Researchers at Northeastern University have found that opting out of automatic content recognition (ACR) on smart TVs does not consistently stop manufacturers from gathering user data. A study monitoring 12 TVs from 10 different manufacturers revealed that while many operating systems respect opt-out requests, others continue to transmit information.
ACR systems function by sampling the audio or video playing on a television, converting that content into digital fingerprints, and sending them to a database. TV companies use this data to provide viewing metrics, make content recommendations, and enable targeted advertisements. Because manufacturers often lock down smart TVs, researchers had to infer ACR activity by analyzing where the devices sent network traffic.
The study found that several devices, including a Westinghouse Xumo TV and three TVs from Sony, Hisense, and TCL running Google TV OS, showed no ACR activity at all. For those that did have ACR, the researchers discovered that almost all scanned over-the-air transmissions. However, third-party apps like Netflix and YouTube generally showed no ACR activity, with the exception of a small amount on webOS that disappeared once the user opted out.
The effectiveness of the opt-out feature varied significantly by brand. The study confirmed that opting out worked for LG, Amazon Fire TV, a Sony Bravia running Google TV, and TVs using Vidaa OS. In contrast, Samsung’s Tizen OS saw a decrease in activity but did not stop completely, with ACR-correlated traffic still appearing during antenna, first-party streaming, and HDMI use. Roku OS TVs also continued to apply ACR to the Roku Channel app; while TCL discloses this limitation in its settings, Roku does not. Most notably, Walmart’s Vizio TV continued to send data as if the opt-out had never occurred.
To determine how these systems functioned, researchers played various types of content to see which data was captured. They concluded that Tizen likely uses video fingerprinting, while webOS and Vidaa use audio. Fire TV OS, Google TV OS, Roku OS, and Vizio OS appear to use a combination of both.
The researchers also discovered a vulnerability in Vidaa OS that exposed unencrypted information. This flaw allowed them to access an MQTT broker—an intermediary between Vidaa OS and the video ad platform Unruly—and receive ACR results from over 1 million unique TVs over a three-hour period. The data included permanent TV identifiers, time zones, app names, inputs, antenna channels, and audio fingerprints. Vidaa confirmed the vulnerability and has since addressed it by requiring a login for the server, though messages remain unencrypted.
Professor David Choffnes, the project lead, told The Verge that the tests were conducted by applying opt-outs through settings menus after setup, and that manual tests after factory resets yielded the same results. Because the network traffic to ACR endpoints was encrypted, the researchers noted they could not confirm the exact contents of the remaining traffic, but they interpreted the continued presence of such traffic as "suspicious."
The study recommends that users disconnect TVs from the internet and use separate streaming devices that do not run ACR. If users prefer built-in apps, the researchers suggest using webOS, Fire TV OS, Google TV on Sony, or Vidaa OS while opting out of all possible settings. They also provided a blocklist of endpoints for use with tools like Pi-hole. The researchers called on manufacturers to list every input monitored by ACR, authenticate and encrypt all ACR traffic, and urged regulators to ensure that opt-out agreements are fully functional.
