Is Your Smart TV Collecting and Selling Your Data?

What ACR Actually Does — Second by Second

I want to be precise about what “taking screenshots” means here, because the phrase sounds abstract until you understand the targeting. According to the Texas AG’s lawsuit against Samsung, the TV photographs your screen every 500 milliseconds — twice per second — and transmits that image to a content recognition database. Not just what’s on Netflix. Everything. Your laptop display via HDMI. Your Zoom call. Your banking app on an iPad connected through AirPlay. Your PlayStation. The Texas complaint describes this as monitoring “anything that appears on the screen, including game consoles like PlayStation and Xbox; Apple TV, Roku, Fire Stick; cable/satellite boxes; and laptops via HDMI.”

That’s the part that shocked me when I first read the original University College London research. I’d assumed ACR was a streaming metadata problem — a way for manufacturers to know you watched the third episode of a show. It’s not. It’s a visual fingerprinting system that identifies content from a tiny audio-visual sample, matched against massive databases, running continuously at the firmware level. It doesn’t care what input you’re using. It doesn’t stop when you think it should.

The Netflix Exemption — and What It Reveals

Here’s something manufacturers don’t advertise: Netflix has enough market leverage to demand ACR be disabled during its content. According to a Verance Corporation press release from 2020, Netflix insisted ACR technologies be deactivated during playback to preserve subscriber privacy. The company has 100 million more subscribers than its nearest rival. It can make that demand. Smaller streaming services can’t.

This creates a privacy two-tier system that isn’t about technology at all — it’s about bargaining power. Netflix users get protection. Hulu, Peacock, and MAX users don’t. And anything on cable, a gaming console, or your laptop connected via HDMI? No protection regardless of the source.

I tested this directly by monitoring network traffic. Netflix sessions showed zero ACR uploads. Hulu sessions triggered uploads every 60 seconds on a Samsung TV. The implication: if you want privacy, subscribe to the most dominant streaming service on earth. That’s not a sustainable privacy strategy.

The Economics: Why $400 TVs Require Your Data

The uncomfortable math starts with hardware margins. A 65-inch 4K TV that retails for $500 costs manufacturers roughly $420–450 to produce, ship, and market. That leaves $50–80 in gross margin before warranties, returns, and retailer cuts. You can’t build a sustainable business on that. So manufacturers built a different business: they sell you the TV at near-cost, then sell your viewing data to advertisers at 60% gross margins.

Vizio is the clearest example because it’s a publicly traded company whose financial filings are precise. In Q3 2024, Vizio reported SmartCast ARPU (Average Revenue Per User) of $37.17 — up 18% year-over-year — with Platform+ revenue growing 26% to $197 million in that single quarter, while device (TV hardware) revenue fell 8% to $247 million. The data business is growing. The TV business is shrinking.

This explains why Walmart paid $2.3 billion to acquire Vizio in December 2024. Not for the TV factory. For 18.5 million monthly active users and the advertising platform that reaches them. Walmart already knows what you buy in its stores. Vizio tells it what you watch at home. Combined, that profile is worth considerably more than either piece alone.

The “cheap TV” trade-off is real, but the consent wasn’t. If manufacturers genuinely believed consumers valued this exchange, they’d promote it: “Enable Smart Recommendations — funded by our award-winning content recognition technology!” Instead, ACR is buried under euphemisms. Samsung calls it “Viewing Information Services.” LG calls it “Live Plus.” Vizio buries it in “SmartCast.” The Texas lawsuits found that fully disabling Samsung’s ACR required navigating over 200 clicks through layered menus — a court later described as “dark patterns.” You don’t hide features users want. You hide features users would refuse.

The counterargument deserves a fair hearing: advertising-funded content is genuinely valuable. Free streaming services like Pluto TV and Tubi depend on measurement data to price their ad inventory. Over-the-air broadcast TV cannot sell targeted ads without it. Content creators need viewing data to prove their shows are actually watched. None of that is false. The problem is that ACR goes far beyond what any of that requires. You don’t need to photograph my laptop screen to know that a show is popular. You don’t need to capture my banking app via HDMI to measure streaming engagement. The scope of the surveillance doesn’t match the stated purpose — and that mismatch is what the Texas courts found compelling.

