Your Smart TV Is Secretly Uploading Data Even When You Turn Off Smart Features

Your Smart TV Is Secretly Uploading Data Even When You Turn Off Smart Features

A recent investigation reveals that smart TVs may continue uploading data to unknown servers even when smart features are disabled. The data transmission persists through external HDMI devices like Apple TV and PlayStation, raising concerns about privacy and surveillance. This finding suggests that turning off smart features may not be enough to stop data collection, prompting questions about who is receiving the data and why.

The Most Profitable Part of Your TV. | Transcript:

Like, something really weird is happening. We've been working on this video about like every TV technology out there. It's coming soon, but we found this thing. Check it out. See this? Like, one of these screens is uploading data to someone. See it right there? Who are they talking to? I put all these screens in an external HDMI. I tried an Apple TV, a PlayStation. It still uploads data. Like, I turned off every smart feature I could find on them. Nothing. So, are we watching these screens or are they watching us? Trumania. Hollywood has shown us these dystopian futures where our screens are looking back at us. And we learn to be careful with the phones and with social

media and with Alexa, but the TV set? Like, I've probably set up 20 TVs in my life, a bunch more for this channel. I've never once read what I was agreeing to on that first screen. So, what could the TV possibly be sending and to whom? It's a Chef's Pal. It's a dicer, greater, peeler all-in-one. Wow. Since we started researching this video, a bunch of YouTube channels have published about it, but we dug one level deeper and we found the person that invented this and we dug into the code to find what they're actually seeing and how to stop them. So, let me untangle this for you. Okay, so the first thing I noticed is that it's very little data that gets transferred. This is the Samsung TV. I'm playing content off an Apple TV, so the

TV is just acting as an HDMI input. But, see this here? It's about 1 kilobyte per minute. It's not enough data for video. It's probably not enough to stream me sitting on the couch. So, what is it sending then? Could it be images? I mean, you can't compress an image that much. Well, actually, you don't need that much data to find out what someone is watching if you focus not on the image, but on what is being watched. And we know how to do that in part thanks to Shazam. So, Shazam doesn't actually send its servers everything that you're listening to cuz that would be for starters a big privacy problem.

Also like this audio wave is dirty man, like bad speakers, echo, people talking. So what Shazam will do is it'll record about 10 seconds of audio and it'll create this thing called a constellation or a fingerprint. This animation from Real Engineering is the best explainer on YouTube about the audio part of it. We're going to focus on video, but I'm going to use this to show you this constellation which is just a set of points across different frequencies. So we have a value and we have a time between those values. And that's how music gets matched. And all this thing will happen in your phone. So your app isn't sending a full recording to the cloud, it just creates this fingerprint

which is what Shazam uses to then match against this library. So you save data, the whole system becomes more private and Shazam only needs to search for matches in those simpler patterns versus the full audio wave which will save a lot of time. You think it's doing like the video version of Shazam with one key difference which is you didn't ask for it. But requesting I ran from a serious musician is just it's too far. And so the name for this technology in television is ACR, automatic content recognition. So we understand that smart TVs are smart. There is some data that any smart device will collect. But when the content comes from an HDMI cable, say a cable box, Blu-ray, PS5, you would think that the TV is just acting like a

screen. Right? Of course not. There here. In Samsung's ACR guide, which is a real document that we have, they call this thing a glass level screenshot. Meaning it doesn't matter if the content is not playing from the smart TV, ACR will still look at the pixels that are being displayed. So what can the overlords see? And is that a privacy concern for us cuz I mean what if I'm watching I don't know, some home videos that I don't want anyone seeing. There are a bunch of patterns around this all with different approaches, but I want to walk you through one of them called perceptual hashing just so you understand how it works. So, let's say

they're watching a private home video that you were the only one meant to watch. In this case, your TV in theory should be acting just as a dumb TV, just displaying the image, not using the smart features. Now, assuming that this is a 4K screen, we have 8.3 million pixels. Those are way too many to compress into a file or to stream them all the time, people would very quickly notice. So, the first thing that this will do is down sample image. It'll crush it to like 32 by 32, so total of 1,024 pixels. So, anything at 32 by 32 becomes a blob, but I don't care. Like that's still my image. You can still make stuff up at that low resolution, right? But we're not done. So, the next thing the system

