Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Samsung and Vizio smart TVs continued sending traffic consistent with automatic content recognition (ACR) even after researchers disabled the feature.

This raises concerns about how reliable privacy controls are at preventing surveillance of viewing. However,encrypted connections made it impossible for researchers to confirm whether those transmissions contained viewing data or whether manufacturers retained them.

The study, titled “Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition,” examined 12 televisions from 10 manufacturers across eight operating systems.

Researchers conducted 5,943 automated experiments, testing viewing scenarios with ACR enabled and disabled.

Smart TVs Flaw

ACR identifies on-screen content using audio or video fingerprints that are matched against reference libraries. This technology can reveal programming watched via antenna broadcasts, HDMI devices, or supported streaming services, enabling audience measurement and targeted advertising. Unlike standard app analytics, ACR can operate across various external inputs.

The researchers captured network traffic while supplying controlled content through antenna connections, HDMI inputs, and screen mirroring.

The researchers repeated each scenario 30 times for both privacy settings, allowing comparisons between opted-in and opted-out behavior.

Their analysis distinguished between content-related ACR traffic and background communications, excluding small residual volumes below 5% of opted-in traffic when evaluating the effectiveness of opting out.

Samsung’s Tizen televisions continued to generate ACR-like traffic in all 30 opted-out tests involving its built-in streaming service. Traffic also appeared in 41 of 60 antenna runs, 18 of 30 HDMI runs, and 6 of 30 Tubi tests.

Similarly, Vizio’s SmartCast televisions showed no observable reduction in traffic to its identified Amazon Kinesis ACR endpoint after opting out. The endpoint continued to receive traffic in every opted-out run across the tested scenarios.

These findings contradict the manufacturers’ claims about their privacy controls. Samsung states that ACR is optional and can be disabled through settings.

At the same time, Vizio claims users can withdraw from its Viewing Data program at any time. In contrast, LG webOS, Sony Google TV, VIDAA, and Fire TV implementations showed effective opt-outs. However, Roku’s controls did not extend to its own streaming service, highlighting inconsistencies in what an opt-out actually entails.

The investigation also uncoveredseparate pathways for viewing data exposure. VIDAA transmitted audio fingerprints and persistent device identifiers through unencrypted MQTT connections.

An unauthenticated server exposed more than 57 million recognition results linked to over one million televisions during a three-hour sampling period. Although VIDAA later introduced server authentication, researchers reported that the transmissions remained unencrypted.

In a separate instance, Vizio’s WatchFree+ service exposed show or channel information through readable DNS queries and TLS Server Name Indication fields associated with Amagi delivery infrastructure, independent of ACR settings.

These findings are specific to the tested devices and their firmware and do not apply to every model. While ongoing encrypted traffic indicates inconsistencies in the opt-out process, it does not clarify what information companies received, processed, or retained.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.