Your “no” means nothing: Vizio smart TVs are ignoring tracking opt-outs
Vizio’s SmartCast OS sent ACR-pattern traffic even when the TV sat idle on its home screen – in every run.
Vizio smart TVs track you even if you opt out. By Cybernews / Shutterstock.
Follow us
- Northeastern researchers found Vizio TVs kept sending tracking-related traffic after users opted out.
- The study tested 12 smart TVs from 10 makers, covering systems used by most US smart TVs.
- Four other platforms stopped sending similar data after users disabled automatic content recognition.
- Researchers could not inspect Vizio’s encrypted traffic, so they did not conclude it broke the 2017 settlement.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
In 2017, Vizio had to begin asking its smart TV owners for permission to track the content on their screens. It did – but a new study has found that the company’s devices ignore tracking opt-outs and continue to send data.
Nine years ago, Vizio paid more than $2 million to settle charges that its TVs were tracking what was playing on 11 million screens back in 2017. The company also agreed to begin asking TV owners for permission to collect their viewing data.
But a new study by researchers at Northeastern University, called “Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition,” has found that opting out of automatic content recognition (ACR) doesn’t actually change much in Vizio’s case.
“Vizio's SmartCast OS sent ACR-pattern traffic even when the TV sat idle on its home screen, in every run,” the researchers found.
“The opt-out setting had no observable effect on traffic to the identified ACR endpoint,” they add in the research paper.
In total, the study authors tested 12 smart TVs from 10 manufacturers, including Samsung, Roku, Sony, and others. Together, these devices run the eight operating systems behind roughly 95% of smart TVs in the US.
Vizio SmartCast’s results were actually the worst – the OS seemed not to care at all about the opt-out.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
By comparison, four other platforms – LG’s webOS, Amazon’s Fire TV, VIDAA, and Sony’s Google TV – fully went quiet after opting out and stopped sending ACR-like traffic.
ACR abuses all around
ACR is built into most smart TVs. Officially, it identifies what’s playing, whether it comes from an app, an antenna, a game console, or a cable box.
But little is publicly known about how ACR behaves in practice, and the Federal Trade Commission accused Vizio in 2017 of installing this sort of software on its TVs without consumers’ knowledge or consent.
In addition, Vizio covertly collected specific demographic information, such as sex, age, income, marital status, household size, education level, home ownership, and household value. The company then sold this data to third parties.
The one limitation in this particular case is that the researchers couldn’t see what was inside the Vizio smart TVs because the company’s web traffic is encrypted. That’s why it isn’t factual to say Vizio is breaking its FTC settlement.
Abusing ACR has become a pretty common practice among smart TV manufacturers lately. For example, LG smart TVs can listen in on voice commands, gather location data, and scan your home for other connected devices.
Last week, one reverse engineer accused Samsung of secretly spying on users by collecting huge amounts of data from built-in microphones, connected devices, and even AI they didn’t know about.
