Study finds smart TV tracking persists after users opt out

A Northeastern University study published on 26 October 2026 tested 12 smart TVs across eight operating systems and found that automatic content recognition (ACR) tracking persists even after users opt out on several devices. The researchers conducted 5,943 experiments and captured more than 57 million non-empty ACR detection results in a three-hour window, with data including device IDs, app names and content categories such as Politics, Health and Medicine, and Religion.

The study notes that VIDAA’s ACR partner Unruly ran an MQTT broker with no authentication, allowing anyone on the network path to read traffic that included app names, input sources, tuner channels, audio fingerprints and an unresettable device ID. The researchers emphasise that most traffic was encrypted, so payload contents could not be verified.

In terms of opt-out effectiveness, the study found opt-outs worked for four systems (LG webOS, Amazon Fire TV, Sony Google TV and VIDAA) but not for Samsung Tizen, where traffic consistent with ACR activity persisted in more than 60% of evaluated scenarios. On Vizio SmartCast, traffic continued in all opted-out scenarios due to an endpoint hosted on Amazon Kinesis. Separately, the researchers report a DNS leak related to Vizio’s WatchFree+ service, exposing show and channel names regardless of ACR settings.

VIDAA confirmed the broker flaw and indicated authentication is now required, though transmissions remain in plaintext. The report attributes these findings to researchers, vendor statements, and project data published by Watching the Watchers.