Does opting out of smart TV tracking work? Research finds “suspicious” traffic.

Smart TVs running operating systems from Samsung, Vizio, and Roku continue sending data to automatic content recognition (ACR) endpoints after users opt out of tracking in the devices’ settings, according to research published on Monday. The paper from Northeastern University researchers points to potential privacy violations from some of the biggest TV brands.

ACR captures video screenshots or audio clips from smart TVs and sends the data to remote servers, where it’s used for things like measuring content viewership and serving targeted ads.

The paper, “Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition,” examined eight smart TV OSes across 12 smart TVs from 10 manufacturers (Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio, and Westinghouse) to examine when smart TVs use ACR and how effective opting out of user tracking is.

Regarding the relatively small number of TVs studied, Ilgar Mammadov, the report’s lead author and a research assistant at Northeastern, told Ars Technica:

Together, the smart TV operating systems we tested cover approximately 95 percent of those used in the United States. Because ACR is implemented at the OS level, we expect that adding more TVs running the same operating systems would largely repeat our existing findings rather than reveal new behavior.

The researchers made OS-specific control scripts and delivered them over Wi-Fi, while Mon(IoT)r and SPHERE Research Infrastructure software captured network traffic coming to and from each TV. The research included identifying each OS’s ACR endpoint. Some of the OSes, including Samsung’s Tizen, “expose self-disclosing ACR domains containing keywords such as ‘acr’ and ACR provider names,” the paper said. The researchers conducted 5,943 controlled experiments for the report.

The report’s findings have their limits, of course. Mammadov noted that each ACR provider and OS studied implemented ACR differently, adding:

They differed in the scenarios that trigger ACR, in how effective the opt-out is, and in the ACR modalities used. We would therefore expect TVs using ACR providers outside our study to behave differently as well, and our results should not be generalized to them. That said, our methodology is designed to be reusable.

Ongoing network traffic after user tracking is disabled

The researchers found that the TVs running Samsung Tizen, Vizio OS (which the report refers to by its former name, SmartCast), and Roku OS continued to send network traffic to the respective ACR endpoints when user tracking was disabled in settings and when tested for specific usage scenarios, including using a first-party streaming app.

In Roku OS’ case, the tested TVs exhibited this ACR-like behavior only when using the operating system’s integrated streaming app, The Roku Channel. Further, that behavior is expected and disclosed in Roku’s terms of service and, according to the report, in the TV’s settings on TCL-branded TVs.

That’s not the case for Tizen and Vizio OS TVs, which exhibited ACR-like behavior across additional usage scenarios, as shown in the table from the report below.

Ars contacted Samsung and Vizio to ask why TVs running their OSes send network traffic to ACR endpoints when tracking is disabled. We’ll update this story if we get answers.

Critically, encryption prevented the report’s authors from determining what the network traffic contained. However, they view the “continued presence of traffic consistent with ACR tracking after opt-out as suspicious.”

“These behaviors indicate potential privacy violations; however, we cannot know for certain without access to payload content,” the report reads.

Samsung

Researchers found that “traffic consistent with ACR tracking” remained present in all 30 of Tizen’s first-party streaming app measurements and 41 out of 60 of its “antenna” measurements, specifically when they used a radio frequency (RF) modulator “to deliver custom broadcast TV content with both dynamic video and audio” and to “deliver simulated content with dynamic video but no audio.”

Network traffic also continued after opt-out during 18 of 30 HDMI measurements on Tizen.

The researchers also recorded traffic to ACR endpoints in more than half the tests in which the researchers displayed “dynamic video with audio via HDMI from an external source” on a Tizen TV.

Vizio OS

The report’s authors determined that Amazon Kinesis is “the endpoint most consistent with ACR behavior for” Vizio OS and noted that traffic to the domain stops when using third-party streaming apps and screen mirroring, consistent with Vizio’s statement in a 2021 SEC filing that it doesn’t collect ACR data from those sources.

With Vizio OS, “a content-correlated endpoint hosted on Amazon Kinesis continues to receive traffic in 100 percent of opted-out scenarios.” Notably, the TVs reportedly sent network traffic to ACR endpoints when the TVs were idle.

