Testing Smart TV Tracking  

How We Tested Smart TV Tracking

To understand both the technical behavior and the user experience, we tested each device in two stages: first, by documenting the setup process, and second, by monitoring network traffic under different ACR settings.

Each device was factory reset before testing. During setup, our testers documented the privacy prompts, Terms of Service, account requirements, and ACR-related options shown to a typical buyer.

To check whether privacy settings affected network behavior, we captured traffic using Wireshark through a mirrored switch port. Where available, we tested each device first with ACR-related data sharing allowed, and then again after turning off the relevant setting or withdrawing the related permission. We repeated those tests while playing content from built-in apps, HDMI devices, USB playback, gaming consoles, and idle states.

This was not a complete audit of every packet, endpoint, or privacy claim. Because most smart TV traffic is encrypted, our captures could generally show destination hostnames, timing, traffic volume, and changes in network behavior, but not the full contents of what was being sent. Our focus was narrower: ACR-related setup choices, disclosures, and traffic patterns to known or identifiable ACR-related services.

The ACR Settings Worked, But The Traffic Wasn't Always Easy To Identify

Once device setup was complete, we reviewed our Wireshark captures for traffic to known or clearly identifiable ACR-related services. On the Samsung S95F OLED, Sony Bravia 8 II, and LG G5, the results were clear enough to isolate. Samsung TVs and smart monitors, for example, contacted endpoints such as "log-ingestion.samsungacr.com" and "acr-us-prd.samsungcloud.tv". The Sony Bravia contacted analytics and ACR-related endpoints associated with Google and Samba, including "app-measurement.com", "dpn.cid.samba.tv", "fling.cid.samba.tv", and "events.cid.samba.tv".

With ACR enabled, these TVs sent small, regular bursts of data to identifiable endpoints. Once we found the relevant privacy setting and turned it off, that traffic stopped or changed dramatically. In that narrow but important sense, the opt-out worked, and the network captures gave us a clear before-and-after signal.

This clarity in the network traffic data was not true for every TV.

On the other smart TV models we tested, we could not isolate ACR-related traffic as cleanly. The ACR-related traffic was much harder to separate from the rest of the TV's background communication. The example of the TCL QM8K Wireshark capture is presented below. Here, we don't see a clear change in traffic volume or timing, or any obvious change in server hostnames when ACR was enabled or disabled. That doesn't necessarily mean those TVs ignored the setting. It means the data was not clearly distinguishable at the network level in the way it was on the Samsung, Sony, and LG televisions.

This is an important limitation for consumers and researchers. If ACR data is sent to the same servers as other telemetry, software updates, account services, recommendations, or app data, then it becomes much harder to verify what is happening. It also makes control of your network traffic through selective blocking difficult. A user may not be able to block "viewing data" through DNS filtering without also breaking unrelated TV features, because the traffic is not cleanly separated by hostname.

So the finding is mixed: ACR opt-outs can work, but the transparency of the data flow varies a lot by TV.

ACR Was Not Limited to Certain Apps or Inputs

For the TVs where we could identify ACR-related traffic, the collection was not limited to one app or one type of content.

On the LG G5, for example, we saw regular data-collection spikes when the TV was idle on the home screen, while using Netflix, YouTube, and Plex apps, and while playing a video from a USB drive. In other words, the traffic was not limited to streaming apps or to content delivered through LG's own interface.

The HDMI results were especially notable. While playing a game on a connected PS5 and while browsing the internet on a connected laptop, the ACR-related traffic became much more frequent and higher in volume. We cannot say from the network data alone exactly why that happened, but one possibility is that content from external devices requires more frequent sampling to identify.

That broader behavior matches the basic purpose of ACR. The technology is designed to recognize what appears on the screen, which means it can apply across the viewing experience: built-in apps, local media, external streaming devices, game consoles, and other HDMI sources.

This is why ACR consent is different from simply agreeing to Netflix's, YouTube's, or Plex's privacy terms. Those services can collect their own usage data when you use them, but ACR can operate at the TV level, across sources.

ACR Is Only One Layer of Smart TV Data Collection

It's also important not to treat ACR as the only privacy issue on a smart TV. During our Samsung S95F OLED Netflix test, we saw regular traffic to logs.netflix.com with and without Samsung's ACR consent enabled. That traffic was separate from the Samsung ACR endpoint we were monitoring, and it didn't disappear when we disabled the TV's ACR setting.

That doesn't mean Netflix was doing anything unusual in this specific test. Streaming apps commonly send logs, diagnostics, performance data, and other telemetry back to their own servers based on their own Terms of Service and Privacy Policies. But it does show why a smart TV privacy setting has limits. Turning off a TV manufacturer's ACR feature can reduce one form of viewing-data collection, but it doesn't stop apps, operating-system services, account features, advertising systems, or other background telemetry from communicating with their own servers.

