Study: Opting out of TV tracking works for some makers but not others
Northeastern University researchers tested 12 TVs from 10 manufacturers and found that turning off automatic content recognition (ACR) fully worked only on some of them. Samsung and Roku kept sending some data, while Vizio's opt-out changed nothing.
Researchers at Northeastern University in the United States tested whether the opt-out option for automatic content recognition (ACR) on smart TVs really stops data collection about viewers. ACR systems sample the audio or video playing on a TV, convert it into digital fingerprints and send it to a database to identify what is being watched. TV companies use this to recommend content, provide viewing metrics and allow targeted advertising. The study was covered by the technology outlet The Verge.
How the tests worked
The team monitored 12 TVs from 10 manufacturers running different operating systems. Using Northeastern's Mon(IoT)r software and SPHERE testbeds, they captured all network traffic from each set. Because manufacturers lock down their systems, ACR activity had to be inferred from where each TV sent its data. Content was played through first-party streaming services, third-party apps such as Netflix and YouTube, an HDMI cable, an over-the-air antenna and screen mirroring.
Several TVs showed no ACR activity at all, including a Westinghouse Xumo model and three Google TV sets from Sony, Hisense and TCL. Every TV with ACR-related traffic scanned over-the-air broadcasts.
Opt-out results
Opting out fully worked on LG (webOS), Amazon Fire TV, a Sony running Google TV and Vidaa OS devices. Samsung's Tizen activity decreased but continued with the antenna, first-party streaming and HDMI. On both Roku OS TVs (from TCL and Roku), ACR still applied to The Roku Channel app; TCL discloses this in its menu settings, while Roku does not. On the Vizio TV, opting out did not change ACR-correlated traffic at all. Walmart did not respond to a request for comment before publication. Because most traffic was encrypted, the researchers could not confirm that the remaining traffic was ACR.
Security flaw
The researchers also found a vulnerability in Vidaa OS that exposed unencrypted ACR results from other users. In three hours they collected data from more than 1 million unique TVs. Vidaa confirmed the problem and fixed it by requiring a login for the server, although messages are still sent unencrypted.
Recommendations
The researchers advise disconnecting a TV from the internet and using a streaming device without ACR, or using webOS, Fire TV, Sony's Google TV or Vidaa while opting out of everything possible. They call on manufacturers to list every input ACR monitors and to encrypt its traffic, and on regulators to ensure opt-outs work fully.
