Home / Technology / TVs Still Spy: Opt-Outs Don't Always Work
TVs Still Spy: Opt-Outs Don't Always Work
4 Nov
Summary
- Most TVs respect ACR opt-outs, but Samsung and Roku don't.
- Walmart's Vizio TV ignored opt-out entirely, study found.
- A vulnerability exposed millions of Vidaa TV users' data.
A recent study by Northeastern University has uncovered significant privacy concerns regarding Automatic Content Recognition (ACR) on smart TVs. While most television operating systems appear to honor user requests to opt-out of ACR tracking, the research indicates that this is not universally true. Samsung and Roku TVs were found to continue sending some data, and Vizio TVs, in particular, showed no change in ACR-correlated traffic even after an opt-out.
The study monitored 12 TVs from 10 manufacturers, analyzing network traffic to determine ACR activity. ACR systems fingerprint content to identify viewing habits for personalized recommendations, ad targeting, and viewing metrics. Researchers discovered that while some TVs showed no ACR activity, others scanned over-the-air transmissions and utilized ACR on first-party streaming services.
Interestingly, third-party apps like Netflix and YouTube were largely unaffected by ACR, with minimal exceptions. The study also identified different fingerprinting methods, including audio, video, or a combination, used by various operating systems. While opting out was effective for many, Samsung's Tizen OS showed reduced but persistent ACR traffic, and Roku TVs continued tracking data within their own channel app.
Compounding these findings, a significant vulnerability was discovered in Vidaa OS, which, for a period, exposed unencrypted ACR data from over a million users to an ad platform. Vidaa has since addressed this by requiring a login, though data transmission remains unencrypted. Researchers advocate for greater transparency from manufacturers, secure data handling, and regulators to enforce opt-out agreements.
To mitigate risks, disconnecting smart TVs from the internet and using alternative streaming devices is suggested. For those who prefer built-in apps, opting out of all tracking features on systems like webOS, Fire TV OS, Google TV on Sony, and Vidaa OS is recommended. A blocklist of ACR endpoints is also provided for users who wish to implement network-level restrictions.
