Samsung and LG’s ACR Surveillance Technology Raises Privacy Concerns in Smart TVs

• Samsung and LG Smart TVs use a surveillance tool that tracks screen content to monitor viewing habits.
• The Automatic Content Recognition technology also impacts screen content shown when the TV is used as an external display.
• Researchers say this tool is used differently in the U.S. than in the U.K., possibly due to data privacy laws.

Smart TVs from leading manufacturers Samsung and LG employ Automatic Content Recognition (ACR) technology, which is a tracking tool embedded within the TV's operating system, researchers have unveiled in a new study.

ACR enables these companies to monitor viewing habits by capturing content displayed on the screen and matching it against a comprehensive content library, according to researchers from University College London, University of California, Davis, and Universidad Carlos III de Madrid.

ACR technology, reminiscent of the Shazam song-identification tool, can continue operating even when Smart TVs serve as external displays via HDMI connections. This capability extends its reach to content from gaming consoles and laptops, potentially impacting user privacy.

The study highlights a stark contrast in ACR activity between the U.S. and U.K. markets. In the U.S., ACR remains active during free ad-supported streaming TV (FAST) viewing, whereas it is disabled in the U.K., likely due to differing jurisdictional data privacy laws.

While the research indicates that opting out of ACR tracking does halt related network traffic, the process is cumbersome for users, requiring navigation through various settings with no universal off-switch. Additionally, it's unclear if these privacy controls function as intended.

The study also reveals disparate approaches by Samsung and LG regarding ACR domain use. Samsung connects to multiple ACR domains, while LG utilizes a single domain managed by Alphonso, linked to LG Ad Solutions.

The research team plans to further investigate the intricacies of ACR network traffic, including its relationship with personalized advertising, by employing advanced man-in-the-middle (MITM) techniques. They have made their code and data from the black-box audit available for public scrutiny.

Historically, ACR tracking has stirred privacy debates. Notably, Vizio faced a lawsuit from the FTC for selling customer data derived from ACR tracking, leading to a settlement in 2017 that mandated clearer disclosures and opt-out mechanisms.

In other recent news, Mozilla faces allegations that a feature in Firefox known as “Privacy-Preserving Attribution” (PPA) facilitates user tracking without explicit consent, and Ford's new patent to collect driver data, such as car conversations, raised privacy concerns among experts and customers.