Samsung and Vizio Smart TVs Continue Sending Tracking Data Post-Opt-Out
Researchers found that Samsung and Vizio smart TVs transmit Automatic Content Recognition (ACR) traffic even after users disable the feature, raising privacy concerns.
A recent study, "Watching the Watchers," has revealed that popular smart TV brands Samsung and Vizio continue to send network traffic consistent with Automatic Content Recognition (ACR) even after users have explicitly disabled the feature in their privacy settings. This persistent data flow, observed across various content sources including streaming services and HDMI inputs, raises significant privacy concerns regarding the monitoring of user viewing habits.
ACR technology works by identifying content displayed on a TV screen through audio or video samples, or digital fingerprints. The collected data is then compared against known content databases to identify programs, which can be used for purposes such as audience measurement, targeted advertising, and data sharing with third parties. The "Watching the Watchers" study involved extensive testing across 12 commercial televisions from ten manufacturers, covering approximately 95% of the U.S. smart TV market.
Researchers conducted 5,943 automated experiments, meticulously comparing network activity when ACR was enabled versus when it was disabled. The findings indicated that Samsung's Tizen televisions exhibited ACR-consistent traffic in all tested scenarios involving its built-in streaming service, even after opting out. Similar patterns were observed in tests using antenna inputs, HDMI devices, and third-party streaming apps like Tubi.
Vizio's SmartCast televisions were found to continuously contact their identified Amazon Kinesis ACR endpoint in every opted-out test scenario. The study noted no reduction in this traffic after the ACR feature was disabled, suggesting a potential bypass of user privacy controls.
While the researchers could not definitively confirm the exact data being transmitted due to most ACR traffic being encrypted, the consistent network patterns—including destination, timing, and volume—strongly suggest that data related to viewing habits is still being sent. This lack of transparency, even when users attempt to opt out, undermines user trust and privacy expectations.
In contrast, tested models from LG (webOS), Sony (Google TV), Amazon (Fire TV), and VIDAA showed that their opt-out settings were effective in stopping ACR traffic. However, the research also highlighted other vulnerabilities, such as VIDAA transmitting unencrypted ACR messages over MQTT, exposing sensitive device information. Additionally, Vizio's WatchFree+ service was found to leak readable program or channel information through DNS requests and TLS server-name indications, even when ACR was off.
To mitigate these risks, researchers recommend disconnecting smart TVs from the internet or actively blocking identified ACR endpoints. While a provided blocklist did not disrupt viewing experiences in tested scenarios, it did not address the specific leak from Vizio's WatchFree+ service. The study underscores the broader risks associated with smart TV privacy, including those stemming from app permissions and bundled services.
These findings apply specifically to the tested devices and firmware versions. The research serves as a critical reminder for consumers to remain vigilant about the data their smart devices collect and to actively manage privacy settings, while also advocating for greater transparency and control from manufacturers.