Smart TV privacy study finds tracking persists even when opting out

Smart TVs from Samsung and Vizio continued sending traffic consistent with viewing surveillance after users disabled the feature.

That is according to a Northeastern University study that also uncovered an exposed server leaking millions of viewing records.

Researchers conducted 5,943 automated experiments on 12 televisions from ten manufacturers. Their paper, “Watching the Watchers,” examines eight operating systems representing approximately 95% of the U.S. smart TV market.

The team tested ten viewing scenarios, including antenna broadcasts, streaming apps, HDMI devices, and screen mirroring, comparing network activity with automatic content recognition (ACR) enabled and disabled.

ACR identifies on-screen content using audio or video samples, or fingerprints derived from them, matched against reference libraries. This allows television makers and their partners to gather viewing information for advertising, including from external devices connected to the screen.

Opt-outs leave gaps

The researchers identified and validated ACR endpoints on seven operating systems. All seven generated content-correlated ACR traffic during antenna viewing, while five did so during HDMI playback. None met the study’s tracking threshold for Netflix or YouTube.

Disabling ACR fully suppressed attributable traffic on LG webOS, Amazon Fire TV OS, the tested ACR-enabled Sony Google TV, and VIDAA OS.

Samsung’s Tizen behaved differently. Traffic consistent with ACR continued during all 30 opted-out tests of Samsung’s built-in streaming service, alongside 41 of 60 antenna tests involving moving video and 18 of 30 HDMI tests.

On Vizio SmartCast, opting out produced no observable reduction in traffic to the identified Amazon Kinesis endpoint. Roku’s opt-out generally worked for external inputs but excluded its own streaming service, a limitation disclosed on the TCL television’s settings screen but absent from the tested Roku-branded model.

ACR traffic after user opts-out
Northeastern University

Most traffic was encrypted, preventing researchers from confirming its contents or whether companies processed or retained it. The findings therefore indicate potentially ineffective opt-outs rather than conclusive evidence of continued viewing-data collection.

Millions of viewing records exposed

The VIDAA implementation tested on a Supersonic television transmitted ACR information without encryption to Unruly servers using MQTT, a messaging protocol.

Messages included audio fingerprints, app names, input sources, time zones, antenna channels, and a permanent device identifier. Server responses classified content into categories including religion, politics, and health.

An authentication flaw also allowed researchers to access other televisions’ detection results. During a limited three-hour collection, they received more than 57 million results associated with over one million unique TVs.

The team additionally demonstrated that a previously observed message could be republished and received by its test television. According to the paper, September 2026 checks confirmed fixes for unauthorized access and publishing, but transmissions remained unencrypted.

Separately, Vizio’s WatchFree+ exposed program or channel names through unencrypted DNS queries and TLS server-name fields associated with streaming provider Amagi. Network observers could reconstruct viewing activity regardless of the ACR setting.

The findings follow recent lawsuits in the US against Samsung, Sony, LG, Hisense, and TCL over allegedly collecting viewing data without informed consent. Samsung subsequently agreed to strengthen disclosures and obtain express consent from Texas consumers before collecting or processing ACR data.

To limit exposure, the researchers recommend disconnecting the television from the internet and using an external streaming device without ACR, or disabling ACR where testing showed effective opt-outs. They also provide an endpoint blocklist, although neither ACR settings nor that blocklist addresses the separate WatchFree+ leak.