Smart TV Tracking Persists After Opt-Out on Samsung, Vizio

The privacy toggle that may not work

If you have ever wondered whether someone is watching what you do, the usual suspect is your phone. New research points at a different screen. Northeastern University researchers report that smart TVs running Samsung's Tizen, Vizio's operating system and Roku OS kept sending network traffic to automatic content recognition (ACR) servers after users had switched tracking off in settings.21 The paper is titled "Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition." It tested eight TV operating systems on 12 sets from 10 manufacturers.21 The lead author, Ilgar Mammadov, says those operating systems cover about 95 percent of smart TVs in the United States.21

The scale of the testing is what makes the findings hard to wave away. The team ran 5,943 automated experiments, repeating each scenario 30 times with ACR on and 30 times with it off.22 Across those runs, the opt-out did what it claimed on four platforms: LG's webOS, Google TV on Sony, VIDAA and Amazon's Fire TV software.23

What ACR does, and where the opt-out failed

ACR works roughly like Shazam for your screen. The TV takes short samples of whatever is showing, turns them into digital fingerprints and sends them over the internet to be matched against a library of known content.23 That viewing history can feed targeted advertising and can be shared with or sold to other companies.23 Because ACR runs at the operating-system level, it can pick up content from outside the TV's own apps, including antenna broadcasts and devices plugged in over HDMI.26

Samsung's results were the most detailed. After opt-out, traffic consistent with ACR showed up in all 30 tests of Samsung's own streaming service, 41 of 60 antenna tests, 18 of 30 HDMI tests and six of 30 Tubi tests.22 Samsung holds about 34 percent of the U.S. smart TV market, so the reach is large.22

Vizio's results were in some ways worse. The researchers say an endpoint hosted on Amazon Kinesis kept receiving traffic in every opted-out scenario, and that the opt-out setting had no observable effect on it.21 That traffic continued even while the TV was sitting idle.21 Roku is a narrower case. The ACR-like behavior there appeared only inside The Roku Channel, and Roku discloses it in its terms of service.21 TCL-built Roku TVs also mention it in their settings menu, but Roku-branded sets do not.22

The caveat that matters

The most important limit on the study is encryption. Because the traffic was encrypted, the researchers could not see what it contained. They call its continued presence "suspicious" and say it points to potential privacy violations, not proven ones.21 Mammadov argues that even if a bug is to blame, users end up in the same place, because the TV ignores their opt-out.21 He considers it unlikely that the data is sent and then thrown away on the server side.21

Coverage has handled that caveat unevenly. One U.K. outlet's headline says Samsung TVs "kept tracking what people watched," even though its own article says the researchers could not confirm what the encrypted traffic contained.28 Another piece suggests Samsung sets may keep monitoring "even when powered off."25 The study's own measurements describe idle-state traffic on Vizio, not a switched-off Samsung.21 One roundup groups Roku with Samsung and Vizio as failed opt-outs.30 Ars Technica, by contrast, notes that Roku's exception is disclosed.21 eSecurity Planet takes the most careful line: the results do not show that manufacturers kept collecting or using viewing histories after opt-out.26

The careful reading is the right one, but it should not be mistaken for reassurance. A privacy control that cannot be checked from the outside, on a device locked down so tightly that rooting and TLS interception are generally impossible, is a control people have to take on faith.21 The study shows that, on the two biggest offenders, that faith is not earned.

"Is someone reading my information?" On some TVs, yes

For readers worried that strangers can read their data, the most concrete finding involves VIDAA, the Hisense-developed platform, rather than Samsung or Vizio. VIDAA's opt-out worked, but when ACR is on, its traffic travels unencrypted.22 Anyone positioned between the TV and the server, such as someone on the same network or an internet provider, could read it.22 That traffic can include a permanent device ID, app names, input sources, audio fingerprints and in some cases actual show titles.22

It got worse. VIDAA's ACR partner, Unruly, ran an MQTT broker that required no authentication.24 In about three hours, the researchers collected more than 57 million viewing detections from over a million TVs.22 Those detections fell into categories including religion, politics, and health and medicine, and the researchers also saw ACR running on a children's app, VIDAA Kids.22 They flagged potential COPPA concerns.24 Accounts differ on how fully this has been fixed. One summary says the vulnerability was disclosed and later fixed.30 Others note that while the broker now requires a login, the ACR data itself is still sent unencrypted.24 The second account is the more precise.

Vizio has its own leak. Its free WatchFree+ service exposes show and channel names in readable DNS lookups, so anyone on the network path could piece together a viewing history.22 Turning ACR off does not stop this, and there is no setting that does.22 The researchers' blocklist does not fix it either.29

The paper also faults the way these features are labeled. Five of the eight platforms avoid the plain term "automatic content recognition." Samsung calls the feature "Viewing Information Services," LG calls it "Live Plus" and Vizio calls it "Viewing Data," a practice the researchers describe as a dark pattern.22

The legal backdrop

The findings arrive in the middle of a legal fight over ACR. Texas Attorney General Ken Paxton sued Samsung, LG, Sony, Hisense and TCL on December 15, 2025.12 Samsung settled on February 26, 2026, and LG followed on May 11.12 Both agreed not to collect or monetize ACR data without express opt-in consent.12 Neither settlement included a fine.12 Hisense has been under a temporary restraining order since December 2025.12 Private suits are also piling up. A California class action, Tillery v. Samsung Electronics America, was filed on October 6, 2026.14 Samsung's public position is that ACR is optional, can be turned off, and does not record or watch what is on screen.14 A separate suit against Hisense over VIDAA is waiting on a ruling on Hisense's motions, filed in September.16

This is why the Northeastern findings matter beyond tech circles. The Texas settlements, and Samsung's own defense, depend on the off switch meaning something. If Tizen still sends ACR-like traffic in more than 60 percent of the tested opt-out scenarios, regulators and plaintiffs now have measurable evidence to point to.24 Samsung and Vizio had not explained the traffic as of Ars Technica's report.21

How to tell if you're being watched

The TV research fits a broader lesson about surveillance: symptoms are a poor guide, and checking access is a better one. The researchers' strongest advice is to take the TV off the network and stream through an external device that does not run ACR.21 On LG, Fire TV, Sony Google TV and VIDAA, using the opt-out is reasonable. On Samsung and Vizio, the team suggests blocking ACR endpoints at the router with its published list.24 In the tested scenarios, that blocklist did not interfere with viewing.27

Phones follow the same logic. Security guides agree that battery drain, heat and data spikes can point to spyware, but each has innocent explanations.16 The more reliable signs are concrete ones: unknown devices signed into your Apple or Google account, apps with device-admin or accessibility access you never granted, and unfamiliar configuration profiles.2 Several guides say the clearest warning sign has nothing to do with the hardware. It is when someone knows private things about you that they could only have learned by monitoring you.45 On iPhones, monitoring more often happens through a compromised Apple Account than through installed software.4 Dialing codes like *#21# only show whether calls are being forwarded. They cannot detect spyware.1

One safety warning applies here more than anywhere else. If you think a partner or family member is monitoring you, removing the stalkerware can tip them off. The FTC advises getting help from a trusted device before changing anything.7

The common thread is that you cannot rely on a device's own say-so about its privacy. A toggle reading "off" is not proof, whether it is on a phone or a TV. Checking who has access, and what is actually leaving your network, is the only way to know.