Recent research reveals that Samsung and Vizio smart TVs continue to send data that resembles tracking information, even after users disable the related features in privacy settings. This raises concerns about the effectiveness of smart TV privacy controls and highlights limitations in stopping data flows related to user viewing habits.
Research Methodology and Findings
The study, titled “Watching the Watchers,” analyzed 12 smart TV models from ten manufacturers, covering approximately 95% of the U.S. smart TV market, across eight different operating systems. Researchers conducted 5,943 automated tests to observe network activity with the automatic content recognition (ACR) feature both enabled and disabled.
ACR functions by identifying content on the screen through short samples of audio, video, or digital fingerprints. These signals are matched with known content to determine what is being watched, aiding in audience measurement and targeted advertising. The study noted that even when users opted out, Samsung and Vizio TVs exhibited traffic patterns consistent with ACR technology.
Persistent Tracking Concerns
Tests showed that Samsung’s Tizen operating system continued to exhibit ACR-like traffic in a variety of scenarios, including built-in streaming services, antenna inputs, HDMI connections, and apps like Tubi. Similarly, Vizio’s SmartCast TVs maintained communication with an Amazon Kinesis endpoint associated with ACR, despite being opted out.
While the researchers could not confirm that viewing histories were being recorded due to encrypted data, they observed that traffic destinations, timing, and volume suggested ongoing data transmission. It remains unclear what specific information was sent to company servers or its potential storage.
Comparative Analysis and Recommendations
In contrast, the study found that opt-out mechanisms worked effectively for LG webOS, Sony Google TV, Amazon Fire TV, and VIDAA systems. Roku, however, did not apply the setting to its own streaming service, a limitation disclosed on TCL models but not on Roku-branded TVs.
The research highlights additional risks, such as VIDAA’s unencrypted ACR message transmissions and Vizio’s WatchFree+ service exposing program information through network identifiers. As a preventive measure, researchers suggest disconnecting smart TVs from the internet or blocking known ACR endpoints, though these actions may not prevent all data leaks.
The study also underscores broader security concerns related to smart TV apps and services, emphasizing the need for scrutiny of app permissions and bundled services. As smart TVs evolve, maintaining updated defenses against potential threats becomes essential to safeguarding user privacy.
