Smart TV tracking opt-outs unreliable on Samsung, Roku and Vizio, study finds

What the study tested

Researchers at Northeastern University put 12 TVs from 10 manufacturers under observation to answer a simple question: when you switch off automatic content recognition, does the tracking actually stop? According to The Verge, which reported the findings, the answer depends heavily on which brand sits in your living room.

Automatic content recognition (ACR) samples the audio or video playing on a TV, converts it into digital fingerprints, and sends them to a database that identifies the content. TV makers use the results to power recommendations, measure viewing, and deliver targeted ads.

Because smart TV platforms are locked down and vary widely, the team inferred tracking activity from network traffic, captured with Northeastern's Mon(IoT)r software and SPHERE testbeds. They played content from first-party services like The Roku Channel, third-party apps including Netflix and YouTube, HDMI sources, an over-the-air antenna, and screen mirroring, then watched where the data flowed.

Where tracking happens

Not every set was watching its owner. A Westinghouse TV running Xumo and three TVs from Sony, Hisense, and TCL running Google TV showed no ACR activity — though another Sony set on the same Google TV OS had it enabled, so the platform alone does not determine behaviour.

Among the TVs with ACR traffic, all scanned over-the-air broadcasts, and all but the Google TV and Fire TV sets applied it to the manufacturer's own streaming services. Third-party apps were largely exempt, with only a small amount of webOS traffic that vanished after opting out. Screen mirroring was monitored only on the Vidaa TV.

To determine the fingerprinting method, the researchers played video with audio, audio alone, and video alone, then compared traffic to suspected ACR endpoints. They concluded that Samsung's Tizen likely relies on video fingerprinting, webOS and Vidaa on audio, and Fire OS, Google TV, Roku OS, and Vizio OS on a combination of both.

Opt-out results were mixed

Opting out stopped ACR traffic completely on webOS, Fire OS, Vidaa OS, and the Sony Google TV set. On Samsung's Tizen, traffic consistent with ACR decreased but persisted over the antenna, first-party streaming apps, and HDMI.

Both Roku OS sets in the study kept applying ACR to The Roku Channel app after opt-out. The Verge notes that TCL discloses this limitation in its settings menus while Roku's own hardware does not.

The worst result came from Walmart's Vizio, where opting out had no measurable effect on ACR-correlated traffic. Vizio settled a lawsuit with the FTC in 2017 over its consumer data practices; The Verge says Walmart did not respond to a request for comment.

The paper adds a caveat: because nearly all traffic to suspected ACR endpoints was encrypted, the researchers cannot prove the residual data contains viewing information, and describe it as suspicious rather than confirmed. Timing made no difference — project lead David Choffnes told The Verge that retesting the Vizio and Fire TV after a factory reset produced unchanged results, and the order of experiments was randomised to avoid bias.

An exposed server leaked data from a million TVs

Mid-study, the team found that Vidaa OS sends its messages unencrypted. That allowed them to reach an MQTT broker — an intermediary between Vidaa and Unruly, a video advertising platform — and receive ACR results from other people's TVs. Each message carried a permanent, non-resettable device identifier along with the time zone, app name, input source, antenna channel, and an audio fingerprint. In three hours they collected data from more than one million unique TVs. Vidaa confirmed the vulnerability and now requires a login on the server, though messages remain unencrypted.

What owners can do

The simplest fix, according to the paper, is disconnecting the TV from the internet and using a streaming device that does not run ACR. Owners who keep the built-in apps are advised to choose webOS, Fire OS, Sony's Google TV, or Vidaa OS, and to switch off every tracking option available. The researchers also published a blocklist of ACR endpoints that can be enforced with network-level blockers such as Pi-hole without breaking the TV. They further call on manufacturers to document which inputs ACR monitors in their privacy policies, encrypt and authenticate the traffic, and on regulators to make opt-outs fully enforceable.

Why it matters

ACR amounts to continuous observation of what a household watches, spanning broadcast, streaming, and even HDMI inputs. This study shows that the one control consumers are told to rely on — the opt-out toggle — does not reliably work across major platforms, and that manufacturers' disclosures do not always match their hardware's behaviour. The Vidaa leak shows the data pipeline itself can be insecure, exposing viewing habits and permanent device identifiers at massive scale. Until opt-outs are verifiable and enforceable, the job of proving TVs behave as promised falls to independent researchers rather than the companies doing the collecting.