"We Own the Glass": Your Smart TV Works for Someone Else

**Updates:** Last updated November 4, 2026. Added LG's May settlement with Texas, the November 2 ruling keeping a privacy class action against Sony in court, and a correction: the January restraining order against Samsung in Texas was vacated a day after it was issued. Samsung's statement addresses content recognition only (see "What's still unanswered" below). Researcher log4j's full write-up has still not been published.

**This is a long read, so here's the TL;DR of the situation.** The full story, sources and our evidence key are below.

• Samsung: A researcher called log4j rooted his 2025 Samsung TV and claims it counts dog barks and baby cries, scans your home network every hour, and has a tracking off switch that doesn't fully work. None of it is independently verified yet, and his full write-up isn't out.
• Samsung's answer: It says content tracking (ACR) is opt-in and that nothing is collected once you turn it off. A Northeastern University study measured tracking-like traffic from Samsung TVs after opt-out in most of its tests. Samsung hasn't addressed the rest of log4j's claims.
• LG: Gamers Nexus showed LG TVs scanning home networks and tracking what you play over HDMI. LG confirmed the network scanning, says every smart TV does it, and denies recording conversations.
• Ads you never bought: LG, Hisense and Roku have all pushed new ads onto TVs through software updates after people bought them.
• The law: Enforcement is mostly American. Texas made Samsung and LG fix their consent screens, for Texans only, and a privacy class action against Sony just survived its bid to move to private arbitration. Europe has stronger privacy law but no formal action against Samsung or LG yet.
• What you can do: Turn off viewing information and ad settings, put the TV on a guest network, or take it offline and use an external streaming box. Details are in "What you can actually do" near the end.

It started the way a lot of good security research starts: with something that felt off. A reverse engineer who goes by log4j kept seeing ads on his 2025 Samsung TV that were a little too specific. The firmware was encrypted and Samsung doesn't hand out keys, so on October 21 he used unpublished vulnerabilities to get a root shell on the TV, started reading through Samsung's Tizen operating system, and posted two words that have since been seen by millions of people: "PRIVACY HORROR."

Among the things he says he found: telemetry counters for dogs barking and babies crying, a service that maps every device on your home network every hour, and a switch for content tracking that doesn't always do what it says.

Some of that is less sinister than it sounds. Some of it is worse. And none of it is new in isolation, because 2026 has been the year the smart TV industry's business model finally got audited from every direction at once: by YouTubers, by university researchers, by a US state attorney general, and by European regulators who are still working out what to do about it.

LG Ad Solutions, the advertising arm of one of the world's biggest TV makers, has a phrase for its position in your living room: "we own the glass." This piece is about what that actually means.

What's proven and what's claimed

This story mixes court records, peer-reviewed research, company statements and a viral X thread. They are not equally solid. Here's the key we use throughout:

• Confirmed: court documents, peer-reviewed or published research, regulator reports. Samsung's Texas settlement, the Northeastern University and UCL studies, the EU regulators' smart TV report, the exposed VIDAA data server, LG's patched root vulnerability.
• Company-stated: what Samsung, LG and Hisense say about their own products, including LG confirming that its TVs scan your local network.
• Claimed (unverified): log4j's Samsung findings, and Gamers Nexus's offline microphone recording, which was shown on a TV the researchers had already compromised.
• Alleged: claims made in lawsuits that haven't been decided.
• User-reported: things owners have posted, like ads appearing over game consoles, that the manufacturer hasn't confirmed.

When we write found or showed, it's confirmed. When we write claims, alleges or users report, it isn't.

Samsung: the barking dog and the crying baby

Here's what log4j claims to have found in Tizen on his 2025 TV, across a thread he has been posting since October 21 and an interview with the Daily Mail:

