Submission + - Study Claims Vizio Simply Ignores 'Smart' TV Spying Opt Out Requests (techdirt.com)
An anonymous reader writes: Recently, reports emerged that LG TVs are sniffing around your local network, and even listening to your local environment, even when the TV is purportedly “off.” Some of those voice commands were then stored in plain text and uploaded to the internet. LG’s response? To deny everything. [...] That latter point is central to a new study out of Northeastern that conducted 5,943 experiments across twelve commercial “smart” TV devices. The researchers found that most smart TVs utilize automatic content recognition (ACR), a technology that captures audio or video snapshots of viewed content and then monetizes that data to help build personalized profiles of viewers.
TV makers insist that users are supposed to be able to opt out, but the choice simply doesn’t work across a large segment of TVs. Companies like Vizio simply ignored the consumer requests entirely more often than not: “We find that the advertised ACR opt-out fully suppresses ACR-attributable traffic on only four operating systems; on Samsung Tizen traffic consistent with ACR activity persists in more than 60% of evaluated scenarios, and on Vizio SmartCast a content correlated endpoint hosted on Amazon Kinesis continues to receive traffic in 100% of opted-out scenarios.”
[...] The researchers say since they can’t see the precise scope of what’s being collected due to encryption, they’re unsure whether Vizio is technically violating its FTC agreement (not that we have a current FTC that would care if they were): “The opt-out setting has no observable effect on traffic sent to this endpoint; however, we cannot inspect the payload due to encryption so we cannot confirm whether this violates the FTC settlement.” Results of whether opting out of ACR tracking actually stopped ACR tracking were all over the map. Roku, for example, ignores opt-out requests when users are watching Roku’s own channels. None of the smart TV vendors track Netflix viewing for fear of violating agreements with the streaming giant. Samsung’s opt out function was more likely to actually work when a user was watching antenna broadcasts.
On two Smart TV platforms, personal viewing data collected by ACR remains unencrypted, despite years of bad press and scandal on the subject. Many appear to be violating the law, but because U.S. regulatory oversight has been gutted, they see no meaningful accountability. That includes smart TV OS’ like VIDAA, which is most prominently found on Hisense and Toshiba smart TVs: “VIDAA OS sends ACR data to servers run by Unruly over MQTT without encryption, so anyone on the network path between the TV and those servers can read it. Each message carries a Client ID, a permanent identifier for the TV that can’t be reset, along with the time zone, the app name, the input (antenna, HDMI), the antenna channel and an audio fingerprint."
TV makers insist that users are supposed to be able to opt out, but the choice simply doesn’t work across a large segment of TVs. Companies like Vizio simply ignored the consumer requests entirely more often than not: “We find that the advertised ACR opt-out fully suppresses ACR-attributable traffic on only four operating systems; on Samsung Tizen traffic consistent with ACR activity persists in more than 60% of evaluated scenarios, and on Vizio SmartCast a content correlated endpoint hosted on Amazon Kinesis continues to receive traffic in 100% of opted-out scenarios.”
[...] The researchers say since they can’t see the precise scope of what’s being collected due to encryption, they’re unsure whether Vizio is technically violating its FTC agreement (not that we have a current FTC that would care if they were): “The opt-out setting has no observable effect on traffic sent to this endpoint; however, we cannot inspect the payload due to encryption so we cannot confirm whether this violates the FTC settlement.” Results of whether opting out of ACR tracking actually stopped ACR tracking were all over the map. Roku, for example, ignores opt-out requests when users are watching Roku’s own channels. None of the smart TV vendors track Netflix viewing for fear of violating agreements with the streaming giant. Samsung’s opt out function was more likely to actually work when a user was watching antenna broadcasts.
On two Smart TV platforms, personal viewing data collected by ACR remains unencrypted, despite years of bad press and scandal on the subject. Many appear to be violating the law, but because U.S. regulatory oversight has been gutted, they see no meaningful accountability. That includes smart TV OS’ like VIDAA, which is most prominently found on Hisense and Toshiba smart TVs: “VIDAA OS sends ACR data to servers run by Unruly over MQTT without encryption, so anyone on the network path between the TV and those servers can read it. Each message carries a Client ID, a permanent identifier for the TV that can’t be reset, along with the time zone, the app name, the input (antenna, HDMI), the antenna channel and an audio fingerprint."
