Is your smart TV spying on you: Here's how to check

​

Turning a smart TV off doesn't always turn it off. That's the uncomfortable takeaway from a recent investigation into LG, which found microphones still picking up audio in standby mode, screen dark, nothing on it suggesting anything was happening at all. The company disputes the findings, but the bigger point holds regardless of how that dispute settles: every smart TV on the market runs some version of the same data-collecting machinery, and most of it is switchable, if you know where to look.

What your TV actually watches you doStart with the feature every smart TV has, whatever the badge on the front says: Automatic Content Recognition, or ACR. It samples snippets of the audio and video passing through your screen, turns them into a digital fingerprint, and matches them against a library to figure out exactly what you're watching, on any input, from any source. It doesn't matter if it's a streaming app, a cable box, an antenna, or a Blu-ray player plugged into HDMI; ACR reads the screen, not the source.

Voice control is the second layer. If your remote has a mic, the TV listens for a wake word to trigger it, and once triggered, that audio typically goes to a cloud server for processing, not just the TV itself.

The third layer, network scanning, is a little less publicised. Smart TVs are always scanning for other devices on the same Wi-Fi network—phones, smart speakers, watches, and so on. This is supposedly to allow casting and file-sharing. In practice, that scan can produce a pretty complete inventory of everything connected in your home.

These three layers can be condensed into a few select categories. This includes your viewing history and content preferences. It can also collect hardware identifiers, IP addresses and Wi-Fi information. An advertising ID may also track you across devices. Depending on the device, it may collect voice recordings and voice queries.

It can also estimate your general location through the network. It also collects data about the device’s performance. Almost all of these pieces seem to fall under routine telemetry on their own.

This has gone wrong in public beforeVizio was fined $2.2 million by the FTC in 2017 for tracking millions of viewers by IP address and selling that data on without consent. This case pushed the whole industry toward asking permission during setup, at least on paper.

The hardware side has had its own history of trouble. In 2013, security researchers demonstrated at Black Hat that early smart TVs could be hacked much like a computer, exposing browsing habits, app usage and, on camera-equipped sets, the camera itself.

A botnet called Mirai later showed how far that could scale: it turned huge numbers of internet-connected devices, including TVs, into a network that could knock other services offline, exploiting nothing more sophisticated than weak default passwords.

Two more specific demonstrations are worth knowing. Researchers at the University of Washington built a proof-of-concept called CovertBand that used a TV's own speakers to emit near-inaudible sound pulses, then used the built-in microphone to read the echo and track people moving around a room, accurate to within inches.

Moreover, leaked intelligence documents published in 2017 described a tool aimed at a specific line of Samsung TVs, built to make the screen appear off while the microphone kept recording. This is the same standby-mode concern investigators are raising about other brands today.

That doesn’t mean that all smart TVs are being actively exploited. This is different from a theoretical risk, because the attack surface is real, documented, and has already been used.

Two minutes: does your TV have a camera or a live micBefore touching any settings menu, do this physical check first. It takes less time than the ad before your next show.

Run a flashlight along the top and side bezel of the screen in a dim room. A camera lens will catch the light and glint back differently from the plastic around it.

Then check the remote and the TV's edge for a mic-mute switch, which is a hardware kill switch that software can't quietly override.

Found either? Cover the lens with tape if there's no shutter, and use the mute switch if your set has one. This is the one step that works no matter what any settings menu claims elsewhere.

Now go turn off the trackingEvery platform buries this in a different menu, but the settings exist everywhere, and working through all of them takes under five minutes:

Two toggles matter more than the rest, no matter the brand. Turning off ACR (labelled Viewing Information, Samba Interactive TV, or " Use Info from TV Inputs" depending on the platform) stops the fingerprinting of what's on your screen.

Turning off voice recognition stops the mic from listening for a wake word in the first place. This is the only way to be reasonably certain nothing is being processed while you're not actively pressing a button.

The rest stick because of two habits. Install firmware updates as soon as they are available; the bugs demonstrated at Black Hat and still appearing are patched silently and only provide an advantage after installation. Double-check these settings after every software update, too, as privacy toggles are notorious for silently resetting to “on.”

The one thing no menu fixesNone of these settings touches what matters most: a TV that keeps working in standby, long after the screen suggests it's doing anything. Short of unplugging the set or killing power at a smart strip, no menu toggle guarantees a smart TV is fully offline.