Northeastern University researchers found that some televisions continued sending viewing-related traffic after users disabled Automatic Content Recognition, while an exposed broker revealed millions of recognition results.
Researchers at Northeastern University in Boston have found that disabling Automatic Content Recognition on some smart televisions does not necessarily stop the sets from sending viewing-related data to tracking servers. In tests covering 12 televisions, eight operating systems and 10 viewing scenarios, the team reported that traffic consistent with ACR activity continued on some Samsung, Vizio and Roku devices even after users had switched the feature off in settings. By contrast, the study found that opt-out controls worked as expected on LG’s webOS, Google TV on Sony sets, Hisense’s VIDAA OS, and Amazon’s Fire OS.
ACR is the technology that samples what appears on a screen so a television can identify programmes, films and advertising. In the paper, “Watching the Watchers: Privacy Analysis of U.S. Smart TV Automatic Content Recognition”, the authors said smart TV use of the system is now widespread in the United States, with a large majority of households owning a compatible set. Their test programme was deliberately broad: each scenario was repeated dozens of times with ACR enabled and then again after opt-out, producing 5,943 individual experiments across live antenna feeds, HDMI inputs, streaming apps and idle-state conditions.
The clearest problems emerged on Samsung and Vizio products. According to the paper, Samsung’s Tizen platform continued to generate ACR-like traffic after opt-out in every test run involving the manufacturer’s own integrated streaming service, and in substantial portions of the antenna, HDMI and Tubi scenarios. On Vizio’s SmartCast platform, the researchers said an endpoint hosted on Amazon Kinesis kept receiving data in every opt-out scenario they observed, including when the television was not actively being used. The authors said the setting appeared to have no observable effect on that traffic.
Roku devices presented a different issue. The researchers said the opt-out did not apply to The Roku Channel, which means some data collection continued there regardless of the setting. The paper also notes that TCL surfaces this limitation in its settings menu, whereas Roku TV does not. In broadcast tests, the opt-out worked on Roku TV but not consistently on the TCL model. The study’s authors cautioned that their conclusions are based on network traffic patterns rather than packet contents, because much of the communication was encrypted. They also said they excluded low-volume background traffic to avoid false positives.
The researchers further reported two additional privacy concerns. They found that some data was being transmitted in clear text by two vendors, and they identified an unauthenticated MQTT broker that, over a three-hour window, exposed 57 million ACR recognition results from more than a million televisions. The vulnerability was disclosed and later fixed. The findings apply to U.S. devices and configurations, and may not translate directly to European markets, where the GDPR adds a different regulatory framework. Even so, the study suggests that users should not assume an opt-out switch fully ends smart TV tracking, and it reinforces the value of reviewing privacy settings and limiting network access where practical.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
