An in-depth investigation has revealed that LG smart TVs actively scan home networks and capture audio data, even when the devices are in standby or monitor modes, prompting significant privacy concerns. The investigation, which spanned over 500 hours, suggests that LG’s data collection practices may extend beyond user expectations and disclosures.
Why This Matters
This investigation into LG smart TVs highlights critical issues surrounding user privacy and data security in the age of connected devices. The findings reveal that LG smart TVs scan home Wi-Fi networks using UPnP, map connected devices, and collect audio and viewing data via Automatic Content Recognition (ACR) even when the TV is in HDMI monitor mode or the microphone is muted. These practices raise questions about the adequacy of user consent and the effectiveness of privacy controls offered by smart TV manufacturers.
Network Scanning and Audio Capture
The core findings indicate that LG smart TVs are capable of scanning a home’s entire Wi-Fi network using UPnP and mapping all connected devices, including phones, laptops, and other smart appliances. Furthermore, the Automatic Content Recognition (ACR) software, designed to identify what is playing on the TV, continues to function even when the TV is used solely as an HDMI monitor. Researchers were able to capture usable audio from a TV even when its main microphone was muted through the settings menu, suggesting the presence of a secondary, un-switchable microphone. In one instance, audio was captured and uploaded after the TV was reconnected to the network, including speech from within the room.
Voice commands issued to LG TVs are reportedly converted to plain text and stored in on-device logs. The microphone also remains active for a period of 10 to 15 seconds after speech ceases, potentially capturing subsequent conversations. LG has stated that its sets “do not collect, record, or store ambient conversations,” according to reports from July.
LG’s Business Model and Partnerships
LG’s business model, particularly through its LG Ad Solutions division, appears to involve leveraging TV viewing data for advertising purposes. The company aims to link household TV habits to other devices within the same home. This strategy is underscored by statements from LG Ad Solutions leaders suggesting the company “owns the glass” and, by extension, the data generated from it. LG took a controlling stake in Alphonso Inc., a key ACR partner, in 2021. Serge Matta, president of global ad sales for LG Ad Solutions, previously led ad-measurement firm Comscore, which faced SEC charges in 2019 for allegedly inflating revenue by approximately $50 million. Matta personally paid a $700,000 penalty and accepted a 10-year ban from running a public company.
Security Vulnerabilities and User Agreements
In addition to data collection concerns, the investigation identified significant security vulnerabilities. Remote-code-execution bugs were found in LG TVs, allowing potential attackers to run commands on a TV from across a network, and LG has not fully patched these flaws. Security firm Spur also discovered residential-proxy code within approximately 42% of apps available on LG’s webOS store, according to Krebs on Security. This code can reroute internet traffic through a user’s home connection, making it appear as ordinary household browsing.
LG’s user agreements are extensive, reportedly exceeding 30,000 words combined, requiring several hours to read. Days after Gamers Nexus published its initial report in July, LG added a forced-arbitration clause to its terms, which prevents users from suing the company in court or joining class-action lawsuits. In May, Texas Attorney General Ken Paxton announced a settlement requiring LG to obtain informed consent before collecting ACR viewing data and to provide a clear opt-out mechanism. This followed a December lawsuit that also named Samsung, Sony, Hisense, and TCL. However, the ‘Do Not Sell My Personal Information’ toggle was found to remain off by default before a user connects to the internet or agrees to any terms, raising questions about the effectiveness of these privacy measures.
Broader Context
These findings place LG’s practices within a broader trend of tech companies prioritizing data collection and monetization over user privacy. Similar concerns have been raised regarding other companies, such as Meta’s AI glasses and data privacy issues surrounding ChatGPT. Gamers Nexus is currently crowdfunding a follow-up investigation into other smart TV brands, including Samsung and Vizio, while Texas’ cases against Sony, Hisense, and TCL remain open.
Leave a Reply