Technology
Study finds several smart TVs continue tracking after users opt out
A Northeastern University study tested automatic content recognition across 12 televisions from 10 manufacturers and found that privacy opt-outs did not uniformly stop tracking. Samsung and Roku TVs continued sending traffic consistent with ACR in some situations, while a Vizio set showed no apparent change after opting out. Researchers also found a Vidaa vulnerability that exposed viewing data from more than 1 million TVs. Because much traffic was encrypted, the researchers could not confirm the contents or server-side handling of all remaining data.
Editorial summary · Publisher article
What matters
- Researchers tested over-the-air broadcasts, built-in and third-party streaming, HDMI and screen mirroring across multiple TV operating systems. (p1, p2)
- ACR activity continued in some cases after opt-out, including Samsung antenna, streaming and HDMI use, Roku Channel viewing and all tested Vizio activity. (p2, p3)
- A Vidaa vulnerability exposed permanent TV identifiers, inputs, channels and audio fingerprints; the company later added server authentication. (p3)
- The researchers recommend disconnecting TVs from the internet, blocking tracking endpoints or using devices without ACR. (p4)
What the study could and could not establish
The researchers inferred ACR activity from encrypted network traffic, so continued traffic was suspicious but not conclusive proof that ACR data was processed or retained. Testing was randomized, and factory-reset checks produced unchanged results on selected TVs. (p3)
Context & caveats
- The study covered a limited set of models, and encrypted traffic prevented complete confirmation of what data remained in transit.
- Vidaa addressed the reported access vulnerability by requiring server login, but the report says messages were still unencrypted.
Why this made the edition
The report provides detailed experimental evidence from 12 televisions across 10 manufacturers, including opt-out results, tracking methods and a disclosed vulnerability, with clear limitations.
Source material