Vizio, Samsung Smart TVs Continue Tracking Despite Opt-Outs, Study Finds
Researchers discovered that Vizio and Samsung smart TVs transmit viewing data via Automatic Content Recognition (ACR) even after users disable the feature, raising privacy concerns.
A recent study has revealed that prominent smart TV manufacturers Vizio and Samsung may be disregarding user privacy settings, continuing to collect viewing data through Automatic Content Recognition (ACR) even after users have explicitly opted out. The research, conducted by Northeastern University and detailed in their paper 'Watching the watchers,' tested twelve smart TVs from ten manufacturers to assess the effectiveness of ACR opt-out mechanisms.
Automatic Content Recognition (ACR) technology works by capturing audio and video content from a smart TV's screen and sending it to a third party, typically the TV manufacturer. This data is then used to create digital fingerprints of viewed content, which can be leveraged for targeted advertising or sold to data brokers. With smart TVs becoming ubiquitous in households, understanding how these devices handle user privacy is increasingly critical.
The study involved over 5,000 automated viewing sessions across eight major smart TV operating systems, simulating various scenarios including watching traditional antenna TV, using first-party streaming services, and streaming from third-party applications. Tests were performed with ACR enabled and disabled to compare data transmission.
Findings indicated that Vizio TVs consistently sent 100% of their traffic for first-party services and antenna TV, even when the ACR opt-out was selected. This traffic also remained constant when the TV was idle. While Vizio did not appear to transmit ACR traffic from third-party apps, the continued data collection from other sources raises significant privacy questions, especially given Vizio's history of privacy-related settlements.
Samsung's smart TVs also exhibited issues, with ACR-related traffic detected from third-party apps like Netflix, YouTube, and Tubi TV after opting out. The study noted that Samsung's Tizen OS sent ACR traffic in 7% to 20% of runs for these services. Furthermore, traffic consistent with ACR was observed in 60% of HDMI sessions, and all first-party streaming sessions continued to transmit ACR data.
However, the study did offer some positive results. Four smart TV operating systems—LG's WebOS, Sony's Google TV OS, Amazon's FireTV OS, and Supersonic's VIDAA OS—fully honored ACR opt-out requests, ceasing data transmission. This suggests that while some manufacturers struggle with privacy compliance, others are successfully implementing these features.
Compounding privacy concerns, the researchers noted that most smart TVs, including Samsung, encrypt their ACR traffic, making it difficult to definitively confirm the content being transmitted. Vizio's first-party service, WatchFree+, was found to transmit unencrypted titles of shows and channels, a feature that cannot be disabled. The study also highlighted an instance where unencrypted ACR data from other users' TVs was accessible via VIDAA OS servers.
These findings underscore a significant gap in smart TV privacy, where user preferences may not translate into actual data protection. The implications are particularly relevant as companies like Walmart acquire TV manufacturers, potentially integrating viewing data into broader advertising and customer profiling strategies.