You may or may not be aware of a major privacy controversy that’s erupted in the smart TV space. Recently, a number of YouTube channels began calling out LG, accusing the company of unethically gathering audio — even when your TV is off — along with your location, and data about devices on your Wi-Fi network. LG has stringently denied any wrongdoing, for instance insisting that its TVs don’t record any audio until a wake word for voice commands is detected, just like smart speakers. As I write this, however, it doesn’t feel like the controversy is about to die down.
All this has renewed attention to general privacy issues with TVs. Yes, there can be significant tracking going on. It’s unlikely to expose or exploit your personal info in any dangerous way — but you should know what activity is going on. The potential for abuse is there, and you have a right to be informed.
Automatic Content Recognition (ACR)
How is this legal?
This is the technology you should most be concerned about. It’s purely opt-in these days — thanks in part to a legal case involving Vizio — but it’s insidious from the get-go, since companies give it euphemistic names, and try to spin it as “personalizing” your experience. There is personalization going on, but mostly (if not exclusively) in the form of the ads you see, rather than serving up better movie and show recommendations.
The main goal of ACR is collecting anonymized data to sell to brokers and marketers. As the name implies, it’s constantly scanning onscreen content in order to gauge your habits. While that’s not dissimilar from the cookie-based tracking on many websites, ACR goes a step further, analyzing content regardless of its input source. As far as ACR systems are concerned, your cable box, media streamer, Blu-ray player, and game console are all fair game. Hypothetically, watching a private video of your child’s first birthday party might lead to seeing ads for diapers or daycare facilities.
This does help subsidize the low prices of some TVs, but still — during setup, avoid toggling on any ACR-like “features.” If you think you might have inadvertently enabled ACR in the past, look up instructions on how to disable it for your particular TV platform. I wouldn’t be surprised if ACR is completely outlawed in the future.
Advertising IDs
No ACR necessary (sometimes)
Just about every TV arrives with an anonymized advertising ID. As you make your way through native apps, activity data is linked to this ID, including clicks, searches, and watch times. This data may be used both for sale to outside parties and for internal purposes. Without ACR, this is less worrisome, since it can’t snoop on things like your DVDs or VHS tapes — but if you’re uncomfortable with ad cookies on websites, this should bother you too. There are often Settings options to limit tracking and reset your ad ID, so be sure to take advantage of them.
A threat I should touch on for both ad IDs and ACR is the concept of fingerprinting. While it’s true that your exact identity is anonymized, it’s possible to track a specific person around the internet by identifying recurring traits — their fingerprints. Chances are, there are only so many Samsung TV owners with a Chicago IP address that are into EUCs and learning Python coding. This data is mostly being exploited to sell you products and services, but there is a risk of your fingerprint being linked to your real-world identity, and/or slipping into the hands of hackers.
App-based profiles
With or without a user account
I doubt you’re going to be surprised by this one, but every app you sign in to is tracking activity for its respective creator. You actually need this, to a degree — without it, your favorite service wouldn’t be able to recommend horror and documentaries instead of romcoms and reality shows. Yet you’re also being targeted for ads, and that means exploiting some of the data an app has access to. Note that while outside advertisers shouldn’t have access to your real-world identity, a service provider does as long as you’re providing your name and billing info. Be sure they’re not misusing it.
Actually, tracking is also going on in free apps that don’t require you to sign in at all, such as Tubi and Pluto TV. These can still detect things like your IP address, which determines the ads you see and the regional content you have access to. That regional tracking becomes obvious if you travel outside your home country. An app like Tubi might suddenly show a different library; apps like Hulu and YouTube TV simply stop working outside US territory, no matter if you normally live in an American city and pay with an American credit card. The only way around that is a VPN tunnel.