will do is it'll run a series of tests. For example, it'll store how bright the image is, it'll store that number, then it'll test if it's brighter on the left or on the right, and then top down, it'll score that. Um it'll take 64 of these tests, diagonal, middle column, that a texture, and it'll take the median value of all these 64 tests. And if any number is above the median, the thing becomes a one, and if it's below the median, it becomes a zero. So, that's 64 numbers, either one or zero, 64 bits of data, 8 bytes. That's it. It's very easy to search for matches if you're just searching for 8 bytes. It's definitely aligned with the 1 kilobyte that we've been seeing in our

router. So, just like in Shazam, this stream of data is going to get matched against a huge database of movies and any audio-visual content that there is, and that's how these overlords know what you're watching. So, consider the amount the very little amount of data and the way this data gets compressed and matched, even if someone could read matrix code, there's just not enough data to see me or to see what I'm watching. It's only enough to match to what's being indexed like in Shazam. But what has been indexed of the content available online? Are my guilty pleasures being matched? Do they know what those are? And what about stuff that I watch late at night?

Like who is watching who's watching on the other end? But before I get to who watches, you should know who we owe this to. Who are you? I am the creator. I was watching when you were born. That whole mess started with this guy. This is Ze'ev Newman. Now, I actually noticed that we have a few LinkedIn contacts in common and I actually thought I should thought of reaching out, but I don't think he's going to be happy where this video is headed cuz his LinkedIn probably reads, "I invented a revolutionary data technology called automatic content recognition which has become a mainstay in the TV and CTV business model." Now, the story is that

while Ze'ev was working as that the design agency Vizio, the TV manufacturer, reached out to him cuz they wanted him to build they wanted his help building some widgets for their TVs. So, he took the widget idea and raced it one, I guess. So, Ze'ev started this company called Cognitive Networks and the idea was to react to whatever is on screen in real time. Interactive TV. I mean, that sounds innocent, right? I mean, they called the platform Engage. You might remember it as Life Plus if you had an LG TV or as Show Sync that came from Showtime. All of those were running on Ze'ev's Cognitive Network. The romanticized idea was that if you were tuning into a show like Dexter or Homeland, whether it was

live or DVR or on demand, didn't matter, the TV would recognize the episode then you'd get a little prompt popping up to say, "Vote on what happens next." Or take a trivia. Or watch results in real time. Or get a reminder on the next episode. No app, no phone, the screen just knew. But in my world, you have nothing to fear. Their website at launch sold it like that, like this cool user experience. But the real agenda was clear if you had been paying attention, cuz when Zeev was approached by Vizio, what he actually said was, "Who cares about the widgets? The data from this experience would be more valuable than the experience itself." So, couple years after the launch, trivia, pizza, season voting, all that messaging was

gone from the website. They were now a data company. Vizio bought them soon after, and you would think, you would think that this would become like a Vizio thing, but Zeev's idea was just too good. Everybody else wanted on this thing. LG, they used Cognitive Networks for a while, and then they acquired a startup called Alphonso. Sony partnered with a company called Samba, and Samsung just calls it Samsung ACR. Which is a little ironic, cuz like every TV brand is like keeping track of everything I watch, and I can barely keep track of all the revisions and all the different versions and sets and the router and all the stuff that we've been testing for this video, and I'm the one who has to remember what I shot, what's left. So, I've been using

