Study finds Vizio and Samsung TVs leak tracking data after opt-outs

Northeastern University researchers tested twelve smart TVs from ten manufacturers to see whether Automatic Content Recognition (ACR) data would still be sent after users opt out. The study, titled Watching the watchers, covered eight TV operating systems that account for roughly 95% of U.S. smart TVs and ran ten viewing scenarios across first-party and third-party apps, with over 5,000 automated sessions in total.

It found that Vizio continued to send what appeared to be traffic linked to ACR for first-party streaming and antenna-based services, even after opt-out, and did so while idle. By contrast, third-party streaming data on Vizio reportedly did not trigger ACR traffic.

Samsung’s Tizen OS showed some leakage after opt-out, with traffic patterns consistent with ACR in 7% of Netflix runs, 10% for YouTube, and 20% for Tubi TV, and 60% of ACR-like traffic during HDMI sessions, though first-party streaming remained subject to ACR.

The researchers noted that encryption complicates verification: most smart TVs encrypt ACR traffic, including Samsung, so signals such as destination endpoints, timing and volume were used to infer ACR activity. An exception was Supersonic’s VIDAA OS, which sent ACR data to servers unencrypted, exposing more than 57 million ACR detections from other devices.

The report also mentions a 2017 FTC settlement in which Vizio agreed to allow opt-outs for ACR after investigations into viewing-history collection on about eleven million sets, and that Walmart acquired Vizio in 2024 partly to bolster its advertising business. Four OSes—LG WebOS, Sony Google TV OS, Amazon FireTV OS, and Supersonic VIDAA—were noted as completely silent after opt-out.