LG faces legal action over alleged smart TV spying

• Consumer advocates in Portugal want the courts to investigate LG TVs for potential privacy breaches
• Concerns are over what data your TV is logging and where that data goes
• A new study shows that on some smart TV platforms, opting out doesn't opt you out of ACR

In September, a report accused LG of creating "216,000 spy TVs", an allegation LG denies. But that isn't good enough for Portugal's consumer association, which is calling for multiple smart TVs to be taken off sale and for others to be updated to protect viewers' privacy.

The organization, Citizens Voice, is asking the Portuguese courts to review LG's statement against findings by the technology title TEK Notícias, which says the statement didn't directly explain tests involving audio storage when the TVs were offline, or of named security vulnerabilities in webOS.

Citizens Voice wants the courts to investigate and determine whether the data collection breaches consumers' rights, and if so to take action against not just LG but against retailers, too.

LG won't be the only smart TV maker watching the Portuguese action with interest, and other consumer advocates are likely to be paying attention, too. TV privacy is a hot topic right now, and a separate study of smart TVs earlier this year found that multiple manufacturers' TVs were ignoring privacy opt-outs either by design or accident.

When opting out doesn't opt you out

Watching the Watchers is an analysis of US smart TVs and their automatic content recognition (ACR) activities, carried out by researchers at Northeastern University (via The Verge).

As the researchers explain: "2% of U.S. households have a smart TV that can take snapshots of whatever is on screen and report them back. We measured where that data goes, and whether turning the feature off actually stops it."

The researchers tested 12 different commercial TVs across multiple brands including Samsung's Tizen OS, LG's webOS, Roku OS, Google TV, Fire TV, VIDAAA and Smartcast OS.

While the majority were well behaved, only used ACR on their own streaming services (while respecting Netflix and other third parties' no-ACR stances), and offered user opt-outs for ACR, those opt-outs only "fully worked" on four platforms: webOS, Google TV on Sony, VIDAA OS and Fire TV OS.

Rather worryingly, 30 out of 30 test runs using Samsung's own TV streaming service found that despite opting out of ACR, the runs all showed "traffic consistent with ACR" if you used Samsung's own streaming channels. And 100% of opted-out runs on Vizio didn't seem to make any difference to ACR at all: every run "still sent traffic to its Amazon Kinesis ACR endpoint, with no decrease."

The researchers go into much more detail in their research paper, but the 'tl;dr' is that opting out might not opt you out completely or at all depending on which smart TV you have. However, there is an important caveat: ACR data is usually encrypted (VIDAA OS is the exception), so the researchers can't say with 100% confidence that the data transmitted on every platform is definitely ACR information. The best they can do is say that it sure looks like it.

It seems to me that this is another example of tech firms' overreach running up against consumer advocacy and privacy legislation: as a former EU resident I've spent many years reporting on tech firms batting heads with regulators over data usage and privacy.

And it seems to me that there's a simple solution for smart TV makers: be up-front about what data you're using and what you're doing with it, and make sure opting out means exactly that. It's probably a lot cheaper than going to court.

Thinking of buying a new TV?

Try our TV size and model finder! You tell it how far you sit from your TV, we'll tell you what size to buy based on viewing angle advice from image quality experts, and we'll recommend our three top TVs at that size for different prices.