Hark Pro, that sponsored this section of the video, to help me organize all of this stuff. Hark Pro is an AI assistant that takes stuff off my plate your plate. It remembers the context of your life. It uses a computer in the cloud to do things for you across the web, and it can pull from the tools that you already work in, like Google Docs or Slack. It is like an operating system for your life. So, I've typed, like, build me a panel of every set in this video, every prop that we need, what's shot, what's still left, and built me this panel, one that I can view, I can check, instead of having to dig through my own script and docs and files. And since I'm on the road so much, it also does a lot of the travel

stuff. I was in Croatia a couple weeks ago, so if I need to book a restaurant near the airport, it can find a spot and book dinner around my calendar. It can get me an Uber timed to get me there, or email the hotel to ask for a late checkout, and it shows me any email that it drafts before it sends it. And my favorite part of this is the panels. It's like these mini apps that Hark builds that can track pretty much anything you want, like a countdown with the days until the next trip, or the flight times, or the weather at the destination. It then switches to your gate or any delays as you fly. So, if you're juggling a big project with a lot of moving pieces, or if you travel a

lot, you can try Hark with the link in the description, or with this QR code here. It's been really, really useful for me. Thanks a lot to Hark for supporting our channel. Now, a team from University College London and UC Davis, they actually tested this properly in 2024. They wrote this paper about it. They wired a Samsung TV and an LG TV, [clears throat] and they watched the network traffic while watching regular stuff out of their antennas, out of the TV's own free channels, out of an HDMI connected laptop, or even a game console. And in every case, ACR was sending data. The only cases where data was not being sent was when screen mirroring from a phone, when just sitting idle on the home screen. It also

didn't send anything when using Netflix or YouTube on the smart app on the TV. But, what about the rest? Where are our TV watching habits going? So, when that mega compressed file image thing gets uploaded to the services, they'll get to match it. Companies like Gracenote create this like huge database of content, every frame of every movie converted into these fingerprints that are getting compared against whatever's coming off of people's TVs, just like in Shazam. So, once a match is found, we know that this TV unit has been watching this movie. So, what can you do with this info? What if you're careful? What if you're not even logged in to your smart TV? Doesn't matter. An IP address is all

they need, thanks to data aggregators like Experian. So, if you're home, and you go to say book some flights, you're going to need to send some personal information to this website. So, if you made this transaction at home, your IP address will be in that data pack. Now, the website where you made the purchase, they don't even need to have Experian connected, cuz companies like Experian, what they do is they just buy a bunch of data from a bunch of third-party sources and intermediaries in this transaction. We know at least Samsung works with them. So, as long as the IP address matches, Samsung can just tie that to the same person. Now, we keep hearing about these companies selling our data, but what does selling our data actually mean

in reality? There's this idea that there's a spreadsheet with our email and our watch history that's getting handed off between companies, but that's not really how it works. Now, the way this is mostly used is through targeting buckets cuz every genre that you watch gets counted and you get sorted into these buckets with everybody else that watches the same things and that have certain purchasing behaviors based on that. Like households that watch true crime or sports fans or people who watch shows with specific actors. And remember, these companies have a profile on you. It's built not just from your guilty pleasures, not just from the stuff you watch at night, not just from

your favorite films, but it's also enriched by other transactions that data aggregators have access to, cookies and website visits. The TV screen is adding a whole other layer of data. I mean, it's a pair of eyes in a place that you thought was safe. One that most people had no idea about and that influences ads everywhere. Like, when we get you know, when we get those ads that are too targeted, right? We've been blaming the Zuck for it for a while, but has it been our TV all along? So, let's look at an example using Samba TV. That's the ACR that Sony uses. Same process, the movie you're watching gets matched, data gets sent to Samba. Now,

Samba works with a company called The Trade Desk. It's one of the biggest ad buying platforms in the world. It's called an omnichannel platform. So, you what you basically do is you go there to buy ad space across many different websites all from them. So, basically, The Trade Desk pays Sony/Samba for these profiles so they can use them to sell and target their ads a lot better. So, let's say that in The Trade Desk an advertiser like I don't know, like a coco hot coco company, wants to target people who are into sci-fi and who are feeling lonely. So, the trade desk then goes to buy ad space in real time, say in a streaming platform that runs ads inside the movie.

