Northeastern study finds Vizio and Samsung TVs ignore tracking opt-outs

Northeastern University researchers tested 12 smart televisions from 10 manufacturers—Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio, and Westinghouse—running eight operating systems and found that Vizio and Samsung sets kept sending automatic content recognition traffic after users opted out, according to findings reported Nov. 5, 2026. The tested systems cover roughly 95 percent of smart televisions used in the United States.

Ilgar Mammadov, the report’s lead author and a Northeastern research assistant, said the tested systems cover about 95 percent of U.S. usage and that adding more televisions running the same systems would repeat existing findings. “Together, the smart TV operating systems we tested cover approximately 95 percent of those used in the United States.”

After opting out of automatic content recognition, Vizio’s SmartCast television kept sending the same volume of traffic to an Amazon Kinesis server linked to ACR, including while idle on its home screen. Vizio’s SmartCast results were the worst among tested platforms, according to researchers. Researchers could not inspect Vizio’s encrypted traffic and did not conclude that the company violated its 2017 settlement with the FTC. “The opt-out setting has no observable effect on traffic sent to this endpoint,” Northeastern researchers said.

After opting out, Samsung’s Tizen television continued sending ACR-consistent traffic in all 30 tests involving its built-in streaming service. Samsung transmitted ACR traffic for every first-party streaming session. After opting out, Samsung sent ACR-related traffic for Netflix in 7 percent of runs, YouTube in 10 percent of runs, and Tubi TV in 20 percent of runs, sent ACR traffic in 60 percent of HDMI sessions, and its ACR-consistent traffic appeared in 41 of 60 antenna instances, 18 of 30 HDMI instances, and six of 30 Tubi instances. Samsung’s Tizen operating system exposes self-disclosing ACR domains that include keywords like ACR and names of ACR providers.

Four operating systems—LG webOS, Amazon Fire TV, VIDAA, and Sony Google TV—stopped sending ACR-related traffic after users opted out. Roku’s opt-out setting did not cover its own streaming service, The Roku Channel. On the tested TCL television, a disclosure about the missed opt-out was present but absent from the Roku-branded model.

Researchers ran 5,943 controlled experiments across the tested televisions, repeating each viewing scenario 30 times with ACR on and 30 times after opting out. The tests covered 10 viewing scenarios including antenna TV, screen mirroring, first-party streaming, third-party apps, and HDMI connections. Researchers delivered OS-specific control scripts over Wi-Fi and used Mon(IoT)r and SPHERE Research Infrastructure software to capture network traffic to and from each TV. The study tested only one Vizio television, so results may not represent every Vizio model, and the findings cover only the tested devices and firmware.

Automatic content recognition captures audio or video from a television, converts it to digital fingerprints, and enables targeted advertising or audience measurement. The tracking feature can follow content outside of streaming apps, such as antenna broadcasts and devices connected through HDMI. Most smart TVs encrypt ACR traffic, including Samsung, so researchers inferred ACR activity from destination, timing, volume, and protocol rather than payload contents. Researchers estimate 82 percent of U.S. households had a smart TV as of last year.

Vizio’s WatchFree+ service sent unencrypted show and channel names to Amagi through DNS lookups, with no user setting to turn it off. WatchFree+ also put readable program or channel details into network names visible in DNS lookups and TLS server-name information. Supersonic’s VIDAA OS sent ACR data without encryption, and servers responded unencrypted with recognized genres; more than 57 million detection results from other televisions were accessible because servers did not require a login.

VIDAA sent unencrypted ACR messages over MQTT exposing device identifiers, application titles, input sources and audio fingerprints. VIDAA later added login requirements but kept transmissions unencrypted, according to researchers.

In 2017, federal regulators and New Jersey’s attorney general alleged that Vizio gathered viewing histories second by second from 11 million smart TVs without telling users or getting consent; Vizio paid $2.2 million to resolve the charges. In 2017, Vizio covertly collected specific demographic information and sold this data to third parties. The 2017 deal with the FTC required Vizio to secure affirmative express consent, disclose data practices prominently, delete material collected before March 1, 2016, and keep a privacy program that undergoes review every two years. As part of the settlement, Vizio agreed to allow people to opt out of automatic content recognition.

Walmart said in February 2024 that it agreed to buy Vizio for approximately $2.3 billion, pointing to SmartCast’s advertising capabilities and its Walmart Connect ad business as a main reason for the deal. Malwarebytes said Walmart bought Vizio for $2.3 billion in 2024 in part to help advertisers connect with customers at scale and improve product discovery. Walmart said pairing Vizio’s advertising platform with Walmart Connect would be impactful and allow further investment in its business. Since March, select new Vizio TVs have required a Walmart account to unlock smart features.

An opt-out that still permits data transmission is more than a minor interface oversight, Yahoo Tech says, since Walmart framed the Vizio acquisition around the SmartCast advertising platform. Opt-outs must reflect actual network behavior, Yahoo Tech argues, and manufacturers should publish independent audit results verifying the link between consent choices and actual transmissions. The findings do not establish a violation of the 2017 order but raise questions regulators and independent auditors should examine, Yahoo Tech says.

Texas sued Sony, Samsung, LG, Hisense, and TCL in December 2025, alleging the software captures screenshots every 500 milliseconds. LG settled with Texas on May 11, agreeing to a pop-up disclosure, informed consent, and a clear way to opt out. Three Samsung TV owners filed a case called Tillery v. Samsung in the Northern District of California under number 3:26-cv-11448 on October 6, alleging viewing tracking without informed consent; those allegations are unproven.

Researchers said regulators should test opt-outs at scale. Researchers recommend disconnecting the television from the internet and using a separate streaming device, or blocking known ACR endpoints with a blocklist. Blocking ACR servers did not disrupt viewing in tests but does not stop the WatchFree+ title leak.

Last week, a reverse engineer accused Samsung of secretly spying by collecting data from built-in microphones, connected devices, and AI they did not know about. LG denies claims that its TVs map home networks or capture audio. LG states that voice processing works only when a user presses the remote’s voice button or enables a wake word, calls network discovery standard, and says ACR is opt-in. Malwarebytes says the audio demonstrations used a compromised TV, proving the feature exists rather than showing that every LG television records the living room.