If you have ever dug through your smart TV’s settings to turn off viewing tracking, you might assume that settled it. A new study from Northeastern University suggests that, on some of the most popular TV platforms, it may not have.

Researchers found that TVs running Samsung’s Tizen, Vizio’s operating system and Roku OS kept sending network traffic to automatic content recognition (ACR) servers even after tracking was switched off. The findings were first detailed by Ars Technica, and the full paper, “Watching the Watchers: Privacy Analysis of U.S. Smart TV Automatic Content Recognition,” is available online.

What is ACR?

Automatic content recognition is technology built into many smart TVs that captures snippets of what is on your screen, either video screenshots or audio clips, and sends that data to remote servers. There it can be matched against known content to measure what people watch and to help target ads. Because it works at the operating system level, it can potentially recognize content from many sources, not just built-in apps.

How the study worked

The team examined eight smart TV operating systems across 12 TVs from 10 manufacturers: Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio and Westinghouse. Lead author Ilgar Mammadov told Ars that together, the operating systems tested cover about 95 percent of those used in the United States.

The researchers ran 5,943 controlled experiments, using scripts to drive each TV through scenarios such as watching a first-party streaming app, antenna broadcasts and content delivered over HDMI, while capturing the network traffic each TV sent.

What they found

  • Samsung (Tizen): Traffic consistent with ACR tracking stayed present after opt-out in all 30 first-party streaming app tests, 41 of 60 antenna tests and 18 of 30 HDMI tests.
  • Vizio: A content-related endpoint hosted on Amazon Kinesis kept receiving traffic in 100 percent of opted-out scenarios, with no observable decrease, and traffic was even observed while the TVs were idle.
  • Roku: The ACR-like traffic after opt-out appeared only when using Roku’s own streaming service, The Roku Channel. The researchers note that this behavior is disclosed in Roku’s terms of service.

There is an important caveat. The traffic was encrypted, so the researchers could not see exactly what was being sent. They describe the continued traffic as “suspicious” and say it indicates “potential privacy violations,” but they cannot confirm what data it contains or how it is used.

Mammadov told Ars that even if a technical bug were responsible, “the outcome for users is the same: Their opt-out choice is not reflected in the TV’s behavior.” He called the possibility that companies receive the data and simply discard it “unlikely.” Ars said it had contacted Samsung and Vizio for comment.

Not the first time

Smart TV tracking has drawn scrutiny before. In 2017, Vizio paid $2.2 million to settle Federal Trade Commission charges that its TVs used ACR to collect viewing data without consent. More recently, the Texas attorney general sued several TV makers over ACR data collection; Samsung settled and agreed to explain its use of ACR more clearly.

What you can do right now

If smart TV privacy matters to you, here are practical steps based on the researchers’ recommendations and general best practices:

  • Still opt out. On some platforms the setting did work in the researchers’ tests, so it is worth turning off ACR, “viewing information” or “interest-based ads” options anyway.
  • Disconnect the TV itself. The paper suggests taking the smart TV off your home network and using an external streaming device that does not perform ACR.
  • Block known tracking domains. The researchers published a list of network addresses and domains that people can block, for example on a home router or network-wide ad blocker, to stop devices communicating with ACR services without affecting picture quality.
  • Review privacy settings after updates. Software updates can change options, so check again from time to time.

The researchers also urged manufacturers to list every input ACR watches, such as antenna, HDMI, apps and screen mirroring, in their privacy policies.

The bottom line

Turning off tracking on your TV is still a good idea, but this study suggests it may not be the end of the story on every platform. Until manufacturers explain the traffic, the safest approach is to treat your smart TV like any connected device: limit what it can reach on your network, and decide for yourself what it gets to see.

Image: SamsungSmartTV by Raysonho @ Open Grid Scheduler / Grid Engine via Wikimedia Commons, CC0 1.0