Why don't you let me fix you some of this new Mo Coco drink? All natural cocoa beans from the upper slopes of mountain Nicaragua, no artificial sweeteners. Wait, wait, wait. If the ad is going to run on Hulu anyway, why bother with this whole ACR mess? Why not just buy the ad from Hulu? So, a single platform would let you target ads on their shows, but remember the trade desk is aggregating data not just from Samba, but from a bunch of sources to create these huge profile. Also, because of ACR, the trade desk actually knows when the ad ran on that TV cuz it can recognize the ad it served. So, if Truman had a phone, the trade desk has

all the information linked to him as well. And so, they can run a follow-up to that first ad there. I've tasted other cocoas. This is the best. Okay, okay. So, this has to be like an opt-in type of deal, right? There's no way they would get away with enabling this by default without consent, right? Well, that's the gist of the problem. So, the first time anybody got caught doing this was Vizio. There's this journalist that broke the story in 2015.

Vizio's smart interactivity, that's how they called it. That feature was on by default on over 10 million TVs and they had been tracking people for months or years and nobody had opted into anything. And the article reads that Vizio works with data brokers to connect their IP address with your gender, your age, your income, and interests. And Vizio passes this enhanced data to advertisers who can track all devices that have connected to your home IP address. So, after they were caught, they had to pay like this $2.2 million fine with the FTC, which is not a lot. And so, after the lawsuit, all these TV companies started getting more clever.

They now needed to get consent from the users but they disguised that consent in the shadiest of ways. So how shady are they about the terms? I reset every single one of these screens to factory settings and I set them up from scratch. On the LG I was able to onboard by just checking two of the terms of service even though there's a nice shiny button prompting you to the select all. So in theory it shouldn't send anything but we'll test this. Samsung let me move on only accepting the necessary terms but it makes your TV dumb so the smart hub gets disabled and there are no apps. I'm getting like a crippled version of the TV. I can't even do anything. I just get like the channel

like this like we like the set top box. The TCL screen was by far the shadiest cuz that one runs on Google TV but there's no way to set up this TV if you don't log in with your email. Google account. Okay, let's set it up and see what happens. Of course there's been a lot of press about this recently. YouTube channels, articles but actually we're all late to the party cuz all the way back in December 25th the state of Texas had already filed a lawsuit against the five largest TV manufacturers to stop them from collecting data. And after that dozens of private citizens even other states they've done the same they've sued them as well. So where do we stand

today end of September 26th? The lawsuits must have worked right to stop them from spying? Well, in February 26th Samsung agreed to stop collecting ACR data without true consent at least in the US. Let's see if that's true. So I set these a while ago it's been like 30 minutes or so. For the Samsung we have I don't know. Actually zero bytes. Whatever we did in the settings of the Samsung this TV is not sending any internet traffic. Now remember this was set up as a dumb TV it should not be sending anything at all.

Enabling the smart hub would probably put us back where we started. Now TCL on the other hand that's a TCL. They managed to get the lawsuit dismissed on the argument that the state of Texas lacks jurisdiction to regulate TCL. So, in our test, the TCL, which again forced me to log in even to use the TV as a TV, it was definitely sending something. And it's crazy to me that you probably couldn't even use this screen if you didn't have Wi-Fi cuz you have to log into your email. Now, Sony and Hisense, they have not responded yet. But then there's LG. Because LG settled the lawsuit with the state of Texas in May 26th, which in theory means they would stop sending data. But this LG G5 TV has a microphone

connected to it and right now it's listening to me. And it's still listening to me. No network. Say something, god damn it. You're on television. So, Gamers Nexus, they published this incredible 2-hour documentary on what they discovered that their LG TVs are doing. We were able to retrieve a plain text transcripts of voice conversations and inputs from the TV. Utilize the TV to record from a webcam and from a microphone while the TV appeared to be off and it was clean captured, too. That is by far the worst or the best, I don't know, depending on how you look at it, the worst smoking gun of this whole

mess. I'm going to link the video below, but it looks like it wasn't the Zoc behind those hyper-targeted ads. Nobody had thought to look to the dumb device just standing on the wall. And it's not just the mic, by the way. Gamers Nexus found that a TV can scan the entire home network. It pretty much discovered every device on the Wi-Fi. It had device names and serial numbers for stuff that was on the home that had never been plugged to the TV. It is crazy. We know who's in the LG household. We know which devices are there. We know how to extend that reach into mobile. In our tests, we found the same, of course. LG was sending data despite us only accepting the essential terms when

we onboarded the screen. So, how does a company react to this PR disaster? They apologize, right? Maybe they choose to, maybe they pivot and they start to capitalize and they launch like a privacy-focused TV. Right? But no, they just double down. In the US, they now have a new terms in their thing. They have a forced arbitration clause, which blocks buyers from suing them in court or from joining a class action lawsuit. This was reported by Decrypt. So, why? Why are they so desperate? Why do they go to these lengths to keep mining our data? Okay, so let's look at Roku's case. And Roku is a public company. They have to file some real numbers with the SEC. That's where we found this stuff. So,

