Vizio and Samsung Smart TVs Found to Ignore ACR Tracking Opt-Outs in University Study
A study by researchers at Northeastern University, titled 'Watching the watchers', tested twelve smart TVs from ten manufacturers across eight operating systems covering roughly 95% of US smart TVs to assess whether Automatic Content Recognition (ACR) opt-out settings actually stop data collection. Vizio continued sending traffic consistent with ACR for first-party streaming and antenna-based TV even after opt-out, while Samsung's Tizen OS leaked ACR-related traffic for third-party services like Netflix, YouTube, and Tubi TV, and 60% of HDMI sessions, despite users opting out. Only four operating systems — LG WebOS, Sony's Google TV OS, Amazon FireTV OS, and Supersonic's VIDAA OS — fully honored opt-out requests. The findings raise questions about compliance with Vizio's 2017 FTC settlement, in which it paid $2.2 million over unauthorized collection of viewing histories from eleven million TVs, especially relevant now that Walmart acquired Vizio in 2024 partly for its advertising data business.
Detalhes técnicos
The researchers ran over 5,000 automated sessions testing ten viewing scenarios (antenna TV, first-party and third-party streaming apps, HDMI/screen mirroring) with ACR both enabled and disabled. Most manufacturers, including Samsung, encrypt ACR traffic, forcing researchers to infer ACR activity from endpoint destination, timing, volume, and protocol signals rather than payload content. Vizio's TV sent 100% of apparent ACR traffic to Amazon's Kinesis data ingestion service regardless of opt-out status, and its payload could not be inspected due to encryption. One exception, Supersonic's VIDAA OS, sent ACR data unencrypted to servers lacking authentication, exposing over 57 million ACR detection results from other users' TVs to anyone monitoring the network. Vizio's WatchFree+ service also transmitted unencrypted show/channel titles with no option to disable this behavior.
Remediação
Users of LG WebOS, Amazon FireTV OS, Sony Google TV OS, and Supersonic VIDAA OS can reasonably trust the ACR opt-out setting. For other devices, researchers recommend disconnecting the smart TV from the internet and using an external streaming device, or applying a network-level blocklist of known ACR endpoints (provided by the researchers) via a capable router.
Linha do tempo
-
Vizio and Samsung Smart TVs Found to Ignore ACR Tracking Opt-Outs in University Study
ler a análise desta fonte ocultar
A study by researchers at Northeastern University, titled 'Watching the watchers', tested twelve smart TVs from ten manufacturers across eight operating systems covering roughly 95% of US smart TVs to assess whether Automatic Content Recognition (ACR) opt-out settings actually stop data collection. Vizio continued sending traffic consistent with ACR for first-party streaming and antenna-based TV even after opt-out, while Samsung's Tizen OS leaked ACR-related traffic for third-party services like Netflix, YouTube, and Tubi TV, and 60% of HDMI sessions, despite users opting out. Only four operating systems — LG WebOS, Sony's Google TV OS, Amazon FireTV OS, and Supersonic's VIDAA OS — fully honored opt-out requests. The findings raise questions about compliance with Vizio's 2017 FTC settlement, in which it paid $2.2 million over unauthorized collection of viewing histories from eleven million TVs, especially relevant now that Walmart acquired Vizio in 2024 partly for its advertising data business.
Technical Details
The researchers ran over 5,000 automated sessions testing ten viewing scenarios (antenna TV, first-party and third-party streaming apps, HDMI/screen mirroring) with ACR both enabled and disabled. Most manufacturers, including Samsung, encrypt ACR traffic, forcing researchers to infer ACR activity from endpoint destination, timing, volume, and protocol signals rather than payload content. Vizio's TV sent 100% of apparent ACR traffic to Amazon's Kinesis data ingestion service regardless of opt-out status, and its payload could not be inspected due to encryption. One exception, Supersonic's VIDAA OS, sent ACR data unencrypted to servers lacking authentication, exposing over 57 million ACR detection results from other users' TVs to anyone monitoring the network. Vizio's WatchFree+ service also transmitted unencrypted show/channel titles with no option to disable this behavior.
Remediation
Users of LG WebOS, Amazon FireTV OS, Sony Google TV OS, and Supersonic VIDAA OS can reasonably trust the ACR opt-out setting. For other devices, researchers recommend disconnecting the smart TV from the internet and using an external streaming device, or applying a network-level blocklist of known ACR endpoints (provided by the researchers) via a capable router.