TVs Found to Send Data Despite Opt-out Settings

Researchers at Northeastern University have been investigating how automatic content recognition (ACR) works on modern TVs and whether opting out of it makes a difference in terms of data collection.

To test this, the researchers monitored 12 TVs from 10 different manufacturers to see if disabling ACR would prevent them from sending user information to third-party databases. The study involved a range of popular TV brands, including those with well-known operating systems like Google TV and Vidaa OS.

In most cases, opting out was successful in preventing the TVs from transmitting data to external servers. This was observed on LG, Amazon Fire TV, Sony Bravia running Google TV, and TVs using Vidaa OS, a system found on models from Hisense, Toshiba, and smaller brands like Supersonic. However, there were some exceptions.

Samsung and Roku devices continued to send data despite the opt-out setting being enabled, suggesting that these companies' ACR systems may not be as easily disabled as those on other TVs. Furthermore, Walmart's Vizio TV seemed oblivious to the opt-out request, and its behavior remained unchanged.

TV manufacturers use ACR systems to gather information about what users are watching by sampling audio or video signals from the device. This data is then converted into digital fingerprints that can be matched against a database of known content. The purpose of this tracking includes providing targeted advertising, offering viewing metrics, and making recommendations for what to watch next.

The researchers used Northeastern's Mon(IoT)r software and SPHERE Research Infrastructure testbeds to capture and analyze network traffic from each TV, allowing them to determine when ACR tracking was active and identify where the TVs were sending this data.

This involved capturing all network traffic from each TV during various testing scenarios, including playing content from first-party streaming services such as LG Channels and The Roku Channel. They also tested third-party streaming services like Netflix and YouTube, as well as over-the-air antenna signals and screen mirroring.

The team's findings revealed that some TVs did not exhibit any ACR activity, including a Westinghouse Xumo TV and three other models from Sony, Hisense, and TCL running Google TV OS. These devices appeared to be free of the tracking mechanism.

Several other TVs were found to have varying levels of ACR activity, with different inputs producing different results. For example, some devices showed significant ACR traffic when streaming content via screen mirroring or over-the-air antenna signals.

The use of multiple testing scenarios and TV models allowed the researchers to gather a comprehensive understanding of how ACR tracking functions across various operating systems and input methods.

The researchers found that TVs running different operating systems exhibit varying levels of ACR tracking activity. While all tested TVs scan over-the-air transmissions for ACR data, not all use this method on first-party streaming services. Google and Amazon are the exceptions to this rule, with their platforms using ACR on both over-the-air transmissions and first-party apps.

A closer look at third-party apps like Netflix and YouTube reveals that only a small amount of ACR activity is present on webOS devices. This traffic disappears when these devices are opted out of ACR tracking. Screen mirroring appears to be exempt from monitoring, except for one TV running Vidaa OS.

To determine whether each operating system uses audio or video fingerprinting, the researchers conducted an experiment involving different types of content playback. They found that Tizen likely employs video fingerprinting, while webOS and Vidaa use audio-based methods. Fire TV OS, Google TV OS, Roku OS, and Vizio OS all use a combination of both.

Ideally, opting out of ACR activity should eliminate all data transmission to suspected ACR endpoints. However, this was not consistently the case in the experiment. On webOS, Fire OS, Vidaa OS, and Sony's Google TV devices, opting out did indeed stop ACR-related traffic.

However, Samsung's Tizen OS showed reduced but incomplete cessation of ACR activity when opted out. Specifically, some ACR-correlated traffic persisted even after opting out, particularly during antenna use, first-party streaming, and HDMI connections. Additionally, Roku OS TVs from TCL and Roku continued to track ACR data on the Roku Channel app despite being opted out.

The limitations of opting out of TV tracking vary between different models and brands. TCL TVs explicitly disclose this limitation in their menu settings, whereas Roku TVs do not provide such transparency.

Vizio TVs were tested to see if opting out would affect the amount of ACR-correlated traffic. However, the results showed that even after opting out, there was no noticeable change in the traffic levels.

Walmart, the retailer responsible for selling Vizio TVs, was contacted for comment regarding the study's findings but did not respond before publication. This lack of response raises questions about the company's stance on TV tracking and consumer privacy.

The researchers were unable to confirm with certainty that the remaining traffic after opting out was indeed ACR-related due to the encryption used by most network traffic sent from TVs to suspected ACR endpoints.

Tests conducted on certain models, including Vizio and Fire TVs, showed that even manual opt-outs after a factory reset did not change the results. The testing order was randomized to prevent any potential bias or influence between experiments.

The researchers were able to access an MQTT broker due to a vulnerability, which allowed them to receive Automatic Content Recognition (ACR) results from other Vidaa TV users.

This unauthorized access enabled them to collect data from over 1 million unique TVs in just three hours. The vulnerability has since been addressed by Vidaa, who have implemented login requirements for the server, although messages are still sent unencrypted.

Despite opting out of ACR tracking, researchers detected some residual traffic on certain operating systems, including Tizen OS, Roku OS, and especially Vizio OS. This suggests that these platforms may not be as secure as previously thought.

The study recommends several ways to protect oneself from TV data harvesting. One simple solution is to disconnect the TV from the internet entirely, both wired and wireless connections, and use a streaming device that doesn't run ACR.

Regulators must hold TV manufacturers accountable for their data collection practices and ensure that opt-out agreements are effective in protecting consumers' information.

The Northeastern study highlights the need for greater transparency from TV companies about Automatic Content Recognition (ACR) technology and the types of data they collect. Manufacturers should be responsible for disclosing this information, rather than leaving it to independent researchers to uncover. It is time for companies to stop hiding their data collection activities and take ownership of the information they gather.