Researchers found Samsung and Vizio televisions continued generating traffic consistent with automatic content recognition after tracking was disabled, while an exposed VIDAA broker revealed millions of viewing records.
A security study from Northeastern University has raised fresh concerns about whether smart TV privacy controls work as advertised, after researchers found that some sets continued sending traffic consistent with automatic content recognition even after viewers disabled the feature. The work examined 12 televisions from ten manufacturers across eight operating systems and included 5,943 automated tests, according to reports on the study. It also identified a separate exposure in VIDAA’s ACR system, where researchers were able to collect roughly 57 million viewing records from an accessible MQTT broker.
The most troubling part of the findings is not simply that televisions generated telemetry, but that opt-out controls did not always appear to stop it. Reports on the study say Samsung and Vizio devices continued to produce ACR-like traffic after tracking was switched off, while other platforms behaved more consistently with the privacy setting. That distinction matters, because a privacy control is only meaningful if users can verify that it changes the underlying data flow, not merely the label on a menu.
Automatic content recognition is designed to identify what is playing on a screen by sampling audio or video signals and sending them to a remote service. In practice, that can support audience measurement, recommendations and targeted advertising. But it also means a television may observe content from any connected source, not only streaming apps, which is why disclosures about what is monitored, where data goes and how long it is retained are so important. Reports on the study say the researchers were evaluating exactly those questions across a broad sample intended to reflect most of the US smart TV market.
The VIDAA finding points to a different but related weakness: backend security. According to reports on the study, the researchers accessed an unauthenticated MQTT broker that was exposing Unruly-related viewing data, and the traffic was not encrypted. VIDAA has since added authentication to the broker, which reduces the immediate risk of unauthorised access, but authentication and encryption are not the same control. A system can block unknown clients and still leave data vulnerable if that data travels in plaintext over the network.
The reported volume of exposed records should also be interpreted carefully. A count of 57 million viewing results does not automatically mean 57 million people were affected, because the number could include repeated events or duplicated identifiers. Even so, the scale of the exposure shows how quickly a misconfigured connected service can make large amounts of behavioural data available. That is especially relevant for smart TV ecosystems, where manufacturers, operating-system vendors, analytics firms and advertising partners may all be involved in processing the same underlying information.
The broader lesson is that consumer-facing privacy settings cannot be judged by their interface alone. Independent testing is needed to confirm whether an opt-out actually stops the intended collection, whether downstream services still receive the same data and whether backend systems are properly authenticated and encrypted. The study’s reported results do not prove that every smart TV behaves this way, nor do they establish that 57 million unique users were exposed. They do, however, suggest that privacy assurances in this market deserve far closer technical scrutiny than manufacturers have often received.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
