A research paper prepared by researchers at Northeastern University in the United States found that some of the largest smart TV brands continue to send data to endpoints belonging to Automatic Content Recognition services, commonly known as ACR, even after users disable tracking options in the device settings. ACR technology is used to capture visual screenshots or audio clips from the television and send them to remote servers to measure viewership and deliver targeted advertisements.
The study, titled "Watching the Watchers: Analyzing the Privacy of Automatic Content Recognition in US Smart TVs," covered eight operating systems distributed across 12 smart TVs from 10 manufacturers, including Amazon, LG, Samsung, Sony, TCL, Vizio, Roku, and others. The researchers noted that the tested operating systems account for about 95 percent of the smart TV operating systems used in the United States.
Data Traffic Continues Despite Deactivation
The researchers conducted 5,943 controlled experiments using specialized software and tools to capture incoming and outgoing internet traffic from each television. The results showed that devices running systems such as Samsung Tizen, Vizio OS, and Roku OS continued to send data to ACR endpoints when the tracking feature was disabled in device settings and under various usage scenarios, including the use of live streaming applications.
In the case of Roku OS, this behavior appeared only when using the built-in streaming application in the system, which the company explains in advance in its user service terms. As for Samsung Tizen and Vizio systems, data traffic transmission continued in additional usage scenarios including broadcasting satellite channels via antenna and multimedia input sources via HDMI ports even after stopping tracking completely.
Why This News Matters
This discovery raises serious legal and regulatory questions regarding companies' respect for user privacy choices and the transparency of data collection. Given that the data traffic was encrypted, the study was unable to determine the exact content of those transmitted packets, but the researchers considered the continued flow of data suspicious and a potential indicator of privacy violations.
For their part, the researchers ruled out the possibility that this data is collected and then destroyed immediately upon reaching the servers due to the technical impracticality of doing so and the pointless consumption of network resources. In contrast, some of these companies have faced previous legal cases related to data collection without clear consent, as Vizio settled a previous lawsuit with the Federal Trade Commission, while Samsung agreed to update its terms after a lawsuit in Texas.
Protection Recommendations and Available Options
The research highlights a severe lack of transparency regarding the operation mechanisms of Automatic Content Recognition technology and the difficulty of testing it given that smart TV operating systems are closed-source. To reduce the risks of unauthorized tracking, the researchers issued a list of network addresses and domains that users can block to prevent connection to ACR services without affecting TV viewing quality.
The researchers also recommend disconnecting smart TVs from the internet entirely and using independent external streaming devices that do not track content, or relying exclusively on opt-out settings in systems whose tests proved effective in stopping communications.