Samsung, Vizio Smart TVs Send User Data After Privacy Settings Disabled

Key Takeaways

• Samsung and Vizio smart TVs were observed transmitting data consistent with Automatic Content Recognition (ACR) even after users explicitly disabled the feature in privacy settings.
• The Watching the Watchers study, which examined 12 smart TV models, raises significant concerns about the effectiveness of privacy controls on widely used devices.
• While encrypted traffic prevented confirmation of exact data content, network patterns indicated continued data transmission, suggesting potential privacy breaches.
• One manufacturer, VIDAA, was found transmitting sensitive ACR data unencrypted, and a server exposed millions of detection results from over a million televisions.

Smart TV Privacy Under Scrutiny: Samsung and Vizio Accused of Continued Data Transmission Post-Opt-Out

New research indicates that smart televisions from Samsung and Vizio may continue to transmit data related to viewing habits, specifically Automatic Content Recognition (ACR) information, even after users have explicitly disabled these features within the devices’ privacy settings. This discovery, detailed in the Watching the Watchers study, casts doubt on the efficacy of privacy controls offered by major smart TV manufacturers and highlights potential vulnerabilities in user data protection.

The comprehensive study analyzed 12 commercial television models from ten different manufacturers, covering eight distinct operating systems that collectively represent approximately 95% of the U.S. smart TV market. Researchers conducted 5,943 automated experiments, meticulously comparing network activity when ACR was both enabled and disabled.

Automatic Content Recognition: A Double-Edged Sword

ACR technology functions by identifying on-screen content through the analysis of short audio or video samples, or by creating digital fingerprints derived from them. These signals are then cross-referenced against known content databases to pinpoint specific programs. While valuable for audience measurement, targeted advertising, and data sharing, the persistent operation of ACR despite user opt-out raises serious privacy implications.

ACR’s reach extends beyond integrated streaming applications, encompassing content from antenna broadcasts and external HDMI devices. Previous cybersecurity investigations have highlighted how ACR can remain active even when a smart TV is primarily used as an external display, underscoring its pervasive nature.

Persistent Tracking Observed on Samsung and Vizio Devices

During the analysis, researchers captured network packets while televisions displayed controlled content from various sources, including antenna inputs, HDMI connections, streaming services, and screen mirroring. Each viewing scenario was repeated with ACR enabled and subsequently after the feature was disabled.

Samsung’s Tizen-based televisions consistently exhibited ACR-consistent traffic in all 30 tests involving its built-in streaming service, even after users opted out. Similar traffic patterns were observed in 41 out of 60 antenna tests, 18 out of 30 HDMI tests, and six out of 30 Tubi app tests.

Vizio’s SmartCast televisions similarly maintained contact with their identified Amazon Kinesis ACR endpoint in every opted-out scenario where traffic was initially present. Researchers detected no reduction in this communication after the feature was disabled, suggesting a persistent data flow.

It is crucial to note that while these findings demonstrate continued network traffic consistent with ACR, the majority of this traffic was encrypted. Therefore, researchers relied on factors such as destination servers, timing, data volume, and other network patterns. They could not definitively ascertain the exact information transmitted to company servers or confirm whether this data was stored.

Varying Compliance Across Manufacturers

In contrast to Samsung and Vizio, the opt-out mechanisms appeared to function correctly on tested LG webOS, Sony Google TV, Amazon Fire TV, and VIDAA systems. Roku’s privacy setting, however, did not cover its own streaming service. This limitation was disclosed on the tested TCL television, which incorporated Roku technology, but not on the Roku-branded model itself.

Unencrypted Transmissions and Exposed Data

Beyond the concerns of uncertain encrypted traffic, the research also exposed significant risks. VIDAA was found to transmit ACR messages over MQTT without encryption, directly exposing sensitive data such as device identifiers, application names, input sources, and audio fingerprints. Alarmingly, an unauthenticated server linked to VIDAA was found to expose over 57 million detection results tied to more than one million televisions. While VIDAA subsequently implemented login requirements, researchers noted that transmissions remained unencrypted.

Separately, Vizio’s WatchFree+ service was observed placing readable program or channel information within network names visible via DNS requests and TLS server-name information. This could potentially reveal user viewing choices to network observers, even when ACR is explicitly disabled.

What You Should Do

• Disconnect from the Internet: For maximum privacy, consider disconnecting your smart TV from the internet entirely if you primarily use it for external inputs (e.g., gaming consoles, Blu-ray players) and do not rely on its smart features.
• Block ACR Endpoints: Implement network-level blocking of known ACR endpoints. The researchers have published a blocklist which, in their tests, did not disrupt viewing. However, this may not prevent all forms of data leakage, such as the WatchFree+ title leak.
• Review App Permissions: Scrutinize app permissions and bundled services on your smart TV. Some applications or services may have broad data collection permissions that operate independently of general ACR settings.
• Use a VPN or DNS-based Filtering: Employ a reputable VPN service or a DNS-based content filter (like Pi-hole) on your home network to gain more control over outgoing traffic from all your smart devices, including TVs.
• Stay Informed: Regularly check for firmware updates from your TV manufacturer, as these may include privacy enhancements or bug fixes. Also, stay updated on cybersecurity news regarding smart TV vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.