Overview
- A Northeastern University lab study published this week tested 12 TVs across 10 manufacturers and found Vizio and Samsung sets continued to send network traffic consistent with automatic content recognition after researchers opted out.
- The researchers identified concrete privacy failures: Vizio’s WatchFree+ leaked unencrypted show and channel names via DNS lookups and Vidaa OS exposed an MQTT broker that allowed collection of many ACR detection messages before access controls were added.
- Most suspected ACR traffic was encrypted so the team could not read payloads and therefore could not definitively prove that the remaining traffic after opt-out contained viewing fingerprints or breached prior legal commitments.
- The paper gives practical fixes for users, including disconnecting smart TVs from the internet, using separate streaming devices, and applying a published blocklist of ACR endpoints that did not break TVs in lab tests.
- The findings revive enforcement and legal scrutiny—Vizio settled an FTC case in 2017 over undisclosed tracking and consumer advocates in Portugal have already sought court review—so regulators and lawyers may now probe whether opt-outs are being honored.