• Sound events. A telemetry event called EV201/SOUNDSENSOR_ON with counters for dog-barking and baby-crying events, which he says are sent as key-value pairs to a Samsung cloud server.
• An "always-on voice" service listed in the TV's security policy file.
• Microphones that aren't the TV's. If a model has no built-in mic, he says the software looks for connected devices that do, like a soundbar or Bluetooth speaker.
• Network mapping. ARP probes roughly 20 minutes after power-on and then every hour, collecting the MAC and IP addresses of everything on your network. MAC addresses reveal manufacturers: your iPhone, your PlayStation, your baby monitor. He says the presence-detection code has no opt-out check.
• Watching inside apps. A region-specific neural network that reads what's on screen inside apps like YouTube: what you watch, which ads you skip, how far you get.
• Camera and remote access. Fields for camera state and streaming duration, and a component he calls rmdemon that can start a packet logger and a remote live view of the screen.
• A power light you can't trust. Code that can set the TV's power LED independently of its actual state, referenced from the voice client that handles far-field audio. He says he doesn't know why a voice service would need to control the power light.
• Face detection. Code that returns bounding boxes around faces on screen. That's detecting faces, not identifying people, and he said he was still checking whether it's stock OpenCV code or used by Samsung's background services.
• A broken off switch. Several places where Tizen checks whether you've disabled content tracking are, he says, incorrectly implemented or missing entirely. He doesn't claim to know whether that's deliberate.
• Over 400 partners listed in the TV's configuration.

He has promised a full write-up of about 44 sections and an open-source, telemetry-free version of Tizen. Two weeks after saying it would come "in a few days," neither is out; he has since said he may put deeper write-ups behind a paid X subscription. On October 28 he also posted screenshots from a second set, another user's 2026 Samsung running Tizen 10, which he says runs even more on-device models. Nobody has reproduced his findings on a stock TV.

The case for calm

The most viral claim, that Samsung TVs listen for your dog and your baby, has a mundane explanation. Samsung sold this. Its 2025 Vision AI TVs shipped with Pet Care and Family Care: on-device AI that uses the TV's microphone to detect barking or crying and sends an alert to your phone through SmartThings. Both are designed to work while the TV is on standby.

Family Care is already gone. According to SBS Biz, citing a Samsung notice, Samsung shut the baby-cry feature down on September 22, about 18 months after launch, saying it wanted to focus on more useful features. Industry reporting adds that it kept mistaking crying in movies and TV shows for a real baby. Pet Care is still listed.

TechRadar argued this doesn't look like a scandal on its face, and that checking which nearby devices have microphones is not the same as using them; it could exist for karaoke or video calling apps. On Hacker News, where the thread hit more than 800 points, a developer with 17 years in smart TV apps pointed out that the security policy file is how Tizen apps declare their permissions, which shows what a service can do, not what it does. The only outside test of the microphone, by Hugging Face engineer Xuan-Son Nguyen, saw it open for five seconds and then stay quiet for hours, though on a TV that was already rooted with settings disabled.

All fair. Capability in firmware is not proof of collection.

What's still unanswered

But "it's an advertised feature" doesn't settle the question that matters. Samsung advertised that the TV would detect barking and alert you. It never said, as far as we can find, that counts of those events go back to Samsung.

In the days since, Samsung has given the same statement to TechRadar, HDTVTest and Xataka:

"Like many Smart TV providers, Samsung uses Automatic Content Recognition (ACR) to enhance the viewing experience, better tailor both the content, and if users consent, the advertising they see. Samsung Smart TVs do not enable ACR by default. Users must opt-in to the ACR service and can opt-out at any time. When a customer disables ACR, viewing information is not collected or transmitted."

That statement is about content recognition and nothing else. It doesn't mention the sound-event counters, the network scans, the camera fields or the microphone discovery, and it doesn't explain why counts of barking and crying go to Samsung's servers. TechRadar asked that question. So do we.

It also makes two claims worth testing. "Not enabled by default" is technically true when the opt-in is a screen at setup, but Texas alleged that screen let you opt in with one click while never letting you fully unenroll, and Samsung later agreed to rebuild it for Texans (more on that below). And "when a customer disables ACR, viewing information is not collected or transmitted" is exactly what a university team tested a few days earlier, with a different result.

LG and the Gamers Nexus investigation

In early September, Gamers Nexus published a 135-minute investigation with Level1Techs and independent security researchers. They bought a new LG G5 OLED, intercepted its traffic and took apart its firmware.

What they showed, per their video and coverage by The Verge and Ars Technica: the TV scanned their local network and found phones and smartwatches belonging to staff who had nothing to do with the test. It logged location, the names and signal strength of nearby Wi-Fi networks and internal IP addresses of other devices, and sent data toward LG Ad Solutions. Content recognition ran on HDMI inputs, meaning what you play on a console or watch from a laptop.

