---
title: "Samsung and Vizio TVs Keep Talking to Tracking Servers After Viewers Opt Out, Study Finds"
description: "In 5,943 experiments on 12 TVs, Northeastern researchers found traffic to ACR servers continuing after tracking was switched off"
author: "Jan Sokol"
published: 2026-10-21T18:00:37Z
modified: 2026-10-22T00:34:09Z
url: https://rews.cc/a/samsung-and-vizio-tvs-keep-talking-to-tracking-servers-after-216f24
language: en
tags: ["privacy", "surveillance", "smart-tv", "data", "opt-out", "tech"]
publisher: "Rews (https://rews.cc)"
---

# Samsung and Vizio TVs Keep Talking to Tracking Servers After Viewers Opt Out, Study Finds

*In 5,943 experiments on 12 TVs, Northeastern researchers found traffic to ACR servers continuing after tracking was switched off*

By Jan Sokol · October 21, 2026 · https://rews.cc/a/samsung-and-vizio-tvs-keep-talking-to-tracking-servers-after-216f24

## In brief

- Northeastern researchers found Samsung, Vizio and Roku TVs sending traffic to ACR tracking endpoints after users opted out
- The study ran 5,943 experiments on 12 TVs from 10 makers; the lead author says the systems tested cover about 95% of US smart TVs
- Vizio traffic to an Amazon Kinesis endpoint continued in 100% of opted-out scenarios; Roku’s was limited to The Roku Channel
- Encryption hid what the traffic contained; the authors call it suspicious and say discarding the data on arrival is unlikely
- The team published a blocklist of ACR domains; Vizio paid $2.2M to the FTC in 2017 and Samsung settled a Texas ACR suit

Deep in the settings menu of most modern televisions there is a switch that says the set will stop watching back. It is a small control with a large promise: that in his own living room the viewer decides. Research published on Monday by a team at Northeastern University suggests that on some of the best-selling televisions in America, the viewer can flip the switch and the machine goes on talking much as before.

The technology is called automatic content recognition, or ACR. It captures screenshots of what is on the screen, or clips of its sound, and sends them to remote servers, where they are used to measure audiences and to target advertising. As [Scharon Harding reported for Ars Technica](https://arstechnica.com/gadgets/2026/10/does-opting-out-of-smart-tv-tracking-work-research-finds-suspicious-traffic/), the researchers found that TVs running Samsung’s Tizen, Vizio’s operating system and Roku OS kept sending traffic to their ACR endpoints after users had opted out of tracking.

## The laboratory

The paper is titled “Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition.” Its authors are Ilgar Mammadov, Het Rutul Joshi, Daniel J. Dubois and David Choffnes, according to the [project’s public repository](https://github.com/IlgarNEU/Watching-the-Watchers), which lists it for the 2027 proceedings of the Privacy Enhancing Technologies Symposium. They tested eight operating systems on 12 televisions from 10 manufacturers: Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio and Westinghouse. Control scripts written for each system went to the sets over Wi-Fi, while the Mon(IoT)r and SPHERE Research Infrastructure software recorded the traffic going in and out. In all they ran 5,943 controlled experiments, and they have published raw network traces, among them a [dataset from a TCL set running Roku OS](https://zenodo.org/records/23110818).

Some systems hid very little. Tizen, the paper notes, talks to “self-disclosing ACR domains” whose names contain “acr” or the name of an ACR provider.

![A blank television screen connects through a coral ribbon to three stacked servers inside a coral circle on a yellow background.](https://rews.cc/img/e9fda14eaff416ac36b19d0e875d6fe8ffc4bff1.webp)

Twelve televisions is a small sample from a vast market. Mammadov, the lead author and a research assistant at Northeastern, answered that objection: the operating systems tested “cover approximately 95 percent of those used in the United States,” he said, and because ACR is built in at the operating-system level, more sets running the same software “would largely repeat our existing findings.” He also set out the limits. Each provider implemented ACR differently, in what triggers it, how well the opt-out works and what it captures, so “our results should not be generalized” to providers outside the study, though the method “is designed to be reusable.”

## Three kingdoms, three customs

Roku’s sets showed this ACR-like behaviour after opt-out only inside the company’s own streaming app, The Roku Channel. Roku discloses this in its terms of service and, according to the report, in the settings on TCL-branded TVs. Here, at least, the viewer had been told.

Samsung’s viewers had not. Traffic consistent with ACR tracking showed up in all 30 of Tizen’s measurements with its first-party streaming app. It showed up in 41 of 60 antenna measurements, in which the researchers used a radio-frequency modulator to broadcast their own content, some with moving video and sound, some with moving video and no sound. It continued in 18 of 30 HDMI measurements. When the researchers fed moving video with sound from an external device over HDMI, traffic reached ACR endpoints in more than half the tests.

