Smart TVs may keep tracking viewers even after privacy settings are turned off
Some smart TVs continue sending network traffic consistent with viewing recognition after users disable the feature, raising questions about privacy controls, reports a Qazinform News Agency correspondent.
Researchers at Northeastern University conducted 5,943 controlled experiments involving 12 televisions from 10 manufacturers. The devices covered eight operating systems representing approximately 95% of the US smart TV operating system market, according to their study.
Automatic content recognition, or ACR, identifies programmes by sampling audio or video and comparing digital fingerprints with a content library. Viewing information can support audience measurement and targeted advertising.
On Samsung’s Tizen, traffic consistent with ACR persisted after opting out in all 30 tests of its built-in streaming service, 41 of 60 antenna tests and 18 of 30 HDMI tests.
On Vizio’s SmartCast, the privacy setting produced no observable reduction in traffic to an Amazon Kinesis endpoint identified as consistent with ACR activity. Roku’s opt-out did not cover its own streaming service, a limitation disclosed in its policies.
However, encryption prevented researchers from establishing what the continued transmissions contained or how companies handled them.
“These behaviors indicate potential privacy violations; however, we cannot know for certain without access to payload content,” the report states.
Opting out fully suppressed identified ACR traffic on four tested platforms: LG’s webOS, Amazon’s Fire TV OS, Sony’s Google TV implementation and VIDAA OS. The findings reflect the tested devices and software versions and do not necessarily apply to other models or regions.
On the project website, researchers urged manufacturers to explain which inputs ACR monitors and protect its transmissions. They also published a blocklist of ACR network addresses and suggested disconnecting televisions from the internet and using an external streaming device without ACR.
Earlier, Qazinform News Agency reported that Chinese e-commerce platform AliExpress had allegedly used users’ audio systems as part of a browser fingerprinting technique to distinguish devices, according to an investigation by the Brave browser team.