Recently, reports emerged that LG TVs are sniffing around your local network, and even listening to your local environment, even when the TV is purportedly “off.” Some of those voice commands were then stored in plain text and uploaded to the internet. LG’s response? To deny everything.
For decades now we’ve documented how while “smart” TV makers are obsessed with making money off of in-home surveillance (which is now more profitable than the actual TV), they do an abysmal job protecting the data they collect. They also routinely don’t respect consumer choice when users say they don’t want to participate in the full scope of hyper-commercialized mass surveillance.
That latter point is central to a new study out of Northeastern that conducted 5,943 experiments across twelve commercial “smart” TV devices. The researchers found that most smart TVs utilize automatic content recognition (ACR), a technology that captures audio or video snapshots of viewed content and then monetizes that data to help build personalized profiles of viewers.
TV makers insist that users are supposed to be able to opt out, but the choice simply doesn’t work across a large segment of TVs. Companies like Vizio simply ignored the consumer requests entirely more often than not:
“We find that the advertised ACR opt-out fully suppresses ACR-attributable traffic on only four operating systems; on Samsung Tizen traffic consistent with ACR activity persists in more
than 60% of evaluated scenarios, and on Vizio SmartCast a content correlated endpoint hosted on Amazon Kinesis continues to receive traffic in 100% of opted-out scenarios.”
These companies have been awful for a long while now, and U.S. regulation of the sector has varied between soggy and inconsistent. Many smart TV manufacturers fail to encrypt sensitive data, or remove features if you refuse to have your daily viewing habits measured and monetized (by say, disconnecting your TV from the internet).
Vizio was fined $2.2 million by the FTC back in 2017 for failing to tell customers that their televisions were spying on them. The company also wound up facing a $17 million lawsuit that wound up giving consumers somewhere between $13 and $31 (lawyers in the case saw $5.6 million in fees).
The researchers say since they can’t see the precise scope of what’s being collected due to encryption, they’re unsure whether Vizio is technically violating its FTC agreement (not that we have a current FTC that would care if they were):
“The opt-out setting has no observable effect on traffic sent to this endpoint; however, we cannot inspect the payload due to encryption so we cannot confirm whether this violates the FTC settlement.”
Results of whether opting out of ACR tracking actually stopped ACR tracking were all over the map. Roku, for example, ignores opt-out requests when users are watching Roku’s own channels. None of the smart TV vendors track Netflix viewing for fear of violating agreements with the streaming giant. Samsung’s opt out function was more likely to actually work when a user was watching antenna broadcasts.
On two Smart TV platforms, personal viewing data collected by ACR remains unencrypted, despite years of bad press and scandal on the subject. Many appear to be violating the law, but because U.S. regulatory oversight has been gutted, they see no meaningful accountability. That includes smart TV OS’ like VIDAA, which is most prominently found on Hisense and Toshiba smart TVs:
“VIDAA OS sends ACR data to servers run by Unruly over MQTT without encryption, so anyone on the network path between the TV and those servers can read it. Each message carries a Client ID, a permanent identifier for the TV that can’t be reset, along with the time zone, the app name, the input (antenna, HDMI), the antenna channel and an audio fingerprint.
The app name alone can be revealing. We saw ACR on apps such as VIDAA Kids, which raises concerns under the U.S. children’s privacy law (COPPA), and Christianity and Money. VIDAA’s own HOME OS app sent show and film titles in place of the app name.”
Keep in mind these researchers just focused on ACR — or video, image, or audio snippets taken to track your viewing and build a profile on you. There are numerous other ways smart TVs can track you — and numerous other avenues via which your traffic is being surveilled by everybody along the chain, including your telecom provider.
This persists because companies do not fear U.S. regulators, because U.S. regulators have been largely lobotomized via corruption. The United States also remains too corrupt to base even a baseline privacy law for the internet era or regulate the data brokers that further monetize much of this data. Still the researchers were nice enough to provide regulators a path, should they someday choose to do their jobs.
