Smart TV ACR Tracking Study Finds Failed Opt-Outs and 57 Million Exposed Viewing Records
Do Son 
At a Glance
| Organization | VIDAA OS and its ACR partner Unruly (exposure); Samsung Tizen and Vizio SmartCast (opt-out findings) |
| Data exposed | ACR detection results with device IDs, app names and content categories such as religion, politics and health |
| Records affected | 57 million detection results from more than one million TVs, counted by researchers in a three-hour sample |
| Cause | An unauthenticated MQTT broker and unencrypted ACR traffic |
| Disclosure status | Reported to VIDAA, which confirmed it; broker now requires authentication, but traffic is still unencrypted |
| Source | Northeastern University research paper, CyberInsider, All About Cookies |
TL;DR
Northeastern University researchers ran 5,943 experiments on 12 smart TVs covering eight operating systems. They found that smart TV ACR tracking keeps sending traffic after users opt out on Samsung and Vizio sets. They also uncovered an open server that exposed 57 million viewing records from more than one million TVs.
What Is Smart TV ACR Tracking?
Automatic content recognition (ACR) takes frequent audio or video snapshots of what is on screen. The TV then sends them to remote servers, which match them against a media library. As a result, vendors learn what you watch and can sell ads around it.
This matters because ACR is everywhere. According to the paper, “82% of U.S. households contain smart TVs that support automatic content recognition.”
Scope of the Study
The team tested the eight dominant smart TV systems, which cover about 95% of the U.S. market. These include Samsung Tizen, LG webOS, Vizio SmartCast, Amazon Fire TV, Roku, Sony Google TV and VIDAA. Each TV went through ten viewing scenarios, such as antenna, HDMI, streaming apps and screen mirroring.
What Was Exposed
The biggest finding involves VIDAA, the second-largest smart TV system globally in 2024. Its ACR partner, Unruly, ran an MQTT broker with no authentication. In a three-hour window, the researchers collected “more than 57 million non-empty ACR detection results across 82 categories.”
Several of those categories are sensitive. The paper lists “Politics,” “Health and Medicine,” and “Religious.” Moreover, “each record included a unique client identifier transmitted in plaintext.”
Confirmed Count, Limited Sample
The 57 million figure comes from the researchers’ own capture, not from a criminal leak. It covers only three hours, so the real volume of smart TV viewing data flowing through the system is likely far higher. The team says it made no attempt to link records to real households, and it will not share the data.
How It Happened
VIDAA sends ACR data to Unruly over unencrypted MQTT. Because of this, anyone on the network path can read it. The traffic includes the app name, input source, tuner channel, audio fingerprint and a device ID that users cannot reset.
In some cases, the app name itself is revealing. The researchers saw ACR running on a kids’ app and on a religious channel. They warn this raises “potential COPPA concerns in the US.”
Opt-Outs That Do Not Fully Work
The opt-out stopped ACR traffic on only four systems: LG webOS, Amazon Fire TV, Sony Google TV and VIDAA. By contrast, “on Samsung Tizen traffic consistent with ACR activity persists in more than 60% of evaluated scenarios.” On Vizio SmartCast, one endpoint hosted on Amazon Kinesis kept receiving traffic “in 100% of opted-out scenarios.”
Still, the researchers stress a limit. Most of this traffic is encrypted, so they could not see its contents. In their words, “we cannot know for certain without access to payload content.”
A Leak Outside ACR
Separately, Vizio’s free WatchFree+ service leaks show and channel names through unencrypted DNS lookups. This happens whatever the ACR setting is, and no menu option turns it off.
Who Is Affected
VIDAA TV owners face the clearest exposure, since their viewing data traveled in plain text. Samsung and Vizio owners who opted out may still be sending ACR-like traffic. Roku users should know the opt-out does not cover The Roku Channel.
Confusing menus make things worse. Five of eight systems avoid the term “Automatic Content Recognition.” For example, Samsung calls it “Viewing Information Services,” while LG uses “Live Plus.” The researchers link this to a known dark-pattern category.
What Affected People Should Do
- Turn off ACR on LG, Amazon Fire TV, Sony Google TV and VIDAA, where the opt-out worked in testing.
- On Samsung and Vizio, block the ACR endpoints at your router. The team has released a blocklist on its project GitHub.
- For full protection, disconnect the TV from the internet and use a streaming device that does not run ACR.
- Update your TV firmware so it picks up any vendor fixes.
Notably, none of these steps stops the WatchFree+ DNS leak.
Company Response
VIDAA confirmed the broker flaw after the researchers reported it. The broker now requires authentication. However, “all transmissions to the broker remain in plaintext,” the paper says. The team was told mitigation work is in its final stages.
So far, neither CyberInsider nor All About Cookies has reported any comment from Samsung or Vizio on the opt-out findings. Regulators may take note anyway. Vizio paid $2.2 million in 2017 to settle FTC charges over ACR and promised a working opt-out. Meanwhile, Texas has already sued five TV makers over ACR practices.
Full results, data and the blocklist are on the Watching the Watchers smart TV ACR project page.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