The most alarming segment, the TV recording audio while it appeared to be off and storing it until it reconnected to the internet, was demonstrated on a TV the team had already compromised through vulnerabilities. As India Today noted, that shows what an attacker could do, not that every LG TV records by default. The researchers also said they had reported remote code execution flaws to LG that were still under disclosure, and recommended disconnecting LG TVs from the network.

LG's response was split. It told The Register the claims were not true, and told Al Jazeera its TVs don't record ambient conversations; wake-word audio is processed locally and deleted. Its official statement says content recognition is off by default, uses audio fingerprints only, collects no screenshots, and doesn't run inside apps like Netflix or YouTube.

But as The Next Web pointed out, LG confirmed that its TVs scan local networks for other devices, and said every modern smart TV does it. That's not a denial. That's an admission with a shrug attached.

Two more details are worth knowing. The independent Glasshouse project found that LG's content recognition program, on at least one older firmware, contains both audio and video capture paths, and LG's statement doesn't say which models it covers. And LG Ad Solutions' own marketing offers advertisers targeting by what you watch, which games and consoles you use, your purchase habits, and whether you're an "ad skipper." Off by default or not, this is what the product is built to sell.

The independent evidence

Strip out every disputed claim from both stories and you still have this.

Opt-outs that don't opt out

On October 19, researchers at Northeastern University published "Watching the Watchers", the largest test of automatic content recognition (ACR) so far: 5,943 experiments on 12 TVs from 10 brands, covering the eight TV operating systems that make up about 95% of the US market.

ACR is the core technology here. It samples what's on your screen, as audio or video fingerprints, and matches it against a database to work out what you're watching, wherever it's coming from.

The finding: the opt-out fully worked on only four systems: LG's webOS, Sony's Google TV, Amazon's Fire OS and VIDAA. On Samsung, traffic consistent with content tracking continued after opting out in all 30 tests of Samsung's own streaming service, 41 of 60 antenna tests and 18 of 30 HDMI tests. On Vizio, a content-linked endpoint kept receiving traffic in every opted-out scenario, including when the TV was idle. Roku did it only in its own Roku Channel app, which it discloses.

Samsung says that when ACR is off, viewing information is "not collected or transmitted." The researchers measured traffic consistent with ACR anyway. The caveat matters: the traffic was encrypted, so they can't prove what was inside it, and they told Ars Technica a bug is possible. But data sent and then thrown away would be a strange way to honor an opt-out. It also flips the PR picture: LG took the public beating this autumn, but in this test its off switch worked and Samsung's didn't.

57 million records, no password

The same study found something worse. VIDAA, the operating system on Hisense TVs and other brands, sent viewing data to its ACR partner Unruly without encryption: a permanent device ID, the app in use, the input source and an audio fingerprint. The server replied with genre labels including "Religious," "Political" and "Health and Medicine." It even tracked the VIDAA Kids app.

The server itself required no login. In a three-hour sample, the researchers collected more than 57 million detection results from over a million TVs. After they reported it, VIDAA added authentication, but the data still travels unencrypted.

The researchers also found that Vizio's free streaming service puts the titles of what you're watching directly into unencrypted network lookups, so anyone on the path can rebuild your viewing history.

Even when it's just a monitor

A 2024 study from UCL and UC Davis tested Samsung and LG TVs in the UK and US. It found that content recognition runs even when the TV is used purely as a display for a laptop or console over HDMI. Opt-out did stop it in that test. And when the researchers filed GDPR requests to see what Samsung and LG held about them, the responses were vague and much smaller than the volume of data they'd watched the TVs send.

The TV you bought isn't the TV you have

Surveillance pays for the second half of the business: advertising that arrives after you've paid.

• LG added screensaver ads to OLEDs going back to at least 2020 through software updates, enabled by default, as FlatpanelsHD found. In May, owners reported promotional banners, including food delivery ads, appearing over their PlayStation 5 picture after firmware updates, some after disabling ad settings, as AdGuard documented. LG hasn't confirmed this.
• Hisense TVs showed unskippable ads on power-on, input switching and even channel changes, according to reports collected by Tom's Hardware in March, mostly from Spain and the UK. Hisense says it was a temporary test in Spain that has ended.
• Roku pushed an automatic update in May that makes a large ad a permanent fixture of its home screen, per Ars Technica. It also holds a patent for showing ads when your HDMI input is paused, targeted using content recognition.

