Samsung, Vizio and Roku smart TVs keep sending tracking data after opt-out, study finds

Automatic content recognition, or ACR, captures video screenshots or audio clips from smart TVs and transmits them to remote servers, where the data is used for measuring content viewership and serving targeted advertising.

The paper, 'Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition,' examined eight smart TV operating systems across 12 televisions from 10 manufacturers: Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio and Westinghouse. The researchers set out to establish when smart TVs use ACR and how effective opting out of user tracking actually is.

The study found that devices running Samsung, Vizio and Roku software kept sending data to ACR endpoints after users had opted out, traffic it describes as suspicious. The paper argues the behaviour points to potential privacy violations by some of the largest TV brands.

Connected televisions have become central to the advertising market, with ACR data used both to measure who watches what and to build profiles for ad targeting. The findings add to ongoing questions about whether the privacy controls offered to consumers do what they promise.

Analysis

Why This Matters

For millions of smart TV owners, the opt-out setting is the main control they have over viewing data collection. If data flows continue regardless, that control is effectively meaningless.
ACR can transmit screenshots or audio clips, sensitive material that feeds targeted advertising and viewership measurement.
The findings could draw regulatory and consumer attention to the privacy practices of connected TV makers.

Background

Smart TV manufacturers and their advertising partners have used automatic content recognition for years to identify what appears on screen, helping advertisers measure campaigns and target viewers. Because the features are typically on by default, manufacturers provide settings that are supposed to let users stop the collection. This study tested whether those opt-out controls work on current hardware from a range of major brands.

Key Perspectives

Researchers (Northeastern University): Their testing across 12 TVs and eight operating systems found continued transmission to ACR endpoints after opt-out on Samsung, Vizio and Roku devices, and they characterise the traffic as suspicious and the behaviour as a potential privacy violation. Ad-supported TV industry: ACR underpins audience measurement and targeted advertising, the revenue model behind many smart TVs sold at low hardware prices. The industry's reliance on this data gives it a strong interest in the collection continuing. Critics and sceptics: The study covers a sample of 12 TVs and eight OSes, which may not reflect every model or firmware version. Whether the continued traffic amounts to a violation depends on what data is sent and how each company's privacy commitments are worded, questions the paper itself raises.

What to Watch

Whether Samsung, Vizio and Roku respond with explanations, fixes or software updates that change what their TVs send after opt-out.
Whether regulators or lawmakers take up the findings in privacy enforcement or consumer protection proceedings.
Follow-up research testing updated firmware and additional brands to see whether the behaviour persists.

Checked

9 claims in this story checked against 1 source: 5 supported.

Show each claim

SupportedSamsung, Vizio and Roku smart TVs continue sending data to ACR endpoints after users opt out of tracking.Ars Technica - All content: “Smart TVs running operating systems from Samsung, Vizio, and Roku continue sending data to automatic content recognition (ACR) endpoints after users opt out of tracking in the devices’ settings”
SupportedNortheastern University research finds “suspicious” traffic after opt-out.Ars Technica - All content: “Does opting out of smart TV tracking work? Research finds “suspicious” traffic..”
Partly supportedThe research was published this week.Ars Technica - All content: “according to research published on Monday.”
SupportedThe paper examined eight smart TV operating systems across 12 televisions from 10 manufacturers.Ars Technica - All content: “The paper, "Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition," examined eight smart TV OSes across 12 smart TVs from 10 manufacturers”
SupportedACR captures video screenshots or audio clips from TVs and sends them to remote servers for measuring viewership and serving targeted ads.Ars Technica - All content: “ACR captures video screenshots or audio clips from smart TVs and sends the data to remote servers, where it's used for things like measuring content viewership and serving targeted ads.”
SupportedThe paper points to potential privacy violations by some of the biggest TV brands.Ars Technica - All content: “The paper from Northeastern University researchers points to potential privacy violations from some of the biggest TV brands.”
Partly supportedACR data is used to build profiles for ad targeting.Ars Technica - All content: “where it's used for things like measuring content viewership and serving targeted ads.”
Not in the sourcesConnected televisions have become central to the advertising market.
Not in the sourcesThe findings add to ongoing questions about whether smart TV privacy controls do what they promise.