Smart TV tracking opt-outs fail to block ACR ad telemetry across 95% of US living rooms, study finds
Northeastern University researchers audit 12 smart TVs across 10 major brands, revealing continuous network video fingerprinting even when privacy toggles are disabled.
Technology news
A comprehensive empirical investigation by cybersecurity and privacy researchers at Northeastern University has revealed that privacy toggles designed to disable Automatic Content Recognition (ACR) on smart televisions consistently fail to prevent intrusive background tracking across major consumer hardware brands.
The research paper, titled 'Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition,' evaluated 12 television models from 10 prominent manufacturers—including Amazon, Hisense, LG, Roku, Samsung, Sony, TCL, and Vizio—representing operating systems that together control approximately 95% of the US connected television market. Researchers performed 5,943 controlled Wi-Fi packet-inspection tests while toggling every user-facing tracking and advertising preference.
Network analysis revealed that multiple smart TV platforms continued transmitting continuous cryptographic hashes of on-screen video frames, ambient audio snippets, and unique hardware identifiers to ACR domains and third-party ad brokers even after consumers explicitly disabled tracking in system settings. Several operating systems disguised surveillance telemetry through persistent connection heartbeats, rendering standard router privacy filters ineffective.
Lead researcher Ilgar Mammadov noted that because ACR functionality is baked directly into low-level operating system kernels, consumer settings rarely grant meaningful sovereignty over outbound data flows. Privacy advocates warn that as television displays increasingly serve as centralized smart home hubs, unvetted firmware-level telemetry creates severe regulatory compliance liabilities under state privacy statutes.