Recent research reveals that smart TVs from Samsung and Vizio continue to send traffic suggestive of Automatic Content Recognition (ACR) even when the feature is disabled. This challenges assurances given to users about privacy controls and raises concerns over what data might still be flowing from their devices. The findings come from a wide-ranging experiment covering dozens of popular TV models.
What’s ACR & Why It Matters
Automatic Content Recognition (ACR) is a technology embedded in many modern smart TVs that can identify what’s being watched—whether via HDMI, antenna, streaming apps, or even mirrored screens—by sampling audio, video, or content fingerprints. This data supports targeted ads, audience measurement, and content tracking across platforms.
The Experiment & Key Findings
A team conducted the Watching the Watchers study, running nearly 6,000 automated experiments on 12 different TV brands spanning eight operating systems—representing around 95 percent of the U.S. smart TV market. Each test was performed with ACR first enabled, then disabled in the TV’s privacy settings, while TVs displayed controlled content through various inputs. Networks were monitored all the while. When Samsung’s Tizen TVs were tested, they showed patterns consistent with ACR in all 30 tests involving their native streaming service—even when the feature was turned off. In tests with antenna, HDMI, or third-party apps like Tubi, Samsung still exhibited ACR-like traffic in many cases. Vizio’s SmartCast TVs kept contacting their known ACR endpoint in every tested scenario after opting out, showing no reduction in data traffic.
Encrypted Signals & Limitations
Because much of the network traffic is encrypted, researchers could not definitively prove that content history or sensitive data was being collected or stored. Rather, they inferred ongoing tracking from consistent patterns in volume, timing, and destination of the traffic. In contrast, manufacturers like LG (webOS) and Sony (Google TV) appeared to succeed in preventing ACR-style transmissions when opt-out was activated. Roku’s settings were more complex: in some models, the opt-out didn’t cover Roku’s own streaming service, a nuance disclosed in certain TCL TVs but not universally.
Other Privacy Risks Discovered
Beyond encrypted traffic, the study flagged other notable vulnerabilities. VIDAA, for example, sent ACR messages over unencrypted protocols that exposed device identifiers, input sources, and audio fingerprints. One server held over 57 million detection records tied to over one million TVs; after this was revealed, a login requirement was added, yet messages remained unencrypted. In Vizio’s WatchFree+ service, readable program or channel details appeared in DNS or TLS server‐name fields—meaning even non-experts monitoring a network could see what a viewer is watching, despite ACR turned off.
What Users & Brands Can Do
Researchers suggest disconnecting smart TVs from the internet or blocking identified ACR endpoints using network tools. Their curated blocklist did not disrupt viewing in tested setups, though it doesn’t protect against metadata leaks like those found in WatchFree+. The findings serve as a warning for manufacturers to improve transparency and control—especially around encrypted vs. unencrypted data flows—and for users to scrutinize privacy settings.
Why It Matters: With smart TVs increasingly becoming central in living rooms, the discovery that Samsung and Vizio still transmit ACR-type traffic even after opt-out undermines trust in how privacy settings actually work. This suggests that opting out may be more cosmetic than functional on some models. Going forward, what we watch for is stronger regulatory oversight, more rigorous enforcement of encryption standards, and clearer disclosures from manufacturers about what data is collected, under what settings, and how it’s secured. Consumers may need ever more control—or to invest in blocking tools—to genuinely protect their viewing privacy.
