A couple of months ago there was a big furore when security researchers published a detailed expose accusing LG Electronics of “spying” on smart TV users in various ways, including allegedly listening in to their conversations through the TV’s built-in microphones.
LG strongly denied the spying accusations, rejecting many of Gamers Nexus’s claims outright and playing down the significance of the others, but its attempts to reassure customers that it respects their privacy have fallen on deaf ears as far as Portugal’s consumer association is concerned.
A report by Correio da Manhã which was later translated by The Portugal News says that the consumer rights group Citizens Voice has filed a class action lawsuit against the company, asking a local court to pull certain offending TV models from sale and “fix” others to ensure that they can’t keep surveilling their users anymore.
Citizens Voice seems to be dissatisfied with LG’s initial response to the accusations made by Gamers Nexus. In its complaint, it says that LG’s statement didn’t fully explain why tests that appear to show that its TVs store audio they pick up through their microphones when disconnected from the web. It’s reportedly asking for an independent technical assessment to determine whether LG’s TVs can collect and store conversations without customers deliberately activating their voice control functions.
In addition, the lawsuit asks the court to determine if LG’s data collection practices breach Portuguese consumer rights laws, and if that’s proven to be the case, take action against both LG and the retailers that sold its TVs, FNAC and Worten.
The proceedings will likely take some time to be resolved, but they’re likely to set off alarm bells at other TV brands, including Samsung Electronics, which recently faced separate accusations that it too, is using its televisions to spy on consumers.
Samsung is actually dealing with two separate reports that accuse it of spying. The first allegations emerged last month on X by a security researcher using the handle @log4j. In a series of posts, @log4j claimed that the company is using its TVs’ microphones to send audio back to its own servers in the form of telemetry data. Even worse, when one of Samsung’s TVs lacks an integrated microphone of its own, it will instead look for other connected devices that do have one, such as Bluetooth speakers or soundbars, in order to start using that to listen in instead.
Like LG, Samsung was quick to issue a rebuttal of the claims, saying that what @log4j found was simply a standard case of how most TV brands use Automatic Content Recognition or ACR technology to “enhance viewing experiences” for consumers. It said it never enables ACR by default, stressing that users have to opt-in and can opt-out again at any time. “When a customer disables ACR, viewing information is not collected or transmitted,” Samsung told HDTVTest in a statement.
However, Samsung’s claims of innocence are now being called into question by a second, even more detailed report by researchers at Northeastern University in the U.S., whose findings were revealed by Ars Technica this week.
In their analysis, titled Watching the Watchers, the researchers looked at 12 consumer TV platforms, including Samsung’s Tizen, LG’s webOS, Hisense’s Vidaa, and third-party platforms such as Roku OS, Google TV, Fire TV and Smartcast OS.
There were some alarming findings. While most TVs were well behaved and only found to be using ACR on their own streaming services, in respect of Netflix’s no-ACR policy, and honouring viewer’s decision to opt-out, not everyone did. On the contrary, Samsung, Vizio and Roku were all accused of continuing to send data on viewer activities back to their servers, even after they had supposedly opted out of ACR, the report claimed.
For instance, in 30 out of 30 test runs on Samsung’s own streaming service, the researchers found “traffic consistent with ACR” even after opting out. They found the same traffic patterns on Vizio’s Smartcast OS platform after opting out, while Roku was found to only partially respect viewers who tried to switch ACR off.
The researchers claims do come with a caveat, however, in that ACR data is often encrypted, meaning that they cannot establish with 100% confidence that the traffic sent back from the offending TVs to the companies’ servers is definitely ACR data. However, their findings suggest that the encrypted traffic most definitely “appears” to be ACR.
Watching the Watchers added that webOS, Google TV on Sony, VIDAA OS and Fire TV OS were all in the clear and stopped transmitting ACR data back to their servers when users opted out.
Samsung, Vizio and Roku have not yet responded to the latest allegations, but we’ll be sure to update this story if they do.
