given its current privacy backlash, why would Zoom ever consider such a move?

Let's start with the How, then we'll cover the Why.

As I mentioned at the start of this piece, Zoom's current business is based on what folks in the tech industry call a freemium SaaS (software as a service) model. The company makes a version of its platform available to anyone for free, and then "upsells" those free users to a paid version that has more bells and whistles, like the ability to record conferences, larger numbers of participants on a videoconference, and so on. Pricing starts at $15/month, scaling up to thousands a month for large customers. This model is most often employed for enterprise customers (Slack is a good example), but it's also found success in consumer-facing applications, where more often than not users pay to avoid advertising (think YouTube or Hulu). Regardless of whether the service is enterprise or consumer focused, free users always outnumber paying ones by an order of magnitude or more.

One of the most difficult elements of a freemium SaaS model is luring those free users "down the funnel" into paying for a monthly subscription. So how might Zoom convince its bumper crop of roughly 190 million new consumers to start paying up?

By now you've probably figured out where I'm going with all this. Zoom could implement a free service that's supported by advertising, then encourage users to pay for a version that's ad free. Doing so would be ridiculously simple: Just as with YouTube, Zoom could force its users to watch a "skippable" pre-roll video ad before the start of each videoconference (and it could use its data trove to make those ads extremely targeted). Well aware that such an interruption would be an annoyance at best, Zoom could then offer to strip the ads out for customers who paid a small subscription service of, say, $5 a month. If just one quarter of its customer base decided to do so, Zoom's revenues would jump by $250 million a month - adding a cool $3 billion a year to its top line revenue, nearly all of which would be pure profit. The resulting advertising business could easily add hundreds of millions, if not billions more. That's five times more revenue than the company reported in its last fiscal year.

Which brings us to the "Why" of this admittedly speculative (but nevertheless quite reasonable) exercise. And that why comes down to capitalism. Zoom is a public company with a massive valuation - more than $40 billion at the time of this writing. That gives it an unsustainable price to earnings ratio of roughly 1,750 - 76 times larger than the S&P average. The pressure to "grow into" those outsized expectations is enormous. Zoom is staring at a multi-billion dollar business model just begging to be implemented. For its shareholders, board, and senior executives, the question isn't why it should be adopting the business model that made Facebook, Google, Apple, and Amazon the most valuable companies in the world. Instead, the question is simply this: Why shouldn't it?

In another post, we'll explore answers to that question (and how Zoom, if it's thoughtful, could help reimagine the core architecture of surveillance capitalism). For now, take a spin around our newest visualization, and give us input in the comments below. Thanks for reading, and take care of yourself - and others - out there.

###

The Mapping Data Flows project is seated at Columbia SIPA - we are grateful for the support of Dean Merit Janow, as well as the support of the Brown Institute at Columbia's Graduate School of Journalism, the Omidyar Network, and faculty and staff including Mark Hansen, Juan Francisco Saldarriaga, Zoe Martin, Matthew Albasi, Natasha Bhuta, and Veronica Penney. Hat tip as well to Doc, who's been focused on these issues for decades.