Vizio and Samsung smart TVs kept sending data consistent with viewing surveillance after owners switched the tracking setting off, according to a Northeastern University study published in early November. The researchers tested 12 televisions from 10 manufacturers, covering the eight operating systems behind roughly 95 percent of U.S. smart TVs. Four of those systems went quiet after an opt-out, which makes the two holdouts stand out.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The technology at issue is automatic content recognition, or ACR, which identifies what is on screen so the maker can sell or analyze viewing habits. Every maker offers a menu toggle for it. The study asked whether the toggle works.
Vizio’s Amazon Kinesis traffic and the 2017 settlement
The Northeastern team ran ten viewing scenarios on each TV, including antenna broadcasts, first-party and third-party streaming, screen mirroring and HDMI-connected devices, for 5,943 automated experiments with ACR on and off. Malwarebytes summarized the results: Vizio sets kept sending apparent ACR traffic for first-party streaming and antenna viewing after the opt-out, and sent the same pattern while sitting idle.
Much of that traffic went to an endpoint on Amazon Kinesis, a data ingestion service. The researchers wrote that the opt-out setting has no observable effect on traffic sent to the endpoint. Because the payload is encrypted, they could not say what the traffic contains and could not confirm any breach of Vizio’s earlier legal commitments.
Those commitments date to 2017, when Vizio agreed to pay $2.2 million to settle Federal Trade Commission and New Jersey charges that it had collected viewing histories from 11 million smart televisions without consent. The settlement required Vizio to honor viewer choices about such collection. The FTC’s business guidance on the case, What Vizio was doing behind the TV screen, lays out the original conduct. Walmart bought Vizio in 2024 for $2.3 billion.
Why the finding matters commercially is plain from the ownership trail. When Walmart bought Vizio, a Walmart statement said that pairing it with Walmart Connect, the retailer’s advertising business, would be impactful, and viewing data is the raw material for that kind of targeting. The study’s method was designed to be repeatable: each TV was tested with the setting on and off across the same ten scenarios, so differences can be attributed to the opt-out and not to the content on screen.
Samsung’s Tizen sets and the 60 percent HDMI figure
Samsung’s Tizen sets behaved differently but not better. After opt-out, built-in streaming still produced ACR-consistent traffic in all 30 runs on the study’s Watching the Watchers project page, and the page reports that the same pattern appeared in 41 of 60 antenna runs and 18 of 30 HDMI runs. Malwarebytes expresses the HDMI result as 60 percent of runs.
Samsung’s system appears to recognize content mainly by what is shown. ACR traffic vanished on a black screen, while removing the sound changed nothing. Netflix and YouTube sessions leaked in small shares, about 7 percent and 10 percent of runs and Tubi TV about 20 percent, which matches 6 of 30 Tubi runs on the project page.
The limits of the method deserve plain statement. Researchers watched network traffic and could not read the encrypted contents, so the label consistent with ACR is an inference from timing, destination and volume, not a captured list of viewed programs. Malwarebytes also flags an inconsistency in the VIDAA findings, which went silent after opt-out yet also sent ACR data in the clear, and the coverage does not reconcile the two. The Northeastern team’s own page names the opt-out as the variable it tested, and its results for Vizio and Samsung are what make the privacy question concrete.
The four systems that honored the switch, and VIDAA’s twist
LG’s webOS, Sony’s Google TV, Amazon’s Fire TV and Supersonic’s VIDAA all went silent after the opt-out, so the setting appeared to work on them. VIDAA complicates the picture: it transmitted ACR data without encryption, and its servers required no login at test time, leaving more than 57 million detection results from other households’ TVs reachable.
Vizio’s free WatchFree+ service raised a separate problem. The study found it sends the names of shows and channels in unencrypted queries to a service provider whether or not ACR is on, with no way to disable it. No responses from Vizio, Samsung or Walmart appeared in the coverage reviewed on Nov. 7.
For households deciding what to do before the holidays, the sorting is simple enough. The four systems that honored the switch are webOS, Fire TV, Sony’s Google TV and VIDAA, so an owner of one of those sets has some evidence the menu does what it says. Owners of Vizio and Samsung sets have less, and the study suggests the toggle alone may not be enough.
The researchers’ practical advice is blunt: disconnect the set from the internet and use an external streaming device, or block known ACR endpoints at the router with the blocklist the team published on GitHub. Whether either company changes the behavior, or says what the traffic carries, is the open question.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
