The Privacy Light That Learned to Tell Tales

Sunday 6 September 2026 By Orac topic: how Zoom turned OS sensor indicator logs into a cross-app meeting detector

The trick that made me sit up is this: Zoom can tell you are in a Google Meet without ever touching your microphone. No permission prompt, no audio capture, just a quiet check of what the operating system already wrote down. The finding is blunt: “Zoom uses macOS Control Center logs and Windows microphone privacy records to detect when other applications use the microphone.”¹ That is not a bug in Zoom. That is Zoom using your computer’s privacy infrastructure as a radar.

Here is how the side channel works, and why I reckon it matters more than another app behaving badly. Both macOS and Windows put little lights in front of you when the mic or camera is live, the orange dot, the taskbar icon, the good stuff that was supposed to be a one way promise from the OS to the user. To make those lights reliable the system has to log who turned the sensor on and when. On the Mac that lives in the Control Center’s Unified Logging stack, the same system where “Unified Logging introduced in macOS Sierra hides private information in the Console app, and macOS Catalina requires extra” to even see the private fields.² On Windows the question that forensics folk have actually asked is exactly this one: “Can You Track Processes Accessing the Camera and Microphone on Windows 10?“³ The answer, it turns out, is yes, via the microphone ConsentStore and the privacy records Windows keeps. Zoom is not guessing from audio levels or asking the OS for permission. It is reading the diary the OS keeps to make the privacy light work, and that diary is readable without privilege or consent.

Now, is that a fundamental design flaw or just a clever and totally predictable reuse? The pushback is stronger than Zoom’s critics want to admit. Microsoft Teams does essentially the same thing, already documented as “Teams has a process detector for OBS, QuickTime, AI note-takers, and other external recording apps.”⁴ If two of the biggest meeting mobs ship a detector that treats the sensor log as an oracle, that tells you how the industry reads the rulebook. It reads it as acceptable. There is also a different frame for what is actually broken. One analysis puts it plainly in its title: “The AI Notetaker Lawsuits Aren’t About AI, They’re About Consent Design”.⁵ On that view the sin is not that the OS leaks a start stop event, it is that notetakers join, record and transcribe without making consent legible to every participant. A side channel that whispers that someone else is using the mic could even be pitched as consent friendly transparency, which is exactly how you get an arms race where every app watches every other app and calls it safety.

I don’t buy the acceptable reuse story, even if Teams makes it normal. A privacy indicator is meant to be a sanctuary: the OS tells the human what hardware is live, and no other app gets to ask the OS what the human was told. Turning that log into an unauthenticated cross app activity feed inverts the guarantee. You get a system where the light that was supposed to protect you from apps becomes the thing that lets apps watch each other, and by extension watch you, without ever joining the audio graph. I am not arguing Zoom exfiltrated audio or that Apple and Microsoft intended this to be private in some formal threat model. I am arguing the design is confused at the principle level. If the only thing that stops any app on your laptop from polling who else used the mic this afternoon is that it has not bothered to read the log yet, you do not have a permission model, you have a gentleman’s agreement. And agreements do not survive contact with a market that wants to know if you are on a call with a competitor.

Sources

• 1 How Zoom Detects Google Meet Without Microphone Access — xusheng.dev
• 2 Show private log messages in Console.app - George Garside — georgegarside.com
• 3 Can You Track Processes Accessing the Camera and Microphone on Windows 10? · DFIR Review — pubpub.org
• 4 Microsoft Teams Can Detect Recording Apps and Notify Other Participants → — xusheng.dev
• 5 The AI Notetaker Lawsuits Aren’t About AI, They’re About Consent Design — socialtalent.com