Smart TV Opt-Outs Fail to Stop Data Tracking, Study Finds

Northeastern University researchers found that opting out of Automatic Content Recognition (ACR) on some smart televisions, including models from Vizio and Samsung, does not consistently prevent viewing data collection, based on 5,943 experiments across 12 smart TVs[1][2][6][8][10]. The comprehensive study analyzed eight operating systems, covering approximately 95% of the U.S. smart TV market, indicating that consumer privacy controls are often ineffective[8][9].

This matters because consumers who believe they have protected their viewing privacy by disabling ACR features may still have their data collected and potentially shared, undermining their control over personal information[1][6][7][10]. Smart TVs have been designed for quick setup, leading to a "constant stream of viewing data" collected via ACR, a practice identified by Consumer Reports as early as 2020[4].

What the records show

The Northeastern University study, published in late 2026, found that disabling ACR had "no observable effect on traffic to the identified ACR endpoint" for Vizio SmartCast OS televisions[1][2][8]. Vizio's proprietary WatchFree+ streaming service exposed the titles of shows or channels through unencrypted DNS queries and TLS server-name fields[6][8][12][13]. This data could be read by internet providers or others on the network path, with no setting available to disable this exposure[6][13].

For Samsung TVs running Tizen OS, traffic "consistent with ACR continued" even after users opted out in various scenarios[6][8][10]. This included all 30 tests of Samsung's built-in streaming service, 41 out of 60 antenna viewing runs, and 18 out of 30 HDMI input runs[6][8][10]. While much of this traffic was encrypted, preventing researchers from confirming the exact content, it was described as "suspicious"[6][7][11].

On Roku OS, the opt-out function did not apply to The Roku Channel, Roku's own streaming service[6][8][13]. TCL televisions running Roku OS disclosed this limitation in their settings menu, but Roku-branded models tested did not[6][13].

In contrast, the study found that opting out of ACR fully suppressed identified tracking traffic on TVs running LG webOS, Sony Google TV, and Amazon Fire TV[6][7][8][13]. A critical finding involved a Supersonic television running VIDAA OS, which transmitted ACR data to Unruly servers "without encryption" using the MQTT protocol[8][12][13]. This unencrypted data included a permanent Client ID, time zone, app name, input source, antenna channel, and an audio fingerprint[8][13]. Researchers also uncovered an authentication flaw on VIDAA's ACR partner server, which allowed access to over 57 million viewing detection results from more than one million TVs during a three-hour collection[8][9][13]. After notification, VIDAA subsequently introduced authentication, but transmissions reportedly remained unencrypted[8][13].

The timeline

Concerns about smart TV data collection emerged years ago. As early as April 6, 2015, reports highlighted that Samsung, LG, and Vizio smart TVs could record and share viewing habits[4][5]. By February 2018, Consumer Reports identified various privacy and security vulnerabilities in smart TVs from major manufacturers like Sony, Samsung, LG, TCL, and Vizio, noting the difficulty for consumers to understand data policies[3][4].

What changed and for whom

For consumers, the study indicates that some ACR opt-out settings, intended to provide privacy, do not function as expected on certain smart TV brands[1][2][6][8][10]. This means their viewing data may still be collected despite attempts to disable tracking[1][6][7][10]. For VIDAA OS, an authentication flaw that exposed millions of viewing records was partially addressed after researchers notified the company, though data transmissions reportedly remained unencrypted[8][13]. Researchers provided a GitHub blocklist of identified tracking endpoints as a potential measure for users to limit exposure[6][8][13]. They also suggest disconnecting the smart TV from the internet and using an external streaming device that does not perform ACR to avoid tracking[6][8][13].

What the subject has said publicly

The provided research does not include public statements from the smart TV manufacturers regarding these findings.

What we could not confirm

The exact content of the encrypted traffic sent by Samsung and Vizio TVs after ACR opt-out could not be definitively determined by researchers[1][6][7][10][11]. It is also unclear whether specific viewing histories from these manufacturers were still being processed, collected, or retained[6][7][10]. The behavior of other Vizio smart TV models not included in the single Vizio TV tested could not be confirmed[1]. The study focused on smart TVs and does not establish the behavior of every external streaming device regarding ACR[13].