TV Opt-Out Study: Vizio Ignores It, Samsung and Roku Leak Data

A Northeastern University study of 12 smart TVs from 10 manufacturers found that opting out of automatic content recognition (ACR) tracking works on most platforms — but Vizio, Samsung and Roku TVs kept transmitting data afterward. The Vizio set, owned by Walmart, continued sending ACR-correlated traffic as if no opt-out had occurred at all.

Researchers led by professor David Choffnes used Northeastern's Mon(IoT)r software and SPHERE testbeds to capture and analyze network traffic from each set. They could not read the traffic directly. Almost all of it was encrypted, so the team inferred ACR activity from where each TV sent its data.

What did the study test?

ACR systems sample the audio or video playing on a TV, convert it into digital fingerprints, and match those against a database to identify what a household watches. TV makers use the results for recommendations, viewing metrics, and targeted advertising.

The tested sets included:

• Samsung QN32Q60DAF (Tizen OS)
• LG 32LR655BPUA (webOS)
• Roku 32R3B5 and TCL 32S350R (Roku OS)
• Sony K-43S20M2 (Google TV)
• Vizio VHD32M-0810 (Vizio OS)
• Fire TV HD32N200A (Fire OS)
• Supersonic SC-1520VTV (Vidaa OS)
• Westinghouse WX24HX2800 (Xumo OS)
• Hisense 32A4K, TCL 32S250G and Sony KD32W830K (Google TV, listed with no ACR)

The team played content from first-party services like LG Channels and The Roku Channel, from Netflix and YouTube, over HDMI, over an antenna, and via screen mirroring. Testing order was randomized to prevent earlier experiments from biasing later ones.

Where does tracking actually happen?

Several sets showed no ACR activity at all: the Westinghouse Xumo TV and three of the four Google TV sets, though one Sony Google TV did have ACR enabled. Every TV with ACR traffic scanned over-the-air broadcasts. All except Google TV and Amazon scanned first-party streaming services. Netflix and YouTube triggered almost no ACR, apart from a small amount on webOS that vanished after opt-out. Screen mirroring stayed clean on all sets except the Vidaa TV.

To distinguish audio from video fingerprinting, the researchers played content with both, audio alone, and video alone, then watched for traffic changes. Tizen likely uses video fingerprinting. webOS and Vidaa use audio. Fire OS, Google TV, Roku OS and Vizio OS combine both.

Which opt-outs actually work?

Opting out fully stopped suspected ACR traffic on webOS, Fire OS, Vidaa OS and the Sony Google TV. Tizen traffic decreased but persisted over antenna, first-party streaming and HDMI. On both Roku OS sets, ACR still applied to The Roku Channel app. TCL discloses that limitation in its menus; the Roku-branded set does not. The Vizio set showed no change whatsoever — notable given Vizio settled an FTC lawsuit over consumer data gathering in 2017. Walmart did not respond to a request for comment before publication.

The encrypted traffic forces a caveat. The paper states: "We interpret the continued presence of traffic consistent with ACR tracking after opt-out as suspicious, though we cannot confirm the contents of the network traffic (due to encryption), nor whether data is processed or retained on the server side." Timing does not help consumers either; Choffnes said a factory-reset retest of the Vizio and Fire TV sets produced unchanged results.

What vulnerability did the researchers find?

During the study, the team found that Vidaa OS exposed unencrypted information through an MQTT broker — an intermediary between Vidaa OS and Unruly, a video ad platform. The flaw let them receive ACR results belonging to other Vidaa users. Each message carried a permanent, non-resettable Client ID, plus time zone, app name, input type, antenna channel and an audio fingerprint. In three hours, they collected data from more than 1 million unique TVs. Vidaa confirmed the vulnerability and now requires a login on the server. Messages remain unencrypted.

How can viewers limit tracking?

The paper's simplest recommendation is to disconnect the TV from the internet and use a streaming device without ACR. For built-in apps, it suggests webOS, Fire OS, Google TV on Sony and Vidaa OS, with every opt-out applied. The researchers also published a blocklist of endpoints that tools like Pi-hole can restrict without breaking the set.

They call on manufacturers to disclose every input ACR watches, include that in privacy policies, and authenticate and encrypt all ACR traffic. Regulators, they argue, must verify that opt-out agreements work in full. Until manufacturers confirm what their sets send, buyers cannot verify any privacy claim on their own.