A hot potato: Vizio paid $2.2 million to settle allegations that its smart TVs silently tracked what was playing on 11 million screens in 2017. As part of this agreement, the company first had to ask the owners for permission. But a new study suggests that saying “no” to a current Vizio TV doesn’t change much, at least when it comes to network traffic.
For the study, researchers at Northeastern University tested twelve smart TVs from ten manufacturers. Combined, these devices run the eight operating systems behind about 95% of U.S. smart TVs. Each viewing scenario – antenna, HDMI, streaming apps, and more – was run 30 times with Automatic Content Recognition (ACR) enabled. Each of these steps was then performed 30 more times after the researchers disabled this via the TV’s settings.
Vizio’s SmartCast platform performed worst. After the researchers logged off, the Vizio TV continued to send as much data as before to an Amazon Kinesis server that the team had linked to ACR. This happened on every single run, even when the device was idle on the home screen.
In comparison, only four platforms – LG’s webOS, Fire TV, VIDAA and Sony’s Google TV – were completely silent after the sign-off. However, the Samsung device continued to send ACR-like traffic in all 30 tests of the company’s streaming service. The Roku opt-out, on the other hand, does not apply to the Roku Channel at all.
Still, Vizio and Samsung’s traffic is encrypted, so researchers couldn’t see what was actually in it. That’s why they’re not saying Vizio breached its FTC settlement. They also only tested one Vizio set, so other models may behave differently.
However, even a working opt-out from Vizio’s free WatchFree+ service wouldn’t help. It inserts the name of each show or channel into unencrypted DNS lookups sent to the stream delivery company Amagi. This allows an Internet provider or anyone else in the network path to compile a running list of what someone has viewed. And there is no setting to turn it off.
Walmart, in turn, bought Vizio for $2.3 billion in late 2024, in part to boost its growing advertising business. Since March, select new Vizio TVs even require a Walmart account to unlock their smart features.
For owners who would rather not be watched, the researchers suggest disconnecting the TV’s Internet connection and using a separate streaming device that doesn’t run ACR. They have also published a blacklist of known ACR servers. In their lab tests, blocking the ACR servers didn’t break anything, although the blocklist doesn’t stop the WatchFree+ leak.