None of these were in the product when people bought it. That's the part worth sitting with. A TV used to be finished when it left the shop. Now it's a platform the manufacturer keeps editing after the sale, and the edits flow in one direction.

The law: mostly American, so far

Almost all the enforcement is happening in the United States, and mostly in one state.

In December 2025, Texas Attorney General Ken Paxton sued Sony, Samsung, LG, Hisense and TCL, alleging their content recognition captures what's on screen every 500 milliseconds without real consent. Texas alleged that Samsung's enrollment used "dark patterns": one click to opt in at setup, a long trail of menus to read the disclosures, and no way to fully unenroll, only to "limit the use" of the data. A judge signed a temporary restraining order against Samsung on January 5, then vacated it the next day; Bloomberg Law reported it had been entered by mistake, and Samsung says the state's request was later denied at a hearing. None of those allegations were tested before Samsung settled. The suit against Sony alleges the profiles built from viewing data include political leanings, sexual orientation, health interests and religion.

In February 2026, Samsung settled. Under the agreed judgment, it must get affirmative express consent before collecting viewing data, update the setup screens on 2025 models, and give 2026 models a separate, stand-alone consent screen. It admitted no wrongdoing. The order lasts five years. In May, LG settled too: consent before collecting viewing data, a pop-up explaining it with a clear way to opt out, also with no admission of wrongdoing. The cases against Sony, Hisense and TCL are still open.

Both deals only cover Texas residents. Two of the biggest TV makers fixed consent for one US state because a state attorney general made them. Nobody else got that.

The rest is moving. West Virginia's attorney general sought outside lawyers in April to pursue the same five companies. A class action against Hisense was filed in California in May. On October 6, three Samsung owners filed Tillery v. Samsung in federal court in San Francisco, alleging that Samsung captures the screen roughly twice a second and that its "consent" is manufactured by design.

And on November 2, a federal judge in San Diego refused to send a Sony smart TV class action to private arbitration. Sony's arbitration clause sat in a "Limited Warranty" leaflet in the box, and the judge found a reasonable buyer had no fair notice it was a binding contract. Two California privacy claims go forward; the order dismissed 14 other claims and the injunction request, with 30 days to refile. On the injunction, the judge noted that ACR "can be disabled," which is exactly the assumption the Northeastern study puts in doubt for some brands. None of these cases have been decided.

What about Europe?

If you're reading this from Europe, here's the uncomfortable answer: you have stronger privacy law than the Americans and, on this issue, almost none of the enforcement.

Under GDPR and the ePrivacy rules, tracking what you watch to sell ads needs freely given, specific, informed consent. Whether European TV setup screens actually meet that bar is, as The Next Web put it, an answerable question nobody has publicly asked.

Here's what has happened:

• EU regulators did look. Data protection authorities from the Netherlands, Hungary, Italy and Liechtenstein ran a joint investigation for the European Data Protection Board, testing three popular TVs. Their report, published in September 2025, found data flows to many parties during setup, standby and use, and on every TV even while it was switched off. They found preinstalled apps that sometimes couldn't be deleted, and third-party apps installed automatically without asking. They didn't name the brands. Because the manufacturers are based outside Europe, each country's regulator has to follow up on its own.
• UK TVs behave differently. The UCL study found content recognition in the UK didn't track Samsung and LG's own free streaming apps, while the US versions did. That means it's a policy choice per market, not a technical limit.
• The Netherlands asked about a ban. After the Gamers Nexus video, Dutch MP Kathmann submitted 14 parliamentary questions on September 11, including whether LG TVs could be kept off the European market. The minister's answer was postponed in October. We haven't found a published reply.
• Poland deflected. Asked by PCFormat, Poland's Ministry of Digital Affairs said it couldn't confirm the allegations because the material concerns the US market, and that it would ask an industry body for LG Poland's position.
• Consumer groups are paying attention. Germany's Stiftung Warentest covered the LG findings and how to switch tracking off.
• New rules are coming, slowly. The EU's Cyber Resilience Act started requiring manufacturers to report actively exploited vulnerabilities in September 2026, but most of it doesn't apply until December 11, 2027.