The report reads:

Traffic to the identified Amazon Kinesis endpoint does not disappear or decrease in any opted-out measurement… indicating that the opt-out setting has no observable effect on the traffic sent to this endpoint.

Smart TVs have tracked users without consent before

Without knowing the contents of the traffic or what happens to it once it reaches remote servers, we can’t determine whether the OS operators are simply disregarding user preferences. It wouldn’t be the first time TVs have tracked users without permission, though.

In 2017, the FTC said Vizio TVs used ACR to collect user data without consent. The company paid $2.2 million to settle the charges, saying its ACR software “never paired viewing data with personally identifiable information.” Vizio said it used the data only “in the ‘aggregate’ to create summary reports measuring viewing audiences or behaviors.”

Texas Attorney General Ken Paxton sued Samsung, along with Hisense, LG, Sony, and TCL, last year, alleging that they use ACR to collect personal data “unlawfully.” Samsung made opting out too difficult, the lawsuit alleged. Samsung settled, agreeing to update its terms to more clearly explain its use of ACR.

If the TVs are tracking users who declined tracking, it “would raise serious concerns about user consent and transparency,” Mammadov said. He said that is one of the most likely reasons the TVs are sending network traffic to ACR endpoints when tracking is disabled.

Mammadov noted that Roku states in its terms of service that Roku OS tracks the use of first-party streaming apps even if users opt out of tracking. “This comparison suggests that the traffic we observed on Tizen OS and [Vizio] OS may similarly reflect ongoing data collection,” he said.

Could the activity be caused by a technical bug? Even if that were the case, “the outcome for users is the same: Their opt-out choice is not reflected in the TV’s behavior,” Mammadov said.

Mammadov said another possible explanation for the ongoing traffic is that data is transmitted but discarded once it reaches remote servers. The report’s authors consider this “unlikely,” Mammadov said, adding:

Transmitting data only to throw it away is an inefficient way to honor an opt-out, since it consumes the user’s bandwidth and adds load on the vendor’s servers for no purpose. Of course, it is also impossible for us to audit independently.

“Little is publicly known” about ACR

The paper highlights a troubling lack of transparency around how smart TV ACR works, what data companies are collecting, and when they collect it.

“Despite its importance, little is publicly known about the privacy implications of deployed ACR implementations—in part due to the opaque nature of their deployments and challenges with automated testing,” the report says.

The size of the TV market makes dissecting ACR deployments difficult, the paper says, because doing so requires “large numbers of devices and experiments.”

Another obstacle is that “smart TVs are locked down,” making “techniques like rooting and TLS interception generally unavailable [and creating] a need instead for techniques that reliably infer ACR activity,” the report says.

Avoiding smart TV tracking

Smart TV manufacturers’  persistent, opaque tracking practices have prompted more people to explore modifying their device’s software, including using a growing number of software tools designed to turn smart TVs into dumb TVs. Meanwhile, US nonprofit Software Freedom Conservancy is suing Vizio in an effort to make it easier for people to control their TV’s software, including disabling ACR.

To help people reduce the risk of their TVs tracking them without consent, the report’s authors created a list of network addresses, domains, and URLs that people can block “to prevent devices or apps from communicating with ACR services” without affecting TV viewing quality.

On the paper’s website, the researchers recommended that TV manufacturers “list every input that ACR watches, such as antenna, HDMI, apps, and screen mirroring, in the privacy policy” and “authenticate and encrypt all ACR traffic.”

The paper recommends that users remove smart TVs from their network and “use an external streaming device that does not perform ACR, or use the ACR opt-out on OSes where it was effective in our measurements.”

For tips on avoiding smart TV snooping, check out our guide on how to break free from smart TV tracking.

Scharon is a Senior Technology Reporter at Ars Technica writing news, reviews, and analysis on consumer gadgets and services. She's been reporting on technology for over 10 years, with bylines at Tom’s Hardware, Channelnomics, and CRN UK.