// ARS TECHNICA — MOBILE & WEB
Does opting out of smart TV tracking work? Research finds “suspicious” traffic.
OS operators throwing out that data is “unlikely,” research author tells Ars.
Smart TVs running operating systems from Samsung, Vizio, and Roku continue sending data to automatic content recognition (ACR) endpoints after users opt out of tracking in the devices’ settings, according to research published on Monday. The paper from Northeastern University researchers points to potential privacy violations from some of the biggest TV brands.
ACR captures video screenshots or audio clips from smart TVs and sends the data to remote servers, where it’s used for things like measuring content viewership and serving targeted ads.
The paper, “Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition,” examined eight smart TV OSes across 12 smart TVs from 10 manufacturers (Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio, and Westinghouse) to examine when smart TVs use ACR and how effective opting out of user tracking is.
Regarding the relatively small number of TVs studied, Ilgar Mammadov, the report’s lead author and a research assistant at Northeastern, told Ars Technica:
Together, the smart TV operating systems we tested cover approximately 95 percent of those used in the United States. Because ACR is implemented at the OS level, we expect that adding more TVs running the same operating systems would largely repeat our existing findings rather than reveal new behavior.
The researchers made OS-specific control scripts and delivered them over Wi-Fi, while Mon(IoT)r and SPHERE Research Infrastructure software captured network traffic coming to and from each TV. The research included identifying each OS’s ACR endpoint. Some of the OSes, including Samsung’s Tizen, “expose self-disclosing ACR domains containing keywords such as ‘acr’ and ACR provider names,” the paper said. The researchers conducted 5,943 controlled experiments for the report.
The report’s findings have their limits, of course. Mammadov noted that each ACR provider and OS studied implemented ACR differently, adding:
They differed in the scenarios that trigger ACR, in how effective the opt-out is, and in the ACR modalities used. We would therefore expect TVs using ACR providers outside our study to behave differently as well, and our results should not be generalized to them. That said, our methodology is designed to be reusable.
The researchers found that the TVs running Samsung Tizen, Vizio OS (which the report refers to by its former name, SmartCast), and Roku OS continued to send network traffic to the respective ACR endpoints when user tracking was disabled in settings and when tested for specific usage scenarios, including using a first-party streaming app.