The Reality of Smart TV Tracking
The fact our TVs are gathering our information isn’t new, but what and how they’re tracking — and if we can stop it — is hard to figure out. Researchers at Northeastern University monitored 12 TVs from 10 manufacturers to test whether opting out of automatic content recognition (ACR) actually works. While opting out was effective for most TVs — including LG, Amazon Fire TV, a Sony Bravia running Google TV, and those with Vidaa OS — Samsung and Roku kept sending some data. And Walmart’s Vizio TV continued on as if the opt-out hadn’t even happened.
Does opting out of TV tracking work?
A new study from Northeastern University shows that while most TV operating systems respect ACR opt-outs, not all do.
TVs use automatic content recognition to gather viewing information about us, and opting out doesn’t always stop it.
ACR systems sample the audio or video playing on a TV, convert them into digital fingerprints, and send them to a database to identify what’s being watched. TV companies use that information to make recommendations of what to watch next, provide viewing metrics, and allow for targeted ads.
The researchers wanted to understand when ACR was running on each TV, whether opting out did anything, and what type of data ACR systems were capturing. Because there are many different TV operating systems, and manufacturers keep smart TVs locked down, ACR activity needs to be inferred based on where the TV sends data.
TVs used in the study
Samsung QN32Q60DAF — Tizen OS
LG TV 32LR655BPUA — webOS
Roku TV 32R3B5 — Roku OS
TCL TV 32S350R — Roku OS
Sony K-43S20M2 — Google TV OS
Vizio VHD32M-0810 — Vizio OS
Fire TV HD32N200A — Fire OS
Supersonic SC-1520VTV — Vidaa OS
Westinghouse WX24HX2800 — Xumo OS
Hisense 32A4K (with no ACR) — Google TV OS
TCL 32S250G (with no ACR) — Google TV OS
Sony KD32W830K (with no ACR) — Google TV OS
To answer those questions, the team developed a suite of automated experiments across all the TV operating systems. They used Northeastern’s Mon(IoT)r software and SPHERE Research Infrastructure testbeds to capture and analyze all network traffic from each TV, which let them determine when ACR tracking was active and figure out where the TVs were likely sending that data.
They played content on each TV from first-party streaming services such as LG Channels and The Roku Channel; third-party streaming like Netflix and YouTube; over an HDMI cable; using the over-the-air antenna; and via screen mirroring, all to see if there was any difference in ACR traffic on different inputs.
They found that several of the TVs tested didn’t seem to have any ACR activity whatsoever, including a Westinghouse Xumo TV and three TVs from Sony, Hisense, and TCL running Google TV OS.
Of the TVs with ACR-associated network traffic, all of them scan over-the-air transmissions, while everyone but Google and Amazon uses it on first-party streaming services.
Third-party apps like Netflix and YouTube showed no ACR except a small amount on webOS, which disappeared when opted out. Screen mirroring also looks to be safe from monitoring on all TVs but the one running Vidaa OS.
To figure out whether each OS used audio or video fingerprinting, the experimenters played content that had both video and audio, just audio with a black screen, and just video with no audio. They found that Tizen likely uses video fingerprinting, webOS and Vidaa use audio, and Fire TV OS, Google TV OS, Roku OS, and Vizio OS use a combination of both.
Investigating Opt-Out Failures
Ideally, opting out of ACR activity should stop all data transmission to suspected endpoints, and for webOS, Fire OS, Vidaa OS, and the Sony Google TV, that is what happened. However, Samsung’s Tizen OS activity decreased but did not stop entirely. On two Roku OS TVs, ACR still applied to the Roku Channel app, and opting out on the Vizio TV did not change ACR-correlated traffic at all.
As the paper notes, because almost all network traffic sent from the TVs to the suspected ACR endpoints was encrypted, the researchers couldn’t be entirely sure that the traffic that remained after opting out was ACR traffic.
The research team interprets the continued presence of traffic consistent with ACR tracking after opt-out as suspicious, though they cannot confirm the exact contents or server-side retention.
It did not seem to matter if users opted out during the setup process or later down the line. Project lead professor David Choffnes noted that manual tests after factory resets yielded identical results.
TVs primarily track data over the antenna, HDMI, and with first-party streaming services such as built-in channel hubs.
Security Vulnerabilities Exposed
During the study, the researchers also discovered a vulnerability with Vidaa OS exposing unencrypted information, allowing access to an intermediary broker and receiving ACR results from other users.
Each message carried a permanent, unresetable Client ID, time zone, app name, input source, antenna channel, and an audio fingerprint.
Over a period of three hours, data from over 1 million unique TVs was collected. Vidaa was informed and has since required a server login, though messages are still sent unencrypted.
After opting out of ACR, tracking stopped on most TVs, but some traffic was still detected with Tizen OS, Roku OS, and Vizio OS.
How to Protect Your Privacy
The paper recommends several ways to protect personal data from smart TVs. The easiest method is disconnecting the TV from the internet entirely and using an external streaming device that does not run ACR.
For those continuing to use built-in apps, the researchers suggest webOS, Fire TV OS, Google TV on Sony, and Vidaa OS, provided users carefully opt out of all tracking options. Network-level blockers like Pi-hole can also restrict suspicious endpoints without breaking core functionality.
The researchers call on manufacturers to increase transparency by detailing every watched input in privacy policies and properly encrypting all ACR traffic. They also urge regulators to hold companies accountable for effective opt-outs.
Consumers deserve greater transparency regarding data collection practices, shifting the responsibility away from independent researchers and back onto the corporations.