So far we've found no formal action by a European data protection authority against Samsung or LG over this year's findings. That isn't the same as proof nothing is happening, but the gap between the law Europe has and the enforcement it's done is the story.

Taking the TV back

Where regulators are slow, owners have started doing it themselves, and the irony is hard to miss: people are reverse engineering firmware they paid for to remove ads from the company that sold it to them.

On LG, the community-built webOS Homebrew Channel is the foundation: an open-source app store for rooted TVs, with SSH and startup scripts. On top of it sit projects like lg-webos-ad-killer, which strips promoted home-screen rows and disables LG's ad, content recognition and telemetry services, and Life's Good Without Spying, which blocks LG's ad and tracking servers and stops the background processes, though its own readme admits most of the code was AI-generated. Glasshouse gives rooted TVs a local dashboard that shows what the TV is set to collect, tested on 48 models.

On Samsung, log4j says his telemetry-free Tizen will back up your original firmware first and allow recovery from USB, and admits he bricked his own TV several times building it. Other users say a separate public root already exists for some high-end Samsung models. And yes, AI is part of this scene now. log4j used OpenAI's tools for his reverse engineering and was banned for "cyber abuse," which he disputes.

Why does rooting work at all? Because TV security is often thin. In October, researchers disclosed three chained flaws in LG's webOS that gave anyone on the same network full root access with no PIN. LG has patched it. Earlier this year, Bishop Fox showed a way past Samsung's Tizen lockdown for TVs in developer mode. The same weaknesses that let hobbyists free their TVs let attackers in.

We're not publishing rooting steps. Root methods depend on your exact model and firmware, updates close them, and a mistake can brick a TV and void its warranty. If you want to go down that road, start with the project pages above and check your model on CanI.RootMy.TV first.

What you can actually do

You don't need root to cut most of this down. Pick the level you're comfortable with.

1. Turn off what you can in settings. Menus vary by model and year.

• Samsung: Settings → All Settings → General & Privacy → Terms & Privacy. Turn off Viewing Information Services and Interest-Based Ads, and turn off voice wake-up if you don't use it.
• LG: Under User Agreements, withdraw the Viewing Information and advertising agreements. Under General → System → Additional Settings, turn off Home Promotion, Content Recommendations and Screen Saver Promotion.
• Google TV (Sony, TCL and others): Turn on Apps Only Mode to remove most promoted content.

Given the Northeastern results, treat these toggles as reducing collection, not ending it.

2. Isolate the TV on your network. Put it on a guest or IoT network. log4j recommends this himself: if the TV can't see your phones and laptops, it can't map them. A DNS filter like Pi-hole or AdGuard Home can also block known tracking and ad domains for the whole house.

3. Take it offline. Disconnect the TV from Wi-Fi and Ethernet, forget the saved network, and use a separate streaming box or console for apps. With no connection, the TV can't send anything or download new ad features. You're still trusting whatever box you plug in, but you get to choose it.

4. Check what you buy next. Look at how a brand handles opt-outs and ads before you pay, not after. Based on the Northeastern results, opt-outs on LG, Sony, Fire TV and VIDAA did what they said in testing. That's a low bar, and it's worth knowing who clears it.

Who owns the glass

The defense from the industry is always the same: TVs are cheap because the data pays for them. Maybe. But a $3,000 flagship OLED isn't cheap, and it still shows ads over your console and maps your network.

What 2026 has made clear is that when you buy a smart TV, you're buying a screen you control for exactly as long as the manufacturer lets you. The features change after purchase. The privacy switch may or may not be connected to anything. The consent screen was designed to be clicked, not read. And the only place where any of this has been forced to change is a single US state, for two brands.

LG's ad executives said it out loud: they own the glass. The researchers, the rooting community and the regulators who are finally asking questions are all arguing about the same thing. It's your living room. It should be your glass.

This piece is based on reporting and research published up to November 4, 2026. Claims attributed to log4j have not been independently verified. Samsung, LG, Hisense and VIDAA were not contacted directly for this piece; their positions are taken from their public statements, including the statement Samsung gave other outlets after log4j's posts.