Smart TVs are like “a digital Trojan Horse” in people’s homes

The companies behind the streaming industry, including smart TV and streaming stick manufacturers and streaming service providers, have developed a "surveillance system" that has "long undermined privacy and consumer protection," according to a report from the Center for Digital Democracy (CDD) published today and sent to the Federal Trade Commission (FTC). Unprecedented tracking techniques aimed at pleasing advertisers have resulted in connected TVs (CTVs) being a "privacy nightmare," according to Jeffrey Chester, report co-author and CDD executive director, resulting in calls for stronger regulation.

The 48-page report, How TV Watches Us: Commercial Surveillance in the Streaming Era [PDF], cites Ars Technica, other news publications, trade publications, blog posts, and statements from big players in streaming—from Amazon to NBCUniversal and Tubi, to LG, Samsung, and Vizio. It provides a detailed overview of the various ways that streaming services and streaming hardware target viewers in newfound ways that the CDD argues pose severe privacy risks. The nonprofit composed the report as part of efforts to encourage regulation. Today, the CDD sent letters to the FTC, Federal Communications Commission (FCC), California attorney general, and California Privacy Protection Agency (CPPA), regarding its concerns.

"Not only does CTV operate in ways that are unfair to consumers, it is also putting them and their families at risk as it gathers and uses sensitive data about health, children, race, and political interests,” Chester said in a statement.

Beyond rising streaming subscription fees and the increasing presence of ads in streaming services, the growth of streaming has a "steep price," the report says:

The widespread technological and business developments that have taken place during the last five years have created a connected television media and marketing system with unprecedented capabilities for surveillance and manipulation.

The report notes "misleading" privacy policies that have minimal information on data collection and tracking methods and the use of marketing tactics like cookie-less IDs and identity graphs that make promises of not collecting or sharing personal information "meaningless."

"As a consequence, buying a smart TV set in today’s connected television marketplace is akin to bringing a digital Trojan Horse into one’s home," it says.

Via Violet Blue's Cybersecurity Roundup: October 8, 2024

Smart TV Surveillance? How Samsung and LG’s ACR Technology Tracks What You Watch

Smart TVs from major manufacturers like Samsung and LG use a Shazam-like tracking technology called Automatic Content Recognition (ACR) to monitor what you watch — and opting out can be a painful process for end users.

According to a new study from researchers at the University College London, University of California, Davis, and Universidad Carlos III de Madrid, the tracker operates even when Smart TVs are used as ‘dumb’ external displays via HDMI, potentially capturing content from gaming consoles or laptops.

The ACR technology, which has roots in the popular Shazam song-identification tool, is designed to profile viewing activity of users, periodically capturing the content displayed on a TV’s screen and matching it against a content library to detect what content is being displayed at any given point in time.

This type of so-called “second party tracking” is directly integrated into the Smart TV’s operating system, the researchers explained, noting that a black-box audit of ACR network traffic between ACR clients on the smart TV and ACR servers found a major difference in how the technology works across the US and the UK.

In the US, the researchers found that ACR is active during free ad-supported streaming TV (FAST) viewing, while in the UK it is turned off. This suggests the default behavious is influenced by jurisdictional regulations and data privacy laws.

The research team found that opting out of tracking features does appear to stop ACR-related network traffic, suggesting privacy controls are effective but notes that user-login status on Smart TVs does not impact ACR tracking behavior.

Via Violet Blue's Cybersecurity Roundup: October 8, 2024