What happened
Researchers at Northeastern University tested 12 televisions from 10 manufacturers to see whether switching off automatic content recognition, or ACR, actually halts the tracking, The Verge reported. Opting out stopped traffic to suspected ACR endpoints on LG's webOS, Amazon Fire TV, a Sony set running Google TV and Vidaa OS models. Samsung's Tizen reduced but did not end such traffic, and Walmart's Vizio TV showed no change.
Two Roku OS televisions, one from TCL and one from Roku itself, kept running content recognition inside The Roku Channel app even after users opted out. TCL flags this limitation in its settings menu, while the Roku-branded set does not. Because nearly all of the traffic was encrypted, the researchers said they could not confirm its contents. Project lead David Choffnes said results held after factory resets on the Vizio and Fire TV units.
The team also found a flaw in Vidaa OS that exposed an MQTT broker linking the system to Unruly, a video ad platform. Through it, they obtained recognition data belonging to other Vidaa owners, gathering records from more than 1 million unique TVs over three hours, including permanent device identifiers and audio fingerprints. Vidaa confirmed the issue and now requires a login, although the messages remain unencrypted.
Context
ACR captures snippets of a TV's sound or picture, turns them into digital fingerprints and checks them against a database to identify what is on screen. Manufacturers use the results for viewing recommendations, audience metrics and targeted advertising. Vizio settled an FTC lawsuit over consumer data collection in 2017. Walmart did not respond to a request for comment on the Vizio results before publication.
The briefing
The week in tech, in one email.
The dispatches worth your time, every week. Unsubscribe anytime.