Opted-Out of TV Surveillance? Think Again.

Have you ever been skeptical that “opt-out” toggles don’t work? New research from Northeastern University shows that you may not be a conspiracy theorist after all–at least not if you own a smart TV.  

Northeastern University researchers recently released a paper, Watching the Watchers, that revealed major privacy concerns with automatic content recognition (ACR) software in top smart TV brands and operating systems. TVs with VIDAA and SmartCast operating systems sent unencrypted ACR and viewing data that allowed researchers to see sensitive user information. Meanwhile Vizio and Samsung TVs showed traffic consistent with ACR data transmission even after the researchers opted out. 

A follow up hackathon co-hosted by FULU, Northeastern University, Ludlow Institute, and CodeDay sought to replicate and expand on these findings. FULU’s new report, What Smart TVs Send, documents the finding of three hackathon teams.

One participant found that LG TVs were transmitting location data including address, coordinates, and designated market area. This research contributes to the growing evidence that our TVs know more than we may want about us, and that we should be able to modify them to make sure they stop.

Watching the Watchers: Northeastern University’s Findings

ACR works by fingerprinting, or assigning a unique code, to visual or audio clips that are playing on the TV. Those “fingerprints” are sent to servers and compared against a broader database to determine what is being watched. TV manufacturers use this data to build advertising profiles with a household’s suspected race, political affiliation, and other personal information. Currently, more than 4 in 5 households in the United States have a smart TV with ACR capabilities. Despite this, researchers are still learning about what ACR collects. 

Watching the Watchers highlighted limitations on controlling our TVs. The eight TV operating systems cover an estimated 95% of the U.S. market, and all tracked and transmitted ACR data. 

Northeastern researchers found that Vizio and Supersonic TVs sent unencrypted ACR data. Anyone who could access network traffic on these TVs could see sensitive information such as the viewer's  religion, health, and political leanings. 

In an egregious invasion of privacy, researchers found that Vizio and Samsung TVs sent ACR traffic in every test run–even after ACR was turned off. If this behavior extended to all consumer devices, these companies would have both ignored device owners and misled them that they had a choice in the matter. Seeing this activity from Vizio is particularly shocking given the company faced an FTC complaint in 2017 for installing ACR software without consumers knowledge or consent.

Researchers were also able to gain access to the ACR server used by TVs running VIDAA OS, such as those manufactured by Hisense and Toshiba, without providing a password. In the three hours that they had access, they were able to collect more than 57 million ACR detection results from more than a million TVs running VIDAA OS around the world. VIDAA has since added password protection to the server, but viewing data continues to flow to it in plain text.

Still on the Watch: Hackathon Participants Continue Investigation  

Over the course of the 24-hour hackathon on October 19 and 20, more than 40 students and coders sought to confirm and expand upon Northeastern’s findings. The lead researcher for the Northeastern report, Ilgar Mammadov, explained this was why continued ACR research is needed. “Over time it is possible to change the ACR behavior of smart TVs and this hackathon will bring new findings about ACR implementation on other TVs or how [ACR has] changed over time.”

A team testing a Vizio TV confirmed the TV continued to send data to Amazon Kinesis–an ACR analytics service–even after turning on Vizio’s “Do Not Sell” feature.

One participant even rooted an LG TV and confirmed that it used audio fingerprinting to send data back to the company’s ACR subsidiary, Alphonso. Along with the audio fingerprints, LG also sent device identifiers and location information including address, coordinates, and designated market area.

In their final presentations, participants cautioned their findings could change with software updates. 

Putting an End to Peeping TVs

Technology that disrespects a user’s choices undermines ownership. This type of research is important, but most normies (myself included) don’t know how to hack into a TV to see if it honors data collection choices. The fact of the matter is, we shouldn't have to. 

Tools such as Clean Your TV, TV Detox, and Dumb TV are exciting developments for device owners that run Android or Fire TV operating systems and want to take back control of their living rooms. But while these tools disable ACR, they stop short of fully removing the software. And consumers with devices that run other OSs are still stuck hoping that their opt out request is honored. 

You could, of course, not connect your TV to the internet. But that means you don’t get access to the smart features you paid for. Without the ability to legally strip and share the removal of tracking technology from TVs, consumers are forced into a tradeoff they shouldn’t have to make. 

Sec. 1201 of the Digital Millennium Copyright Act currently prevents people from bypassing digital locks on the devices they own which ultimately makes it a copyright crime for users to fully remove ACR technology and share those methods with others. We are currently petitioning the Copyright Office in the Library of Congress to create an exemption for individuals wanting to remove this invasive software. Beyond exemptions for personal use, FULU is working to reform Sec. 1201 because we believe people should be able to control their devices and share how they regained that control with others. 

Ultimately, owners deserve to control their devices, including where their data goes or to opt-out of data collection entirely.