Smart TVs spy on you, even when you opt out: study

A new study has shown that your smart TV might be tracking you and what you watch, even when you opt out of tracking.

The study, named Watching the Watchers, was conducted by researchers affiliated with Northeastern University in Boston, Massachusetts.

1. Essentially, it examines automatic content recognition (ACR) features, which the study noted are built into most available smart TVs—and whether turning ACR off actually stops TVs from sending whatever is on your screen to providers.

The researchers tested TVs running Tizen OS (Samsung), Roku OS (Roku, TCL), webOS (LG), SmartCast OS (Vizio), Google TV OS (Sony, Hisense, TCL), Fire TV OS, and others like VIDAA and Xumo.

To add some context, here is how ACR works: essentially, the TV takes short audio or video snapshots of what is on screen, and those snapshots (or the digital fingerprints made from them) are then sent to the internet or ACR provider. From there, the provider compares what was sent to a library of known content to determine exactly what you are watching. The data can reveal your viewing habits and can be used for targeted ads or sold to other companies.

Interestingly, the researchers found out that antenna broadcasts were almost always tracked on every analyzed system. On the streaming side, no TV tracked YouTube or Netflix, but free ad-supported streaming platform Tubi was tracked on Tizen OS, Google TV on Sony, and VIDAA OS.

The researchers also noted that most operating systems tracked their own streaming services, except Fire TV OS and Google TV on Sony.

Outside of antenna and streaming services, the researchers said that devices on HDMI ports were tracked on five screen systems, but not on Roku OS or SmartCast OS. Interestingly, screen mirroring was only tracked on one of the tested brands: VIDAA OS. Even more concerning, Vizio’s SmartCast OS sent ACR-pattern traffic back to its provider, even when the TV sat idle.

The researchers also said turning these features off didn’t always work. After running each scenario more than 30 times across each operating system, only four (webOS, Google TV on Sony, VIDAA OS, and Fire TV OS) were found to actually shut off the feature if the user opted out of ACR. Interestingly, another recent report that dove into LG’s smart TVs found other concerning practices, like capturing data when offline or in standby mode, recording people, scanning Wi-Fi networks, and more.

Samsung’s built-in streaming service still showed ACR-consistent traffic, and the same thing happened with Vizio, where traffic was sent to its Amazon Kinesis ACR endpoint.

If you own a smart TV, Watching the Watchers also shared some tips for what to do if you don’t like being spied on. Turning ACR off is the first step, especially if you have a TV that actually lets you turn it off. Further, you can disconnect the TV from the internet and use an external streaming device that doesn’t use ACR. Finally, for those using TVs that don’t respect the ACR toggle, the researchers also shared a blocklist that you can use to prevent the TV from communicating with the ACR endpoints.

Source: Watching the Watchers