The Other Job Your Smart TV Is Doing

Gamers Nexus's investigation into LG smart TVs brought me back to a question from my EleksTube clock project: what am I inviting onto my network when I connect a device?

When I replaced the clock's network-based configuration with a local USB protocol and a Go CLI, its displays, buttons, and timekeeping still worked. The network requirement was an implementation choice, not a functional necessity, since the clock's basic functions didn't require it.

A smart TV presents the exact same dynamic. It is another embedded computer, whether the badge is familiar or obscure, and connecting it creates opportunities for both security failures and telemetry collection. LG's own advertising platform makes the commercial motive explicit: targeting based on viewing and gaming behavior.

Automatic Content Recognition (ACR) drives this pipeline by fingerprinting video samples directly from the screen, including external HDMI inputs. When I use a TV as a laptop display, the observation happens inside the TV after the picture/frame arrives. A VPN running on the laptop does nothing to stop the TV's firmware from analyzing/profiling those incoming pixels.

A Different Badge, Another Platform

Every TV sold is a delivery vehicle for the software its manufacturer chose to bundle. Counterpoint's market figures through May 2026 put Samsung at 16% of global TV shipments, TCL at 13%, Hisense at 12% and LG at 9%. Samsung and TCL had each gained a percentage point against the same period in 2025. Together, these four brand families control roughly half the global market.

For LG and Samsung, that software sustains revenue long after the hardware sale. LG describes webOS advertising and content as a growth business. Similarly, Samsung's June 2026 announcement and platform update opened TV home-screen ads to programmatic buying through The Trade Desk and Google's DV360.

This is the exact architecture I explored in Data as Capital: resolving identity, feeding downstream systems, and measuring the return. ACR generates the viewing data used to build audience segments, while the TV provides the ad inventory. The hardware ends up serving two masters: the owner who paid for the device, and the manufacturer selling access to that owner's attention.

From the owner's perspective, a setup screen reveals little about where those events travel or how they are used further down the chain. The manufacturer has a financial incentive to keep them flowing, which makes the setup's request for permission worth examining.

Consent, After Checkout

In the setup shown by Gamers Nexus, six agreements appeared together with "Select all" highlighted, even though only two were required to install apps. ACR was optional. To simply use the TV, an owner had to manually disentangle core operational terms from an ad-tracking consent flow.

That setup toll is paid in cognitive effort: parse the agreements, locate the optional toggles, and figure out what features might break if you opt out.

Updated terms or later software updates often force that negotiation again, even after setup. Tim Cushing at Techdirt reported in 2014 that a UK LG owner lost access to BBC iPlayer and other network features after rejecting an updated privacy policy. In 2024, Scharon Harding at Ars Technica covered Roku users being blocked from using their devices until they accepted updated dispute-resolution terms. While Roku's case centered on forced arbitration, it exposed the same dependency: continued use of purchased hardware could be made conditional on accepting new legal terms.

Privacy regulations exist precisely to police this bargain by requiring explicit, meaningful consent. Unsurprisingly, those protections face heavy industry resistance. In 2017, broadband providers and advertising lobbies successfully pushed Congress to pass Public Law 115–22, repealing proposed FCC broadband privacy rules that would have mandated opt-in permission for sensitive browsing data. Though aimed at ISPs, the underlying commercial incentive remains identical: mandatory opt-in policies put data access back under the owner's control.

For TVs, enforcement shows how those requirements can shape the product. Vizio's $2.2 million settlement with the FTC and New Jersey addressed allegations of collecting viewing histories without informed consent. Texas's 2026 agreements with Samsung and LG required clearer ACR consent. LG's terms specify revised onboarding disclosures for 2025 models and a pop-up during onboarding for 2027 and later models. These manufacturers can change the interface in software when a jurisdiction demands it.