Roku recently started reporting two segments. They started reporting devices, which are the actual boxes and sticks and TVs, and licensing, which is the platform. That includes the ads and the subscriptions. So, fiscal year 2025, straight from Roku's own 10-K filing thing. On the devices side, which are the TVs and the streaming boxes, they lost $82 million. On the platform side, which are the ads and the subscriptions, they made $2.15 billion in gross profit. In other words, their ad business made over 26 times more profit than their hardware business lost. And the devices side has actually lost money since 2021. I quote from the CEO, by the way, I'm bad. Hardware is not a business. It's a way to acquire active accounts.

Our business is advertising and content distribution services. Just a couple months ago, Fox announced that they're buying Roku, by the way, not for the boxes. There's no business there. Fox said it themselves, they're buying the direct relationships with more than 100 million streaming households. That's code for having their targeting data, obviously. For Roku, that's very clear. The product is you. Now, granted, Roku TVs are very cheap, but it seems that the margins on TVs are not great for the other manufacturers, either. It's much harder to find clear numbers because so many Samsung, LG, at least, they do a bunch

of things beyond TVs. Um but there's some stuff we can infer from the data. For example, 2024, the LG TV division made 11.1 billion dollars, and their CEO reported that the advertising and content division made around 730 million. Now, the hardware division had a 2% margin, 2.1. So, that's what, 230 million dollars or so. On the other hand, this is software or just like digital stuff, and that could easily go with, I don't know, 75% margins. Even if that was 50%, which is similar to what Roku reports, we're looking at more profit from the ads division than from the TV sales. That is the reason why they can't help themselves. This is a very good business. The TV is kind of like a gateway drug. Back in 2009, remember,

Zeff told Vizio that the data would be worth more than the experience. And boy, was he right. And considering the show that ACR has been in the news lately, it blows my mind that guy is willing to keep that stuff in his bio. He definitely understood how impactful this technology was going to be, and how it would turn TVs into just like a data capturing device, and basically transform us into the product. But back to what we can do about it. When we first shot this video, which we started to make working on this a few months ago, we shot tutorials. We did tutorials on each one of these screens on how to disable this stuff, but I mean, it's not really going to stop them now. I mean, I mean, Samsung they did respect our choices. They

haven't uploaded any data, as far as we detected. But I'm not sure about those guys. Like not to mention that these are Latin American TVs with terms that I bet are a little bit more loose than the stuff that's being used in the US. So, what can you do? There are half measures and there are full measures. Half measures means running a quick search on how to disable the settings, of course, for your own TV. They're going to be changing a lot over the next few days, so you have to make sure that you have the latest info. It's not worth recording it on this video. But another thing you can do is isolate the screen on your network, which is what we did here. So, for your router, this might mean using a

different network, a different subnet. Routers like mine have a uh UniFi Dream Router, they have a feature called network isolation that at least ensures the device can't talk or can't see the rest of the stuff that's on the network. I mean, that stops the extra spying, but not the listening, not the sending of your data. If you want the full measures, just cut the cord. You know, set the screen up, then isolate it from everything. Change the Wi-Fi that you used to set it up, and just ignore the TV smart features. And just use a streaming box. There are many options these days. Meaning for my team, we have started working on a video reviewing each one of them to see which one you

can use to ensure the overloads don't gather your data, and honestly, which one gives you the better movie streaming experience. So, subscribe to see when that video comes out, and also, because YouTube knows your watch behavior, it thinks you're going to like this video. Catch you in the next.

More Entertainment Transcript