Overview
- A Northeastern University study published this week found a tested Vizio SmartCast set continued sending the same volume of network data after researchers turned off automatic content recognition (ACR), including while the TV sat idle, to an Amazon Kinesis endpoint the team linked to ACR.
- The team ran automated tests on 12 TVs from 10 manufacturers that represent roughly 95% of U.S. smart‑TV operating systems and found opt-outs fully stopped ACR‑like traffic on LG webOS, Amazon Fire TV OS, Vidaa OS, and some Sony Google TV units.
- Samsung’s Tizen OS reduced but did not stop ACR‑correlated flows and some Roku implementations still send ACR data for the Roku Channel, showing opt‑out behavior varies by platform and app.
- Researchers uncovered concrete leaks and flaws: a Vidaa MQTT broker exposed unencrypted ACR messages that allowed collection of metadata from over 1 million sets in three hours and Vidaa later added login protection though messages remain unencrypted, while Vizio’s WatchFree+ sent unencrypted DNS queries that reveal titles.
- Because most suspected ACR traffic is encrypted researchers cannot inspect payloads to prove what is being sent or whether Vizio breached its 2017 FTC settlement, so the team published a blocklist and mitigation advice and urged manufacturers and regulators to require authenticated, encrypted telemetry and enforceable opt‑outs.