A study of 12 U.S. smart TVs found that automatic content recognition (ACR) opt-outs had different results across operating systems and viewing scenarios. Researchers observed network traffic consistent with ACR after opting out on Samsung Tizen and Vizio SmartCast in specified tests, while Roku’s opt-out did not cover its own streaming service. Four other tested operating systems were classified as effective for ACR opt-outs in the scenarios measured. Because most of the relevant traffic was encrypted, the researchers could not establish what it contained or whether companies processed, retained, or used it.
What the researchers tested
ACR identifies what is playing on a TV using short audio or video samples, or digital fingerprints, sent to a provider for matching. It can apply to content from streaming apps, antenna broadcasts, HDMI-connected devices, and other inputs.
The researchers tested 12 TVs from 10 manufacturers across eight operating systems and reported 5,943 controlled experiments. Their scenarios included idle screens, antenna broadcasts, first-party streaming apps, Netflix, Tubi, YouTube, HDMI, and screen mirroring. Each scenario was run 30 times with ACR enabled and 30 times after opting out, in randomized order. The researchers estimated that the operating systems in their sample covered about 95% of U.S. smart-TV operating systems.
They used controlled content and captured network traffic to identify endpoints whose activity correlated with what was playing. Most ACR traffic was encrypted, so the team inferred ACR-consistent behavior from traffic patterns rather than reading packet contents.
Results differed by operating system and viewing mode
| Tested operating system | Post-opt-out observations | Scenario details |
| Samsung Tizen | Traffic consistent with ACR continued in several tests. | 30/30 first-party streaming runs, 41/60 antenna runs, 18/30 HDMI runs, and 6/30 Tubi runs. Researchers also reported lower-frequency observations during idle, Netflix, and YouTube runs. |
| Vizio SmartCast | Traffic to the endpoint the researchers associated most closely with ACR appeared in every run for five tested conditions. | 30/30 runs per condition for idle, an antenna channel, a black screen with audio, moving video without audio, and first-party streaming. The tested third-party streaming apps and screen mirroring showed no traffic to that endpoint. |
| Roku OS | The opt-out did not cover The Roku Channel, Roku’s first-party streaming service. | First-party app traffic appeared in 29/30 runs on each tested Roku OS TV. For antenna viewing, the opt-out worked in the tested runs on a Roku TV; a TCL Roku TV showed ACR-consistent traffic in 9/90 runs. |
| LG webOS, Sony Google TV, Amazon Fire TV OS, and VIDAA OS | Researchers classified the ACR opt-out as effective in the tested scenarios. | This finding concerns ACR in those scenarios. VIDAA had separate data-exposure findings. |
The results show why a single yes-or-no answer to whether a smart TV tracking opt-out works can mislead: the observed behavior varied by operating system, service, and input. The researchers’ measurements apply to the tested TVs, firmware, and scenarios.
Separate findings on VIDAA and Vizio WatchFree+
The researchers reported that VIDAA OS sent unencrypted ACR messages to Unruly. Those messages included a permanent device ID and an audio fingerprint, as well as app and input information. The study site reported that a server had exposed more than 57 million detection results associated with over one million TVs before a partial fix; the messages remained unencrypted.
The researchers also described a separate Vizio WatchFree+ exposure. In their tests, unencrypted DNS and SNI lookups to Amagi disclosed program or channel names. They reported no available opt-out for this exposure in the tested setup. This finding concerns WatchFree+ title lookups, not the encrypted endpoint traffic observed in some Vizio SmartCast ACR scenarios.
What the researchers recommended
The researchers recommended disconnecting the smart TV from the network and using an external streaming device that does not perform ACR. They also recommended using an ACR opt-out on operating systems where their tests found it effective. Their study tested smart TVs, not every external streaming device, so it does not establish how a particular streaming box behaves.
The researchers publish an endpoint blocklist and reported that blocking those endpoints did not disrupt TV operation or viewing quality in their lab scenarios. That result is limited to the devices and conditions they tested.
