When the world retreated towards video teleconferencing during the onset of the pandemic, user privacy took another harrowing turn. Opting in to Zoom’s services means that many users are giving the company insight into audio data generated in work meetings or calls with friends and family. In fact, video-conferencing apps like Zoom are so hungry for user data, they may even collect data after users mute their microphones.
A pre-print study from the University of Wisconsin-Madison that ran tests on a range of videoconferencing applications found that even after hitting mute, companies often still retained access to a given user’s microphone. Some of the applications tested include Zoom, Slack, Google Meet, and Discord.
The study has not officially been published yet, but Kassem Fawaz and Yucheng Yang, the two researchers behind the investigation, will be presenting their findings at the Privacy Enhancing Symposium in July.
One particular piece of the study summary was especially surprising:
They found that all of the apps they tested occasionally gather raw audio data while mute is activated, with one popular app gathering information and delivering data to its server at the same rate regardless of whether the microphone is muted or not.
Per Zoom’s terms of service, the company may collect meeting and webinar content that is “generated in meetings, webinars or messages that are hosted on Zoom products.” This content includes audio and image data, depending on one’s settings, however, Zoom claims that webinar or meeting content is not used for any marketing or third-party advertising purposes.
Some background—
Fawaz first got the idea to conduct a formal analysis on the extent to which video conferencing applications were collecting information on muted users, after his brother noticed his microphone light remained on despite muting himself. From there he partnered with Yang, and together with some researchers at Loyola University in Chicago, the two broke their study into two parts.
Initially the testing involved a survey of 223 videoconferencing app users about their understanding of the mute button and how companies should be handling audio data. The results spoke to an overwhelming agreement that apps should not be collecting information when users decided to mute themselves.
Following this first part, the team then created their own algorithms to see if the data collected while on mute could be parsed for activities like cooking, cleaning, and playing music, among others. In their findings, the team was able to identify background activities with up to 82 percent accuracy. For those interested in the actual methods of analysis for muted audio collection, here is a link to the unpublished abstract.
“When you’re cooking, the acoustic signature is different from someone who is driving or watching a video,” says Fawaz. “So these types of activities can be distinguished just based on this acoustic fingerprint that was actually sent out to the cloud.”
While the results of the study aren’t necessarily surprising — data collection in any app is unfortunately par for the course — there seems to be a rift between what users think features like mute do and the reality. It’s safe to say we can all just assume our apps are tuning in, even when we don’t want them to.
