Research Finds Some Smart TVs Continue Tracking Despite Opt-Out Settings

Image: Ars Technica · Source

Researchers found that smart TVs from Samsung, Vizio, and Roku keep sending data to automatic content recognition services even after users disable tracking, raising privacy concerns about transparency and consent.

A recent study conducted by Northeastern University researchers uncovered that certain smart TVs continue transmitting data linked to automatic content recognition (ACR) services despite users opting out of tracking in device settings. The investigation, which analyzed eight smart TV operating systems across 12 models from 10 manufacturers—including Samsung, Vizio, Roku, LG, and Sony—focused on how these devices send content data to remote servers to measure viewership and target advertisements.

The research team used custom control scripts and network traffic monitoring tools to observe ACR activity on smart TVs running Samsung's Tizen OS, Vizio's SmartCast OS, and Roku OS. They discovered that TVs using these operating systems frequently sent network traffic consistent with ACR data collection even when tracking was disabled, particularly during usage of first-party content apps and various input modes such as antenna and HDMI.

For example, TVs with Samsung Tizen and Vizio OS continued to generate ACR-related network traffic in all tested scenarios after users had opted out, while Roku OS showed this behavior primarily when using its integrated streaming app, The Roku Channel. This ongoing data transmission after opt-out contradicts user expectations and raises questions about the effectiveness of privacy controls on these devices.

The study's lead author Ilgar Mammadov noted that without access to the encrypted contents of network communications, it was impossible to conclusively determine what data was sent or how it was processed. However, he highlighted that the persistent traffic suggests potential violations of user consent and transparency, which are critical for privacy compliance.

This is not the first time smart TV tracking has come under scrutiny. In 2017, the Federal Trade Commission levied fines against Vizio for collecting viewing data without proper consent. More recently, legal actions have targeted Samsung and other manufacturers over alleged unauthorized personal data collection via ACR technology.

The opaque nature of ACR implementations and the locked-down design of smart TVs hamper transparency and external auditing. Consequently, researchers encourage manufacturers to openly disclose what inputs their ACR systems monitor, authenticate and encrypt all ACR data transmissions, and provide clear information about opt-out effectiveness.

For consumers seeking to avoid tracking, the report advises using external streaming devices without ACR, blocking identified ACR network domains, or limiting TVs’ network access. Initiatives like Software Freedom Conservancy’s legal efforts aim to empower users with better control over their smart TV software to prevent unwanted data collection.

As smart TVs become increasingly integrated into daily entertainment, this study spotlights important privacy issues and the challenges of safeguarding user data in connected home devices. Improved transparency and effective opt-out mechanisms remain essential to ensuring user trust and regulatory compliance.