Samsung and Vizio Smart TVs Still Send Tracking-Like Traffic After Users Turn It Off

Samsung and Vizio smart TVs kept sending traffic consistent with automatic content recognition (ACR) even after researchers turned off the feature in the privacy settings.

The findings raise questions about whether smart TV privacy controls stop viewing-related data flows, while also clarifying an important limit. Encrypted traffic prevented researchers from confirming exactly what these devices transmitted.

The Watching the Watchers study examined 12 commercial televisions from ten manufacturers across eight operating systems representing roughly 95% of the U.S. smart TV market.

Researchers ran 5,943 automated experiments, comparing network activity with automatic content recognition enabled and disabled.

Samsung TV Tracking After Users Turn It Off

ACR identifies screen content using short audio or video samples, or digital fingerprints derived from them. Providers compare these signals against known content to identify programs. Viewing records can support audience measurement, targeted advertising, and data sharing.

Samsung, Vizio TVs Continue Tracking After Opt-Out

The feature can monitor content beyond streaming apps, including antenna broadcasts and HDMI devices. Earlier Cyber Security News coverage of smart TV tracking described how ACR can operate even when a television serves mainly as an external display.

For the new analysis, researchers captured network packets. At the same time, televisions played controlled content through antenna inputs, HDMI connections, streaming services, and screen mirroring. Each viewing scenario was repeated with ACR enabled and after opting out.

Samsung’s Tizen television showed ACR-consistent traffic in all 30 opted-out tests involving its built-in streaming service. Similar traffic appeared in 41 of 60 antenna tests, 18 of 30 HDMI tests, and six of 30 Tubi tests.

Vizio’s SmartCast television continued contacting its identified Amazon Kinesis ACR endpoint in every opted-out run for the affected scenarios. Researchers observed no decrease when the feature was disabled.

These findings do not prove that Samsung or Vizio continued recording viewing histories. Most ACR traffic was encrypted, so researchers relied on destinations, timing, volume, and other network patterns. They could not determine what information reached company servers or whether companies stored it.

Opt-outs worked in the tested LG webOS, Sony Google TV, Amazon Fire TV, and VIDAA systems. Roku’s setting did not cover its own streaming service, a restriction disclosed on the tested TCL television but not the Roku-branded model.

The research paper also describes risks beyond uncertain encrypted traffic. VIDAA transmitted ACR messages over MQTT without encryption, exposing device identifiers, app names, input sources, and audio fingerprints.

An unauthenticated server exposed more than 57 million detection results linked to over one million televisions. VIDAA subsequently added login requirements, according to the researchers, but transmissions remained unencrypted.

Separately, Vizio’s WatchFree+ service placed readable program or channel information in network names visible through DNS requests and TLS server-name information. This could reveal viewing choices to network observers even with ACR disabled.

Researchers recommend disconnecting the television from the internet or blocking identified ACR endpoints. Their published blocklist did not disrupt viewing in tested scenarios, but it does not stop the WatchFree+ title leak.

Smart TV risks also extend beyond ACR. Separate research into proxy-enabled television apps highlights why app permissions and bundled services deserve scrutiny. These findings apply to the tested devices and firmware, not every television from these brands.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Samsung and Vizio Smart TVs Still Send Tracking-Like Traffic After Users Turn It Off appeared first on Cyber Security News.