Turned Off Tracking on Your Smart TV? Samsung and Vizio Sets May Keep Sending Data, Study Finds

You found the privacy setting, you switched off viewing tracking, and you assumed that was the end of it. On some of the most popular TVs in America, it may not be.

University researchers ran thousands of automated tests on a dozen smart TVs. On TVs running Samsung's and Vizio's software, network traffic to servers the researchers linked to viewing tracking kept flowing after the tracking setting was turned off. Together, those two platforms run about 45 percent of smart TVs in the US.

What happened: A team at Northeastern University published a study on Monday, October 19, testing whether the "turn off viewing data" settings on smart TVs actually stop the tracking. The opt-out fully worked on four platforms: LG, Sony's Google TV, Amazon Fire TV and VIDAA. On Samsung and Vizio TVs, it didn't fully stop the traffic.

What this means for you: If you own a Samsung or Vizio TV, switching off the tracking setting is still worth doing, but it may not be the whole fix. The researchers couldn't see inside the encrypted traffic, so nobody has proven what is in it. Their own advice is to keep the TV off the internet and stream through a separate device, or to block the tracking servers on your home network.

What happened

Most smart TVs include a feature called automatic content recognition, or ACR. It works a little like a song-identifying app on your phone. The TV takes short snapshots of the picture or sound on screen, turns them into a digital fingerprint and sends that to a server, which works out exactly what you're watching. That viewing history can then be used for recommendations and targeted ads, and shared with other companies.

ACR can recognize more than streaming apps. Depending on the TV, it can identify shows coming in through an antenna, a cable box or a game console plugged into an HDMI port.

The Northeastern team built an automated "living room" that played identical content on 12 TVs from 10 brands (Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio and Westinghouse). Those TVs cover the eight operating systems that run about 95 percent of US smart TVs. They ran 5,943 experiments in all, repeating each test scenario 30 times with tracking on and 30 times after opting out, and recorded every bit of network traffic.

The study is called "Watching the Watchers."

What this means for you

Many TVs ask you to agree to ACR during setup, and an estimated 82 percent of US households have a smart TV that supports it. That makes the opt-out setting the main tool most people have to keep their viewing habits private.

This study suggests that on some brands, the setting isn't doing everything people expect. Here's how the tested platforms did once tracking was turned off:

Our read: if you have an LG, Fire TV or Sony Google TV set, the setting appears to do its job, so turn it off and you're in good shape. If you have a Samsung or Vizio TV, turn the setting off anyway, then consider the extra steps below.

The details

Samsung

With tracking turned off, traffic consistent with ACR still showed up in all 30 tests of Samsung's built-in free streaming service, in 41 of 60 antenna tests and in 18 of 30 tests using a device plugged into HDMI. It also appeared in 9 of 30 tests where the TV was simply sitting on the home screen.

Samsung's own support page states that viewers can opt out of ACR and the collection of viewing history at any time, and that Samsung does not record or watch the content on the screen. The study's results don't prove Samsung is collecting viewing data after an opt-out, but they show the network traffic didn't stop. The researchers also can't tell whether any data is processed or kept on Samsung's servers.

Vizio

Vizio's results were the starkest. Traffic to a server the researchers identified as the most likely ACR endpoint, hosted on Amazon's cloud, didn't drop at all in any opted-out test, and it flowed even while the TV sat idle. It did stop while third-party apps were running or the screen was being mirrored. The researchers call this traffic the most consistent with ACR, partly based on Vizio's own public filings, but couldn't see what it contains.

In 2017, Vizio and its Inscape unit agreed to pay $2.2 million to settle charges from the Federal Trade Commission and the New Jersey Attorney General that they collected viewing data without consent. Vizio didn't admit wrongdoing, and agreed to get viewers' clear consent before collecting that data. Because the new traffic is encrypted, this study can't show whether it conflicts with that settlement.

