A university hackathon decrypted an LG television’s ACR messages, finding address and location fields alongside audio fingerprints, while tests on Vizio and Hisense sets raised separate privacy concerns.
A Northeastern University hackathon has exposed how much data a smart television can transmit beyond basic viewing fingerprints. According to The Security Ledger and FULU’s report, a graduate student gained root access to an LG set during the 19-20 October event and used that access to inspect encrypted automatic content recognition, or ACR, traffic that would normally be hidden from view. The decrypted messages did not only identify what was playing; they also carried location fields, including a street address, coordinates and a designated market area. FULU said the findings show that consumer privacy risks extend well beyond simple watch-history collection.
The event formed part of a broader research effort at Northeastern’s Cybersecurity and Privacy Institute, with support from the Ludlow Institute, CodeDay and FULU. More than 40 students and coders examined televisions from LG, Vizio and Hisense, building on the university’s Watching the Watchers project, which has previously analysed ACR behaviour across multiple brands and operating systems. That earlier work had often inferred tracking from network patterns, whereas the hackathon allowed researchers to confirm some of those inferences by looking inside the LG television’s transmissions directly.
In the LG tests, the researchers found that the set was sending audio fingerprints during normal playback, along with timestamps, device and session identifiers, the input source and the app or channel in use. Controlled playback experiments suggested the system was reacting to sound rather than picture, because messages appeared when audio was present, but not when it was removed. The researchers did not establish whether the location data was derived from the device itself, the network, the account or some other source, so the findings do not prove the television could always pinpoint a household precisely.
The report also suggests that the LG set’s Live Plus ACR opt-out worked as intended in the limited tests performed. When the feature was disabled, fingerprint uploads stopped, and they resumed when it was re-enabled. At the same time, the researchers identified what they described as a possible transport-security weakness: the rooted television’s uploader accepted an interception proxy’s certificate without the installation of its certificate authority, and copied code showed hostname and certificate verification disabled. FULU said that point needs further testing on an unmodified television before any broader conclusion can be drawn.
Other devices under test raised different concerns. On a Vizio set, researchers observed an unencrypted data stream linked to WatchFree+, Vizio’s ad-supported service, and saw channel names exposed in plaintext lookups even with the television’s viewing-data setting disabled. On a Hisense model, the team found that a shared-media link was stored locally before the user had approved access, meaning another device on the same network could potentially retrieve it. FULU said these results are preliminary, because each team worked on a single television and most experiments were repeated only once, but the organisation argued they underline why independent inspection of connected devices remains necessary.
The findings sit within a wider debate over smart-TV privacy and consumer control. Northeastern’s Watching the Watchers project says smart televisions are now common in the United States and has documented ACR behaviour across multiple brands, including cases where traffic continued even after opt-out settings were used. FULU and other consumer-focused groups are also pushing for changes to the Digital Millennium Copyright Act’s Section 1201, which they say can make it difficult for owners to disable software locks and inspect or remove unwanted tracking features.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