Yet, providing a toggle does not make the choice clear. In the UK, the ICO's consent framework requires genuine choice and generally prohibits making a primary service conditional on unnecessary data processing. Despite that, a 2024 academic study analyzing LG and Samsung smart TVs found frictionless one-click opt-ins paired with opt-out controls buried across multiple sub-menus. Labels such as "Viewing Information Services" leave the owner to decode what a setting actually does before deciding to disable it.

Drawing the Dependency Line

For consent to be meaningful, software must maintain a strict boundary between core display features and optional profiling. Rejecting an ad relationship should leave the physical product fully functional.

HDMI handshakes, panel timing, and image processing belong to the display pipeline. Advertising identifiers, content-recognition events, and background uploads serve an entirely separate business logic. Sharing a system-on-a-chip (SoC) does not make those responsibilities inseparable. A streaming app requires authentication and DRM key negotiation, but rendering an HDMI input has zero technical requirement for an advertising profile.

This is the decoupling principle I discussed in Simplexity. In my smart home event hub, I kept the ESP32's C++ firmware lightweight and moved stateful logic into Go consumers. I can modify how the system reacts to a motion event without touching the sensor's firmware. Applied to a TV, the goal is to isolate which network dependencies are required for hardware function versus which exist to serve the vendor's business model.

Restricting traffic at the router makes it possible to test those boundaries empirically:

1. Network Isolation: Place the TV on a segmented IoT VLAN with firewall rules blocking access to local devices, preventing its firmware from probing the local network.
2. DNS & Telemetry Filtering: Use Pi-hole or AdGuard Home to sinkhole known ad and telemetry domains.
3. Evasion Prevention: Force local DNS routing and block outbound port 53 / encrypted DNS (DoH/DoT) along with IPv6, ensuring the TV cannot bypass local filtering rules.

Because content delivery and ad servers sometimes share the same domain or CDN, domain-level blocking can occasionally break streaming apps or OS updates. Inspecting traffic after every rule change reveals where a vendor has artificially yet intentionally coupled its services.

If router-level filtering fails to separate telemetry from core functionality without breaking playback, a cleaner fallback is to disconnect the TV from the network entirely and delegate streaming to an external media player. This lets you replace the networked software layer independently of the display panel—though the external player introduces its own privacy trade-offs.

Tracing these boundaries is an engaging engineering exercise, but an owner shouldn't need a background in network administration just to figure out what clicking "no" will break.

Reverse Engineering the Firmware

Blocking a connection at the router naturally leaves a deeper diagnostic question: what does the firmware do when an upload fails? That is the focus area for my Embedded Systems series.

The initial baseline requires zero firmware modifications:

• Traffic Baselining: Capture packet flows during boot, idle, active HDMI passthrough, and app execution, then compare those captures against an opt-out state.
• Telemetry Analysis: Combine DNS logs with packet captures (evaluating payload sizes, connection timing, and endpoints) to identify which background daemons generate telemetry requests.
• State Logic Inspection: Evaluate how background ad SDKs process consent flags—specifically whether failed payload drops are discarded, queued to local storage, or allowed to block primary thread execution.

Moving from network captures to firmware inspection introduces legal and contractual boundaries. Vizio's end-user terms, for example, explicitly prohibit reverse engineering or software modification except where permitted by law. These contractual restrictions help vendors protect the ad-serving infrastructure bundled into the hardware.

Replacing or modifying the factory image brings additional legal complexity. Bypassing bootloader locks or extracting vendor-licensed binaries touches on anti-circumvention provisions. While US DMCA triennial exemptions provide a narrow smart-TV exemption for interoperability with lawfully acquired apps, legal standing depends heavily on the specific method, jurisdiction, and licensing models involved.

Publishing those findings carries its own risks. Sony's 2011 legal action against George Hotz over published PlayStation 3 jailbreak tools ended in a settlement and permanent injunction. While that case targeted the public distribution of circumvention tools rather than private research, it underscores the friction that arises when security research intersects with proprietary platform control.