The team also found a separate leak that has nothing to do with the opt-out. In Vizio's free WatchFree+ service, the name of the show or channel being watched appeared in plain, unencrypted web address lookups to servers run by Amagi, the company that delivers the service's streams. Anyone able to watch the traffic on your network could piece together a viewing history. Turning off tracking doesn't fix that one.

Roku

On Roku TVs, the opt-out worked for most viewing, with one exception: The Roku Channel, Roku's own free streaming service. Roku discloses this in its terms, and TCL's Roku TVs say so in the settings menu, but the Roku-brand TV tested did not show that note on screen.

VIDAA

The opt-out worked on VIDAA, the second-largest smart TV operating system worldwide. But the researchers found its ACR data traveling unencrypted, and a server with no login protection. In a three-hour sample, it exposed more than 57 million viewing detection results from more than one million TVs, including categories like "Politics," "Health and Medicine" and "Religious." VIDAA confirmed the problem after the researchers reported it, and the server now requires a login, though the traffic is still unencrypted.

What isn't known

• What's inside the traffic. It's encrypted, so the researchers couldn't confirm it contains viewing data. They describe it as "suspicious" and write that it indicates "potential privacy violations."
• What happens to it. Nobody outside the companies can see whether the data is stored, used or thrown away. The researchers consider that "unlikely," lead author Ilgar Mammadov told Ars Technica, adding that it is "impossible for us to audit independently."
• Why it happens. A software bug is possible. Even then, Mammadov told Ars Technica, the user's opt-out choice isn't reflected in what the TV actually does.
• Every model. The study tested specific TVs and software versions. Other models and future updates may behave differently.

Confusing setting names

Part of the problem is finding the setting at all. Five of the eight platforms don't use the words "automatic content recognition" on the switch. The researchers listed what each one is called:

What to do now

1. Turn off the tracking setting, whatever brand you own. It fully worked on four of the platforms tested, and it's the first step on every other TV.
   • Samsung: search your TV's settings for Viewing Information Services (where it sits varies by model and year) and turn it off.
   • Vizio: press Menu, go to All Settings, then Privacy & Legal (Admin & Privacy on older TVs), and switch Viewing Data off. Vizio states that turning it off also deletes the stored viewing logs for that TV.
   • LG, Sony and Roku: search your TV's settings for the names in the table above and switch them off.
2. Check again after a factory reset. A reset puts the TV back to its out-of-the-box settings, so you'll need to turn tracking off again.
3. Consider taking the TV offline. This is the researchers' top tip. Forget the Wi-Fi network in the TV's settings, or unplug its network cable, and watch streaming apps through a separate streaming stick or box plugged into HDMI instead. Our read: pick a device whose own tracking setting you've also turned off, since streaming devices collect data too.
4. Block the tracking servers (for confident DIYers). The researchers published a list of the ACR servers they found. If your router or a network filter like Pi-hole lets you block addresses, you can add them. In the lab, blocking them didn't interfere with normal viewing, but that isn't guaranteed for every model.
5. Use the TV's free built-in channels with care. On Samsung and Roku, the TV's own free streaming service was where traffic linked to tracking was hardest to switch off, and Vizio's WatchFree+ leaked show names. Watching through a separate streaming device sidesteps both.
6. Shopping for a new TV? Our read: based on these results, LG, Fire TV and Sony Google TV sets had opt-outs that worked in testing, but every brand collects some data, so check the privacy settings on day one whatever you buy.

Ars Technica says it contacted Samsung and Vizio for comment. We'll update this story if either company responds publicly.

References

• Northeastern University: Watching the Watchers, Privacy Analysis of U.S. Smart TV Automatic Content Recognition (paper, PDF)
• Watching the Watchers: Project site and findings
• Ars Technica: Does opting out of smart TV tracking work? Research finds "suspicious" traffic
• Samsung: Samsung Smart TV Automatic Content Recognition (ACR) Feature
• Vizio: Viewing Data Supplement
• Vizio Support: How to turn Viewing Data On, Off, or Delete