Study Finds Smart TV ACR Opt-Out Failures and 57 Million Viewing Records Exposed
Summary
A study of 12 smart TVs found ACR-like traffic continued after opt-outs on Samsung and Vizio. Researchers collected 57 million VIDAA/Unruly viewing results from an unauthenticated MQTT broker in three hours; VIDAA added authentication, but traffic remains plaintext.
Key points
- Northeastern University researchers ran 5,943 experiments across 12 TVs and eight operating systems.
- In a three-hour sample, researchers collected more than 57 million non-empty ACR results from an unauthenticated Unruly MQTT broker serving VIDAA. The records included unique device identifiers; researchers did not link them to real households.
- The VIDAA ACR traffic was unencrypted and included app names, input sources, tuner channels, audio fingerprints, and device IDs; results included sensitive categories such as health, politics, and religion.
- Opt-outs stopped ACR traffic in testing on four systems. ACR-like traffic persisted in more than 60% of Samsung Tizen scenarios and an endpoint received traffic in all tested opted-out Vizio scenarios, though encrypted payloads prevented certainty about their contents.
- Vizio’s WatchFree+ service also exposed show and channel names through unencrypted DNS lookups regardless of the ACR setting; the article says no menu option disables this.
- VIDAA confirmed the broker flaw after disclosure and added authentication, but transmissions remain plaintext; the researchers were told further mitigation was in its final stages.
- The researchers recommend blocking ACR endpoints on Samsung and Vizio, updating TV firmware, or disconnecting TVs from the internet; these steps do not stop the WatchFree+ DNS leak.
Article Details
- Publisher
- Security Online Info
- Report Period
- 2026-10-26 (publication date); study period not specified
- Scope
- Researchers tested eight smart TV systems, covering about 95% of the U.S. market, and examined ACR opt-outs and viewing-data exposure.
- Sample Size
- 5,943 experiments on 12 TVs; the exposed-record count came from a separate three-hour capture.
- Key Statistics
- Researchers collected more than 57 million non-empty ACR detection results across 82 categories in a three-hour sample; the article says these came from more than one million TVs.
- The study conducted 5,943 experiments on 12 smart TVs covering eight operating systems.
- The tested systems represented about 95% of the U.S. smart TV market.
- On Samsung Tizen, traffic consistent with ACR activity persisted in more than 60% of evaluated opt-out scenarios; on Vizio SmartCast, one endpoint received traffic in 100% of opted-out scenarios.
- Recommendations
- Turn off ACR on LG webOS, Amazon Fire TV, Sony Google TV, and VIDAA, where opt-outs stopped ACR traffic in testing.
- On Samsung and Vizio, block ACR endpoints at the router using the researchers’ project blocklist.
- For full protection from the described TV tracking, disconnect the TV from the internet and use a streaming device that does not run ACR.
- Update TV firmware to receive vendor fixes.
Vendors
AmazonThese include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA.LGThese include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA.RokuThese include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA.SamsungVIDAA OS and its ACR partner Unruly (exposure); Samsung Tizen and Vizio SmartCast (opt-out findings)SonyThese include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA.UnrulyVIDAA OS and its ACR partner Unruly (exposure); Samsung Tizen and Vizio SmartCast (opt-out findings)VIDAAVIDAA OS and its ACR partner Unruly (exposure); Samsung Tizen and Vizio SmartCast (opt-out findings)VizioVIDAA OS and its ACR partner Unruly (exposure); Samsung Tizen and Vizio SmartCast (opt-out findings)
Products
Amazon Fire TVThese include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA.Amazon Kinesispersists in more than 60% of evaluated scenarios.” On Vizio SmartCast, one endpoint hosted on Amazon Kinesis kept receiving traffic “in 100% of opted-out scenarios.”LG webOSThese include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA.RokuThese include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA.Samsung TizenVIDAA OS and its ACR partner Unruly (exposure); Samsung Tizen and Vizio SmartCast (opt-out findings)Sony Google TVThese include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA.VIDAA OSVIDAA OS and its ACR partner Unruly (exposure); Samsung Tizen and Vizio SmartCast (opt-out findings)Vizio SmartCastVIDAA OS and its ACR partner Unruly (exposure); Samsung Tizen and Vizio SmartCast (opt-out findings)WatchFree+Separately, Vizio’s free WatchFree+ service leaks show and channel names through unencrypted DNS lookups.