In 2017, the FTC said Vizio TVs used ACR to collect user data without consent. The company paid $2.2 million to settle the charges, saying its ACR software “never paired viewing data with personally identifiable information.” Vizio said it used the data only “in the ‘aggregate’ to create summary reports measuring viewing audiences or behaviors.”
Texas Attorney General Ken Paxton sued Samsung, along with Hisense, LG, Sony, and TCL, last year, alleging that they use ACR to collect personal data “unlawfully.” Samsung made opting out too difficult, the lawsuit alleged. Samsung settled, agreeing to update its terms to more clearly explain its use of ACR.
If the TVs are tracking users who declined tracking, it “would raise serious concerns about user consent and transparency,” Mammadov said. He said that is one of the most likely reasons the TVs are sending network traffic to ACR endpoints when tracking is disabled.
Mammadov noted that Roku states in its terms of service that Roku OS tracks the use of first-party streaming apps even if users opt out of tracking. “This comparison suggests that the traffic we observed on Tizen OS and [Vizio] OS may similarly reflect ongoing data collection,” he said.
Could the activity be caused by a technical bug? Even if that were the case, “the outcome for users is the same: Their opt-out choice is not reflected in the TV’s behavior,” Mammadov said.
Mammadov said another possible explanation for the ongoing traffic is that data is transmitted but discarded once it reaches remote servers. The report’s authors consider this “unlikely,” Mammadov said, adding:
Transmitting data only to throw it away is an inefficient way to honor an opt-out, since it consumes the user’s bandwidth and adds load on the vendor’s servers for no purpose. Of course, it is also impossible for us to audit independently.
“Little is publicly known” about ACR
The paper highlights a troubling lack of transparency around how smart TV ACR works, what data companies are collecting, and when they collect it.