From The Verge · John Higgins · · 3m
Your TV keeps tracking you even after you opt out
A Northeastern University study finds that opting out of automatic content recognition does not always work, with Samsung, Roku, and Vizio continuing to send tracking data.
In brief
A Northeastern University study finds that opting out of automatic content recognition does not always work, with Samsung, Roku, and Vizio continuing to send tracking data. Northeastern University researchers tested twelve TVs and found that while most respect opt-outs from automatic content recognition tracking…
What TVs are tracking
TVs use automatic content recognition to sample audio or video, convert them into digital fingerprints, and send them to a database to identify what is being watched.
The study setup
Researchers at Northeastern University monitored twelve TVs from ten manufacturers to test whether opting out of automatic content recognition actually works.
TVs tested in the study
The study included Samsung QN32Q60DAF with Tizen OS, LG TV 32LR655BPUA with webOS, Roku TV 32R3B5 with Roku OS, TCL TV 32S350R with Roku OS, Sony K-43S20M2 with Google TV OS, Vizio VHD32M-0810 with Vizio…
Where ACR tracks
All TVs with ACR scan over-the-air transmissions.Everyone but Google and Amazon uses ACR on first-party streaming services like The Roku Channel and LG Channels.
How TVs fingerprint content
Tizen likely uses video fingerprinting.webOS and Vidaa use audio.Fire TV OS, Google TV OS, Roku OS, and Vizio OS use a combination of both audio and video fingerprinting to identify what is being watched.
Most opt-outs work
For webOS, Fire OS, Vidaa OS, and Sony Google TV, opting out stopped all data transmission to suspected ACR endpoints.
Samsung keeps tracking
Samsung's Tizen OS activity decreased after opting out but did not stop completely. ACR-correlated traffic still showed while using the antenna, first-party streaming, and HDMI inputs.
Roku's partial compliance
On the two Roku OS TVs tested, ACR still applied to the Roku Channel app after opting out. TCL discloses this limitation in menu settings, while the Roku TV does not.
Vizio ignores opt-out
Opting out on the Vizio TV did not change ACR-correlated traffic at all. Vizio settled a lawsuit with the FTC in two thousand seventeen related to consumer data gathering.
Timing of opt-out does not matter
Whether you opt out during setup or later makes no difference. Researchers manually tested the Vizio TV and Fire TV after a factory reset, and the results were unchanged.
“For the large-scale automated tests, we applied the opt-out through the TVs' settings menus after setup, not during the setup process.”
Vidaa vulnerability exposed
Researchers discovered a vulnerability with Vidaa OS exposing unencrypted information. They accessed an MQTT broker and received ACR results from over one million unique Vidaa TVs in three hours, collecting Client IDs, time zones, app…
“Each message carries a Client ID, a permanent identifier for the TV that can't be reset, along with the time zone, the app name, the input (antenna, HDMI), the antenna channel and an audio fingerprint.”
How to protect yourself
The easiest protection is to disconnect your TV from the internet and use a streaming device that does not run ACR.
What needs to change
Researchers call on TV makers to list every input that ACR watches in privacy policies, authenticate and encrypt all ACR traffic, and make opt-out agreements work fully.
Here's the gist
Northeastern University researchers tested twelve TVs and found that while most respect opt-outs from automatic content recognition tracking, Samsung, Roku, and Vizio continue sending data despite users opting out.
