cyber.hendryadrian.com
Security Report · malwarebytes.com

Study Finds Vizio and Samsung TVs May Send Viewing Data Despite ACR Opt-Outs

· Original article ↗

Summary

A Northeastern University study found Vizio and Samsung TVs appeared to send ACR-related traffic after opt-out. Researchers also found unencrypted VIDAA detection results accessible without login, though encryption limited verification of other traffic.

Key points

  • Researchers tested 12 smart TVs from 10 manufacturers across eight operating systems in more than 5,000 automated sessions. Because much ACR traffic was encrypted, they inferred its purpose from traffic characteristics rather than inspecting payloads.
  • Vizio showed no observable drop in traffic consistent with ACR after opt-out during first-party streaming and antenna-TV viewing; the study reported no ACR traffic for third-party streaming data.
  • After opt-out, Samsung traffic appeared consistent with ACR in 7% of Netflix runs, 10% of YouTube runs, 20% of Tubi runs, and 60% of HDMI sessions; the study also observed it in first-party streaming sessions.
  • Four tested operating systems—LG webOS, Sony Google TV, Amazon Fire TV OS, and Supersonic VIDAA OS—appeared to go silent after ACR was turned off.
  • Supersonic VIDAA sent ACR data unencrypted to servers that also responded without encryption. The researchers said more than 57 million detection results from other TVs were accessible because the servers did not require a login at test time.
  • The researchers reported that Vizio’s WatchFree+ service transmitted watched show or channel titles in unencrypted communications, with no way to turn this off.
  • Suggested protections include disconnecting the TV from the internet and using an external streaming device, or blocking known ACR endpoints.

Article Details

Publisher
Malwarebytes
Report Period
Publication month: November 2026; study period not disclosed
Scope
ACR opt-out behavior across 12 smart TVs from 10 manufacturers, covering 8 operating systems said to represent roughly 95% of US smart TVs.
Sample Size
Over 5,000 automated sessions; 10 viewing scenarios per operating system.
Key Statistics
  • Only 4 of the 8 tested smart TV operating systems appeared to completely honor ACR opt-out.
  • Vizio continued sending 100% of the observed traffic during first-party streaming and antenna-TV viewing after opt-out; researchers could not confirm the encrypted payload was ACR data.
  • After opt-out, Samsung showed traffic described as consistent with ACR in 7% of Netflix runs, 10% of YouTube runs, and 20% of Tubi TV runs; HDMI sessions showed it 60% of the time.
  • More than 57 million ACR detection results from other people's TVs were accessible through Supersonic's VIDAA OS servers during the test, which the article says did not require a login.
  • 82% of US households had a smart TV as of the previous year, according to the article.
Recommendations
  • Select ACR opt-out on WebOS (LG), Fire TV OS, Google TV on Sony, or VIDAA OS on Supersonic, which appeared to honor opt-out in the study.
  • Disconnect the TV from the internet and use an external streaming device to prevent the TV from sending data.
  • Use a router blocklist containing known ACR endpoints to block TV traffic to those endpoints.

Vendors

AmazonFour smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.LGFour smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.SamsungVizio and Samsung TVs both appeared to send this data even when researchers opted out of ACR.SonyFour smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.SupersonicFour smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.VizioVizio and Samsung TVs both appeared to send this data even when researchers opted out of ACR.

Products

FireTV OSFour smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.Google TV OSFour smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.KinesisThe Vizio TV that the researchers tested sent traffic to Kinesis, an Amazon-run data ingestion service that the manufacturer uses to analyze data from its smart TVs.NetflixAfter opt-out, the Samsung TV’s Tizen OS seemed to send ACR-related traffic about Netflix in 7% of runs, YouTube in 10% of runs, and Tubi TV in 20%.Tizen OSAfter opt-out, the Samsung TV’s Tizen OS seemed to send ACR-related traffic about Netflix in 7% of runs, YouTube in 10% of runs, and Tubi TV in 20%.Tubi TVAfter opt-out, the Samsung TV’s Tizen OS seemed to send ACR-related traffic about Netflix in 7% of runs, YouTube in 10% of runs, and Tubi TV in 20%.VIDAA OSFour smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.Walmart ConnectThe retailer also runs Walmart Connect, a retail media business that uses its customers’ data to help other businesses target them with ads.WatchFree+Vizio’s first-party streaming service WatchFree+ also dropped unencrypted titles of any show or channel being watched into online communications with the free TV service provider.webOSFour smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.YouTubeAfter opt-out, the Samsung TV’s Tizen OS seemed to send ACR-related traffic about Netflix in 7% of runs, YouTube in 10% of runs, and Tubi TV in 20%.

Related Articles