Tech News Vizio, Samsung smart TVs seem to ignore tracking opt outs
-
Thread starter
Brownie2019
- Start date
- 3 Replies
- 58 Views
- Featured
Hi Brownie2019, this is a useful study, although “seem” is doing important work in the headline. The researchers found much more than routine background telemetry, but encryption prevented them from proving exactly what Samsung and Vizio transmitted or retained after opt-out.
The original study is reasonably strong: 5,943 controlled experiments, repeated opt-in and opt-out runs, known content, packet capture and traffic-volume comparisons. It also excluded residual traffic below 5% of the corresponding opt-in volume before classifying a run as consistent with ACR.
Its notable results included:
One correction to the article’s wording: those four systems did not necessarily “go completely silent.” They stopped producing traffic that the researchers classified as ACR-related. Smart TVs can still generate update, advertising, app and ordinary telemetry traffic.
Likewise, contacting the same server after opt-out is not by itself proof that viewing fingerprints were still being uploaded. The timing, volume and correlation make the Samsung and Vizio results suspicious, but the researchers could not inspect the encrypted payloads or determine server-side processing. Therefore, this does not yet establish a violation of Vizio’s 2017 FTC settlement.
The separate VIDAA finding is arguably worse from a basic security perspective: its ACR opt-out worked, but the researchers found plaintext ACR messages and, at the time, an unauthenticated broker exposing results from other TVs. Authentication was reportedly added after disclosure, although the transmissions remained unencrypted.
For owners wanting the strongest practical protection:
An external streamer may conduct its own telemetry, of course; this prevents the television from reporting what appears on its panel, not tracking by every service involved.
Walmart’s openly stated advertising rationale for buying Vizio is relevant context—its announcement specifically discusses connecting advertisers with customers at scale—but it is business context, not proof of what these encrypted packets contain. Privacy settings should work without requiring consumers to perform network forensics, and these results give Samsung and Vizio some explaining to do.
Sources
The original study is reasonably strong: 5,943 controlled experiments, repeated opt-in and opt-out runs, known content, packet capture and traffic-volume comparisons. It also excluded residual traffic below 5% of the corresponding opt-in volume before classifying a run as consistent with ACR.
Its notable results included:
- Samsung/Tizen: ACR-like traffic remained in 30/30 first-party streaming runs, 41/60 antenna runs, 18/30 HDMI runs and 6/30 Tubi runs after opt-out.
- Vizio/SmartCast: Opting out produced no observable reduction in traffic to the content-correlated Amazon Kinesis endpoint.
- LG webOS, Sony Google TV, Fire TV and Supersonic VIDAA: no traffic consistent with ACR was observed after opt-out on the tested devices.
One correction to the article’s wording: those four systems did not necessarily “go completely silent.” They stopped producing traffic that the researchers classified as ACR-related. Smart TVs can still generate update, advertising, app and ordinary telemetry traffic.
Likewise, contacting the same server after opt-out is not by itself proof that viewing fingerprints were still being uploaded. The timing, volume and correlation make the Samsung and Vizio results suspicious, but the researchers could not inspect the encrypted payloads or determine server-side processing. Therefore, this does not yet establish a violation of Vizio’s 2017 FTC settlement.
The separate VIDAA finding is arguably worse from a basic security perspective: its ACR opt-out worked, but the researchers found plaintext ACR messages and, at the time, an unauthenticated broker exposing results from other TVs. Authentication was reportedly added after disclosure, although the transmissions remained unencrypted.
For owners wanting the strongest practical protection:
- Disable ACR or settings labelled Viewing Information, Content Recognition, Smart Interactivity or similar.
- Recheck those settings after a factory reset or substantial firmware update.
- If using an external streamer, disconnect the TV itself from the network. Merely switching to HDMI is insufficient when some TVs recognize HDMI content.
- On a connected TV, place it on an isolated guest/IoT network with no access to personal devices.
- Use endpoint blocklists cautiously. The study’s Vizio entry involves shared Amazon Kinesis infrastructure, so blocking the entire service may cause collateral breakage and still does not guarantee that every tracking route is covered.
An external streamer may conduct its own telemetry, of course; this prevents the television from reporting what appears on its panel, not tracking by every service involved.
Walmart’s openly stated advertising rationale for buying Vizio is relevant context—its announcement specifically discusses connecting advertisers with customers at scale—but it is business context, not proof of what these encrypted packets contain. Privacy settings should work without requiring consumers to perform network forensics, and these results give Samsung and Vizio some explaining to do.
Sources
Join the discussion
Write your reply below. You'll create a free account or log in before it's posted.
Recently browsing
Members who viewed this thread in the last 5 minutes
You may also like...
-
-
-
-
-
Security Advisory Your car’s app could be telling Big Tech who you are and where you go