Vizio’s sets went furthest. The endpoint the researchers judged “most consistent with ACR behavior” is hosted on Amazon Kinesis. Traffic to it stops during third-party streaming and screen mirroring, which matches Vizio’s statement in a 2021 SEC filing that it does not collect ACR data from those sources. But it continued in 100 percent of the opted-out scenarios, and the TVs reportedly sent traffic even when idle.

![A cream-colored toggle switch sits against a bright blue background, with a curved red conveyor-like ribbon carrying small cream cubes behind it.](https://rews.cc/img/0d45045c5fdd53b04a661cdb51c7cf21b4a0931e.webp)

> Traffic to the identified Amazon Kinesis endpoint does not disappear or decrease in any opted-out measurement… indicating that the opt-out setting has no observable effect on the traffic sent to this endpoint.

On these sets, the switch changes nothing that can be measured.

## A sealed envelope

Encryption kept the researchers from reading what the traffic contained. They call its persistence after opt-out “suspicious” and stop there: “These behaviors indicate potential privacy violations; however, we cannot know for certain without access to payload content.”

Mammadov went through the possible explanations. If the sets are tracking people who said no, that “would raise serious concerns about user consent and transparency,” and he counts it among the most likely explanations. Roku openly tracks use of its own app despite opt-out, and “this comparison suggests that the traffic we observed on Tizen OS and \[Vizio\] OS may similarly reflect ongoing data collection.” A software bug? Even then, “the outcome for users is the same: Their opt-out choice is not reflected in the TV’s behavior.” Data sent and then discarded on arrival? The authors consider it “unlikely.” “Transmitting data only to throw it away is an inefficient way to honor an opt-out,” he said. “Of course, it is also impossible for us to audit independently.”

That last sentence is the whole problem, and an old one. Power that asks to be trusted seldom lets anyone check. Ars Technica asked Samsung and Vizio why their sets keep talking to ACR endpoints after tracking is disabled. Neither had answered by the time the story ran.

## The record

This has happened before. In 2017 the Federal Trade Commission said Vizio TVs had used ACR to collect viewing data without consent. The company paid $2.2 million to settle, saying its software “never paired viewing data with personally identifiable information” and that it used the data only “in the ‘aggregate’” for audience reports.

![A hand inserts a red coin into a cream television with a large eye on its screen, while two coins lie beside it.](https://rews.cc/img/c6b79a4b77aaee751e8b66432910184bbc89e62c.webp)

In December 2025, [as TechRadar reported](https://www.techradar.com/televisions/your-tv-is-a-mass-surveillance-system-says-texas-and-the-state-is-suing-lg-samsung-hisense-tcl-and-more-to-stop-it), the Texas attorney general, Ken Paxton, sued Samsung, Hisense, LG, Sony and TCL, alleging that they used ACR to collect personal data “unlawfully” and that Samsung made opting out too hard. Samsung settled; Ars reports that it agreed to explain its use of ACR more clearly, and the [IAPP covered the settlement](https://prod.iapp.org/news/a/texas-attorney-general-announces-settlement-with-samsung-in-acr-data-collection-lawsuit/) when Paxton announced it. [Malwarebytes described the deal](https://www.malwarebytes.com/blog/news/2026/03/samsung-tvs-stop-spying-on-viewers-in-texas-heres-how-to-disable-acr-anywhere) as ending ACR collection from Texas viewers without their consent. The Northeastern tests cannot show what Samsung’s encrypted traffic carries, or whether that deal applies to it. Still, a company that agreed to respect refusal now has sets that keep calling home after the viewer refuses.

## What the viewer can do

“Little is publicly known about the privacy implications of deployed ACR implementations,” the paper says, partly because the deployments are opaque and hard to test automatically. Smart TVs “are locked down,” which rules out rooting and TLS interception, so researchers have to infer from the outside what the sets are doing. An [earlier study from UCL, UC Davis and UC3M](https://www.ucdavis.edu/news/your-smart-tv-watching-what-you-watch) reached a similar picture from another direction: on Samsung and LG sets, ACR kept working even when the TV was only a display for another device.

Viewers have started to push back. More people are modifying their sets’ software, and a growing number of tools promise to turn smart TVs back into dumb ones. The nonprofit Software Freedom Conservancy is suing Vizio to make it easier for owners to control the software on their TVs, including turning ACR off. The Northeastern team has published a list of network addresses, domains and URLs that owners can block to stop devices and apps from reaching ACR services. Blocking them, the authors say, does not affect picture quality.