In other words, ACR is important because it can operate at the TV level across apps and inputs. But it's still only one layer of the broader smart TV data ecosystem and privacy concerns.

Opting Out Of ACR Wasn't Always Simple, Obvious, Or Consequence-Free

It was encouraging that the ACR-related settings appeared to matter, but that didn't settle the more practical question: could a normal buyer actually make an informed choice when setting up their TV? In our testing, the biggest problem was not that ACR consent never existed. It was that saying no could require tradeoffs, extra digging, or familiarity with platform-specific language most people wouldn't reasonably have.

Sometimes Opting Out Meant Giving Up Smart Features

The most obvious consumer problem appeared when refusing data collection meant losing access to core smart TV functionality. Vizio was the starkest example: setting up the VQD65R-10 with all of its advertised smart features required logging into a Vizio/Walmart account and accepting the Terms of Service, the Privacy Policy, and the sharing of Activity Data. Users could decline, but doing so left the TV in a limited state with only HDMI and coaxial inputs, and no access to apps. Opting out of sharing usage data after accepting was also not as simple as toggling a setting; in our testing, it required fully resetting the TV.

Even within the same Google TV operating system family, the privacy-preserving path was not consistent. Some models, such as the Sony Bravia 8 II and TCL QM8K, explicitly allowed setup as a "basic TV." That at least gave users a choice to avoid some data collection, though at the cost of losing smart TV features, much like the Vizio. Other Google TV models, such as the Hisense U8QG, absolutely required signing in with a Google account and accepting Google's Terms of Service during the initial setup process.

Some Choices Were Buried Inside Broader Privacy Agreements

On some devices, the problem was not simply that privacy choices came with tradeoffs. It was that the ACR-related language was hard to isolate in the first place. Instead of being presented as a clear standalone choice during setup, it appeared inside broader terms, privacy policies, platform agreements, or post-setup menus.

Roku OS was the clearest example. The Roku Pro Series could not be set up without an internet connection and a Roku account. Activation of the TV required accepting Roku's Terms of Use in a web browser, where reading a long legal document is at least relatively practical. But in our setup flow, that document didn't appear to include ACR-specific language or a direct description of viewing data collection.

The first time we encountered ACR or viewing-data collection language was later, inside Roku's Privacy Policy, which was linked from a "Voice consent" screen on the TV during setup of the hands-free voice remote. To continue setting it up, users had no choice but to check "I understand" on that screen. A normal buyer could reasonably understand that step as consent for the remote's microphone features rather than as the point where they were being directed to broader terms about what Roku can collect about what appears on the TV. Once setup was complete, we also didn't find a simple setting to disable the TV's internet connection entirely from the TV's menus. Cutting the device off from the internet required physically unplugging the Ethernet or kicking it off the wireless network.

Fire TV devices showed a different version of the same problem. Televisions running Amazon's Fire TV operating system offered a basic mode without requiring users to log in to an Amazon account, but ACR-related controls were not presented as separate opt-in choices during setup. Instead, they were covered by broader Conditions of Use, which users implicitly accept by continuing through the setup process. To disable the relevant settings afterward, users had to find and turn off "Device Usage Data" and "Collect App and Over-The-Air Data," both of which were enabled by default.

The TCL QM8K also had its own spin on the issue. To use it as a smart TV, users had to accept a Privacy Policy that mentions third-party use of ACR. But there was no separate ACR opt-out at that stage. Instead, users had to finish the setup and then find the relevant "Interactive Service" setting afterward.

The Same Privacy Choice Looked Different Across Platforms

Taken together, these examples point to a broader industry problem: there is no consistent way to identify, accept, or disable ACR-related features.

This starts with the labels of these settings varying widely from device to device. A user trying to opt out of ACR wouldn't necessarily know whether to look for "viewing data," "viewing information," "interactive services," "enhanced viewing," or something else entirely, as summarized in the table below:

The Hisense 32A4NV and TCL QM8K presented yet another consent problem. Some picture settings on these TVs explicitly stated that they use ACR to recognize content and "automatically enhance both the image and sound quality for all input sources." That is clearer than burying ACR entirely, but it also frames the technology here as purely a performance feature. These prompts didn't clearly explain whether turning on the picture setting meant the same recognition data could also be used for advertising, measurement, or other purposes.

The general inconsistency here is exactly what makes informed consent difficult. Across the same product category, ACR can appear as a privacy agreement, a smart TV service, a picture-enhancement feature, or a setting hidden after setup. It can require explicit opt-in on one device and post-setup opt-out on another, which is part of the legal scrutiny around ACR. Even when a control exists, a typical buyer may not know what it's called, where to find it, or why it matters.

