We Need a Better Way to Verify Who Is in a Zoom Meeting

After extensive research across the Zoom Apps SDK, Meeting SDK, Plugin SDK, REST API, and webhooks, I cannot find a reliable way for a host or authorised application to match a participant in a meeting or webinar to their verified identity.

Full disclosure: I have found one way to do this in my events, but it would not work for most people.

We can see a participant’s screen name, but that name can be changed and easily copied. We may receive meeting-specific participant identifiers, but these generally identify a connection or session—not necessarily the person’s Zoom account or the approved registrant we expected to attend.

There is an API that can request a participant’s email address, but this requires consent during the meeting and can feel intrusive. It also does not provide a dependable method of verifying someone before admitting them from the Waiting Room.

I completely understand why privacy is central to Zoom’s approach. Participants should not have personal information exposed to hosts, developers or other attendees without a clear and legitimate reason.

However, privacy and identity assurance should not be treated as opposites.

If I organise a private meeting or webinar with approved registrants, I should be able to confirm that the person joining is the approved person—or at least that they are signed into the Zoom account associated with the approved registration.

That does not mean displaying their email address. Zoom could provide a simple, privacy-preserving status such as:

* Identity verified
* Matches approved registration
* Signed in, but does not match the registration
* Guest or identity not verified

If additional consent is required, the participant could be shown a clear option:

> “This meeting requires Zoom to confirm that your signed-in account matches your approved registration. Your email address will not be shared with the host.”

The host and authorised applications would receive the verification result, not the participant’s private account information.

This matters because the current limitation holds back the development of safer and more useful in-meeting applications.

Applications cannot reliably connect an approved customer, member, student, patient, speaker or employee with the participant visible inside the meeting. This makes it harder to provide personalised experiences, apply permissions, manage access, record attendance or protect restricted conversations.

More importantly, this is a security issue.

In many meetings, knowing that participants are who they claim to be provides protection against:

* People using false or copied screen names

* Uninvited attendees using forwarded links

* People impersonating colleagues, speakers or customers

* Spammers repeatedly rejoining under different names

* Unauthorised access to private or sensitive discussions

A screen name is not an identity.

The Waiting Room is an excellent access-control tool, but the host still needs trustworthy information on which to base the admission decision. A list of editable names does not provide that assurance.

I therefore believe Zoom needs an optional **Verified Participant Identity** framework across Meetings and Webinars.

It should:

1. Be enabled by the host when scheduling an appropriate meeting.

2. Clearly notify participants that verification is required.

3. Match the signed-in Zoom account with the approved registration or invitation.

4. Return a simple verification result without unnecessarily exposing an email address.

5. Provide a stable, privacy-preserving identifier to authorised SDKs and applications.

6. Continue to support anonymous meetings when identity verification is not required.

7. Give organisations appropriate administrative controls and audit information.

This is more than a request for another SDK method. It requires a change in how we think about identity inside online meetings.

Anonymous and open meetings should remain available. However, hosts running private, professional or security-sensitive meetings should also have the option to know that the person they are admitting is the person they expected.

Almost everyone I have discussed this with agrees that an optional, transparent and privacy-preserving identity-verification system would be valuable.

I am surprised that I do not hear more requests for it.

So I am going to start lobbying for this until we find a workable solution—one that protects participant privacy while also giving hosts and developers the assurance necessary to build safer and more capable meeting experiences.

What do you think?

Would you enable verified participant identity for some of your meetings, provided participants were informed and their email address was not exposed?

All the best,

John Drinkwater
Lord Zoom

PS I have shred this on Linkedin to et real documented reactions