Northeastern researchers find TV opt-outs fail on major platforms

Northeastern University researchers tested 12 smart TVs from 10 manufacturers across eight operating systems in the Watching the Watchers study, running thousands of automated experiments to measure where viewing data goes and whether turning off automatic content recognition (ACR) stops it.

The tests showed opt-outs fully suppressed attributable ACR traffic on platforms including LG webOS, Sony Google TV, Amazon Fire TV, and VIDAA. But on Samsung’s Tizen platform, ACR-consistent traffic continued after opt-out across all 30 tests involving Samsung’s own streaming service. Researchers saw no drop in traffic to an ACR-linked endpoint on Vizio’s SmartCast after selecting the opt-out. On Roku, the opt-out covered external inputs in tested scenarios but not Roku’s own streaming service; researchers said the gap may reflect limited scope rather than deception.

Encryption covered much of the traffic, preventing independent verification of every packet’s contents. Northeastern researchers characterized the findings as signs of potentially ineffective opt-outs rather than proof that every transmission carried viewing data. Cases of secretly tracking users suggest the problem extends well beyond smart TVs.

“We measured where that data goes, and whether turning the feature off actually stops it.” — Northeastern University researchers Nearly all leading television makers collect viewing information, either selling it to outside advertisers or using it for their own marketing.

Automatic content recognition, or ACR, matches pictures and audio fingerprints against complete scenes from programs and films to determine what a person is viewing or hearing, so it can suggest content or serve tailored advertisements. The Texas lawsuit alleges manufacturers capture screenshots every 500 milliseconds without clear consent using ACR technology.

LG’s terms of service say the company collects and sends search terms, audio recordings, payment information, and screenshots to Alfonso, Inc., also known as LG AdSolutions. LG AdSolutions says 49 million LG smart TVs are operating in the US and 216 million operate around the globe. LG says the information mainly supports targeted advertisements and media recommendations.

LG’s code can track sensitive data using a home Wi-Fi network to determine location with accuracy within 10 meters. Smart TVs store user activity locally as data logs with date and time stamps and send data packets to servers for storage and analysis. Data logs record logins, voice control activation, searches, app launches, and more. Some data logs persist indefinitely and can endure app removal, firmware updates, and power interruptions.

Data packets include IP address, profile information, screen image information, audio recordings, Wi-Fi network settings, and possibly geolocation data, and they may travel to servers at intervals as short as once every three seconds. Logs that are hardest to remove include usernames, e-mail addresses, passwords and payment details.

These logs can only be permanently removed via a full factory reset. To factory reset an LG TV, navigate to All Settings > General > System > Reset to initial settings > Reset all; the process takes a few minutes.

After resetting, users should turn off ACR and HDMI CEC data tracking to stop additional collection. Researchers advise disabling ACR where available but treating it as a first step rather than a guarantee because it may not stop all related traffic on every platform.

Cutting the TV’s internet connection and sending streams through an outside box reduces risk more effectively. Researchers recommend reviewing manufacturer privacy policies, limiting unnecessary account connections, and keeping firmware current as protective steps.

Manufacturers should create opt-out controls that cause observable, verifiable shifts in how the network behaves instead of offering only a checkbox in a settings menu. If a control covers less than what an ordinary buyer would expect, that difference needs clear disclosure.

A Portuguese consumer association called Citizens Voice asked courts to investigate LG smart TVs over alleged privacy violations and possible retailer responsibility. The group asked courts to determine whether LG’s data-collection practices violated consumer rights after a September allegation that LG created “216,000 spy TVs.” LG denies the allegation. None of the allegations against LG have been proven in court; the filing is a legal request for investigation, not a verdict.

Citizens Voice is asking Portuguese courts to decide if a setting that fails to work as promised amounts to a breach of consumer-protection law. The group wants possible action against retailers because where a retailer sells a set belongs in the chain of responsibility.

Ken Paxton, the Texas Attorney General, filed lawsuits against Samsung, Sony, LG, Hisense, and TCL. The lawsuits allege manufacturers capture screenshots every 500 milliseconds without clear consent using ACR technology. Paxton said ACR violates the Texas Deceptive Trade Practices Act because it operates without genuine consumer consent. A temporary restraining order already blocks Hisense’s data collection activities.

The attorney general raised concerns that Chinese manufacturers linked to the Chinese Communist Party should not be recording Americans’ devices. Paxton said “companies, especially those connected to the Chinese Communist Party, have no business illegally recording Americans’ devices.” China’s National Security Law allows the government to compel Chinese companies to share data with it, a circumstance that could expose American viewing habits and accidentally captured personal information to foreign intelligence.

Consumer Reports has long criticized dense privacy policies and confusing opt-out procedures for ACR. Consumers often accept setup terms without knowing their watching habits become advertising data sold to outside companies. A Texas lawsuit might require TV makers to turn ACR into a genuinely optional feature instead of turning it on by default with deceptive notices.

Samsung reached a settlement with the Texas Attorney General’s office over smart TV use of ACR for data collection, monetization, and advertisements. The settlement required Samsung to end ACR data collection for Texas customers unless they give explicit consent for personal data.

Gamers Nexus, with Level1Techs and independent security researchers, investigated LG smart TVs. The investigation found evidence the TVs store and use user data even when the TV is off. Gamers Nexus found the TVs scan and probe other devices on the same home network to build profiles, such as identifying which smartphones or watches a user owns.

Gamers Nexus reported that LG smart TV microphones capture room audio even while the screen remains off. When disconnected from Wi-Fi, the TVs store audio locally and send it once internet access is restored.

LG said its televisions do not gather or save surrounding speech and that voice features require user activation first. LG had not issued a more recent press statement on the Gamers Nexus investigation.