The paper from Northeastern University researchers points to potential privacy violations from some of the biggest TV brands. ACR captures video screenshots or audio clips from smart TVs and sends the data to remote servers, where it’s used for things like measuring content viewership and serving targeted ads. The paper, “Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition,” examined eight smart TV OSes across 12 smart TVs from 10 manufacturers (Amazon, Hisense, LG, Roku, Samsung, Sony, Supersonic, TCL, Vizio, and Westinghouse) to examine when smart TVs use ACR and how effective opting out of user tracking is.
Regarding the relatively small number of TVs studied, Ilgar Mammadov, the report’s lead author and a research assistant at Northeastern, told Ars Technica: Together, the smart TV operating systems we tested cover approximately 95 percent of those used in the United States. Because ACR is implemented at the OS level, we expect that adding more TVs running the same operating systems would largely repeat our existing findings rather than reveal new behavior. The researchers made OS-specific control scripts and delivered them over Wi-Fi, while Mon(IoT)r and SPHERE Research Infrastructure software captured network traffic coming to and from each TV.
The research included identifying each OS’s ACR endpoint. Some of the OSes, including Samsung’s Tizen, “expose self-disclosing ACR domains containing keywords such as ‘acr’ and ACR provider names,” the paper said. The researchers conducted 5,943 controlled experiments for the report.
Extract — continue reading at the source.
