Published October 25, 2026. Based on public reports available on that date; details may change.

Most smart TVs run automatic content recognition (ACR), which fingerprints what is on screen and sends it to the manufacturer, and research shows it keeps working when the TV is just a display for a laptop plugged in over HDMI. For a business, that means the TV in your meeting room may report what was presented on it. Turning ACR off in each TV's privacy menu and moving the TVs onto a separate network takes about 15 minutes per room.

What happened

A researcher posting on X as @log4j said this month that they had rooted a 2025 Samsung TV after noticing unusually targeted ads. They reported finding ACR, location and network-mapping features, data sharing with what the post described as about 400 partners, and a service they read as an always-on microphone. As of publication, no full technical writeup had been released and the microphone claim had not been independently checked, so treat that part as unconfirmed.

The ACR part is not new and is well documented. A 2024 study presented at the ACM Internet Measurement Conference measured ACR on Samsung and LG TVs in the US and the UK. It cites LG's own documentation saying its ACR captures frames every 10 ms, and Samsung's saying every 500 ms. The researchers found ACR traffic both during regular TV viewing and when the TV was used as an external display over HDMI.

Why this matters for a business

A meeting room TV is usually connected to whatever laptop is in the room. That can be a board deck, a client's financials, a case file shared on screen during a video call, or a staff member's personal browsing. The TV does not need a camera or a login to do this: the study found that being logged in or out made no material difference to ACR traffic.

The data goes to the TV maker and its ad partners, not to an attacker. For most companies that is a privacy and confidentiality problem rather than a breach. For a law firm, a medical practice or anyone bound by a client confidentiality agreement, it is still information about client work leaving your control without a contract covering it.

There is also a plain security side. Smart TVs get firmware updates on the manufacturer's schedule, often for a few years at most, and nobody in the office is checking them. A device like that should not sit on the same network as the laptops and file server.

The legal background

Regulators have treated this as a consumer protection issue for almost a decade. In 2017, Vizio paid $2.2 million to settle claims by the FTC and New Jersey that it collected viewing data from about 11 million TVs by default without proper consent, and agreed to get express consent going forward.

In December 2025, the Texas Attorney General sued Samsung, LG, Sony, Hisense and TCL over ACR. In early 2026, Samsung agreed to stop collecting ACR viewing data from Texas consumers without express consent and to add clearer disclosure screens. Reports say LG reached a similar agreement later in the year. The cases against the other three makers were still open at last report.

The business model explains why ACR is on by default. In its third quarter of 2024, Vizio reported a $6.7 million gross loss on devices and $115.8 million in gross profit from its advertising and data business, Platform+.

How to turn ACR off

ACR has a different name on every brand. Look for these settings, usually under Privacy, Terms or Support:

  • Samsung: Terms & Privacy, then Viewing Information Services
  • LG: Live Plus
  • Vizio: Viewing Data
  • Roku: "Use info from TV inputs"
  • Sony and other Google TV models: Samba Interactive TV

While you are in those menus, also:

  1. Turn off interest-based ads and reset the advertising ID.
  2. Decline any optional privacy agreements you accepted during setup.
  3. Turn off voice recognition and any "always listening" or sound detection feature.
  4. Delete apps nobody uses in that room.
  5. Write down what you changed, and check again after each firmware update or factory reset, since some updates show the consent screens again.

Isolate the TVs on your network

Put every smart TV, along with cameras, speakers and other connected devices, on a separate guest or IoT network that cannot reach your work computers or servers. Most business routers and access points can do this with a separate SSID or VLAN. If one of these devices is compromised, it should not be able to see anything else on the office network.

For a further layer, DNS filtering services such as NextDNS or a self-hosted Pi-hole can block known smart TV tracking domains for the whole network. Some devices use their own hardcoded DNS servers to get around this, so a router rule that blocks outbound DNS (port 53) to anywhere except your own resolver closes that gap. If an app stops working after you add filtering, the logs show which domain to allow.

The simplest option for a room where confidential material is shown is a display with no network connection at all. A plain monitor or a TV that is never connected to Wi-Fi cannot send anything anywhere.

When to get help

The same approach applies to your website: know what each connected system sends out, turn off what you don't need, and keep the rest isolated and monitored. If you would like an outside view of your WordPress site and the hosting around it, our security audit covers what is exposed and why, and WordPress hardening closes it. The free hardening checklist is a good place to start on your own, or contact us for a free first look.

Sources