A Streaming Device Can Help, But It Doesn't Make Your TV Private

One reasonable response to smart TV tracking is to avoid the TV's smart features entirely and rely instead on an external streaming device for apps and content. After initial setup, each TV we tested could be disconnected from the internet and used as a basic offline display for HDMI devices. For people worried about OS-level ACR on the TV itself, keeping it offline is a meaningful step. Without an internet connection, it has no obvious way to send viewing data back to the manufacturer.

The catch is that sandboxing the TV mostly moves the platform-level data relationship from the manufacturer to the streaming device company. If you watch Netflix, YouTube, Prime Video, Disney+, and other services through the same external device, that device's platform may gain the kind of cross-service viewing visibility you were trying to avoid on the TV.

For example, the Roku Ultra streaming device we tested followed essentially the same setup and privacy flow as the Roku TV, including broad policy acceptance with ACR-related language. The Fire TV Stick 4K Max required an Amazon account to set up, with acceptance of Amazon's policies built into the sign-in process. We didn't find a clear ACR-specific opt-out during setup, though Fire TV OS did include settings such as "Device Usage Data" and "Collect App Usage Data."

The Apple TV 4K was different, but not free of privacy tradeoffs. It could be set up without immediately signing in to an Apple Account, although App Store access and Apple's broader app ecosystem eventually require sign-in. We didn't find ACR-specific language in the Apple TV 4K setup flow, but Apple's TV app privacy disclosures say the company collects information about what users watch in the Apple TV app and connected third-party video apps when users grant permission. The NVIDIA Shield added another layer of complexity. Using it meant entering into separate privacy relationships with Google and NVIDIA; during setup, we were asked to accept policies or terms from both. Together, those policies described broad usage-data collection, but there was no single ACR-specific choice presented in the setup flow.

None of this means streaming devices are a bad idea. If the TV itself stays offline, a separate streaming device can help keep streaming-app activity separate from other things you might display on the screen, such as a laptop, game console, or USB device. It also gives you better streaming hardware, which you can upgrade later without having to replace the entire TV. But it's not a universal privacy fix. It's a choice about which ecosystem you want to use, which company you trust, and which privacy settings are easiest to understand and manage.

What You Can Actually Do About Smart TV Tracking

When you buy a smart TV, you aren't just purchasing a display. You are buying a connected platform that may include ACR, an evolving technology that enables manufacturers to collect broad, system-level viewing data across apps, inputs, and services. That viewing data can be used to infer a person's interests, habits, lifestyle, and purchasing intent. For this reason, ACR raises serious consent questions, which are now coming into focus through ongoing legal scrutiny.

Our testing found that ACR settings were not fake or meaningless. Once we found the relevant setting and turned it off, the network traffic we could identify as ACR-related generally stopped. But that clear before-and-after signal was only visible on some TVs. On many of the models we tested, any ACR-related traffic appeared to be mixed in with other background communication, making it difficult to separate viewing-data collection from telemetry, software services, account features, recommendations, or app traffic. That lack of separation matters because it makes the data flow harder to verify and harder for consumers to selectively block without breaking other TV features.

We also found an informed-consent problem. Across the devices we tested, ACR-related choices were described with different names, placed in different menus, bundled into broader privacy agreements, or tied to tradeoffs like losing advertised smart TV features. A determined user could often find a way to say no, but the path was not consistent or obvious.

For consumers, our practical advice is a privacy ladder. At minimum, look for and disable settings related to "ACR," "viewing data," "viewing information," "interactive services," "Samba Interactive TV," "enhanced viewing," "content recognition," or device and app usage data. That is not a perfect solution, but our testing suggests these settings can matter.

If privacy matters more to you, consider moving up the ladder by keeping the TV offline as a display for HDMI devices. An external streaming box may give you more flexibility, but it doesn't eliminate the privacy tradeoff; it may simply move platform-level viewing data collection from the TV manufacturer to another company. A more privacy-conscious setup might rely more heavily on local media like Blu-rays or a dedicated media PC, though those options come with their own costs, inconveniences, and privacy settings to understand.

There is also a broader solution that individual consumers cannot create on their own: better privacy laws and enforcement. If data privacy matters to you, consider voicing your concerns to lawmakers, regulators, or consumer-protection groups. The recent legal scrutiny in Texas around ACR shows what can happen when electronics companies are forced to explain their data practices and face consequences for failing to obtain meaningful consent.

Manufacturers should make ACR choices clearer, more consistent, easier to find, and off by default unless a user knowingly opts in. Until then, privacy-conscious buyers are left with a ladder of imperfect choices: disable what they can find, use the TV offline, move viewing to devices they trust more, rely more on local media, or start blocking domains at the network level. That is an awful lot to ask of someone who just wants to watch television. Privacy shouldn't require turning a smart TV into a weekend networking project.