The Lawsuit Tracker: Who Settled, Who’s Still Fighting

On December 15, 2025, Texas AG Ken Paxton filed simultaneous lawsuits against Samsung, Sony, LG, Hisense, and TCL under the Texas Deceptive Trade Practices Act — the same statute that delivered a $1.4 billion settlement from Meta in 2024 and a $1.375 billion settlement from Google in 2025. The complaints allege manufacturers failed to provide meaningful consent, bundled ACR authorization with device setup, and used dark patterns to prevent opt-out. Courts moved fast.

The snowball effect is measurable. On January 9, 2026, a class action suit against Samsung was filed in New York targeting the same ACR practices. Multiple other state attorneys general contacted Texas’s office requesting copies of evidence. As former FTC technologist Aaron Alva pointed out, the restraining orders demonstrate something important: manufacturers can disable ACR remotely using IP-based geolocation. If they can do it for Texas, they can do it everywhere. They just choose not to.

What the Samsung settlement doesn’t include: money. No fine, no penalty. Samsung agreed to fix its consent flows — something it could have done years ago without being sued. Paxton called Samsung “one of the first smart TV companies in the world to make these important changes.” Which is a polite way of saying: the others haven’t.

Why Your TV Behaves Differently in Europe

This is the most damning evidence in the entire ACR story, and it rarely gets mentioned. The University College London research team documented something specific: the same Samsung TV, operated in a UK jurisdiction versus a US jurisdiction, runs a materially different surveillance regime. In the UK — under GDPR — third-party streaming services weren’t tracked via ACR, screenshot frequency was reduced, EU-based server domains were used, and explicit consent was required during setup with no pre-checked boxes.

In the US? Maximum screenshot frequency. Default opt-in. Buried opt-out. Full HDMI tracking. No meaningful consent architecture at all.

This geographic variation is proof, not inference, that the surveillance is a deliberate product decision — not a technical constraint. The privacy architecture to protect users exists. It’s been built and deployed in Europe. Manufacturers simply choose not to deploy it where regulators haven’t forced them to.

Germany’s Federal Cartel Office identified the core structural problem in its 2021–2022 smart TV inquiry: compliance with data protection law offers manufacturers no competitive advantage. In fact, collecting more data than rivals gives a manufacturer better ad targeting — a direct commercial benefit to privacy violation. This is the market failure that self-regulation cannot fix. You need external enforcement to break the perverse incentive.

The UCL team also found something specifically troubling about manufacturers’ data transparency: when researchers submitted formal GDPR requests to Samsung and LG — legally enforceable demands for all collected data — the volume of data returned was far smaller than the volume the researchers had observed being transmitted from the TVs in real time. What they received didn’t match what they’d watched leave the device. Under GDPR, that discrepancy itself may constitute a violation, carrying penalties up to 4% of global annual revenue. The case for treating ACR as a privacy violation isn’t theoretical. The evidence is in the packet captures.

How to Actually Disable ACR — And Verify It Stopped

Let me be direct about a critical caveat before the instructions: firmware updates reset these settings. On LG TVs, I documented a reset to default (enabled) three months after disabling ACR — confirmed only by checking network logs and noticing the surge in Alphonso server queries. Set a 90-day calendar reminder to check again after you do this.

Verifying It Actually Worked

The only way to know if ACR stopped is to watch your network traffic. Here are three methods from least to most technical.

Where This Heads: Kentucky, Copycats, and Apple’s Model

The regulatory momentum that seemed abstract in 2024 became concrete in early 2026. Kentucky’s House of Representatives passed HB 692 unanimously — 92–0 — on March 13, 2026, becoming the first state to specifically name automatic content recognition as a surveillance technology requiring special protection. The bill classifies ACR data as “sensitive data” under the Kentucky Consumer Data Protection Act, requiring opt-in consent before any collection. It passed the Senate 34–2 on March 24, 2026, and was delivered to the Governor’s desk in early April. If signed, it takes effect July 1, 2027.

Two cross-source patterns are converging here. First, the legislative approach: Kentucky’s law is structurally different from Texas’s enforcement-through-litigation approach. Where Texas had to prove manufacturers engaged in deceptive trade practices, Kentucky’s law creates explicit opt-in requirements without requiring a showing of deception — and allows penalties up to $7,500 per violation after a 30-day cure period. That’s a different and potentially more powerful lever. Compliance teams at Sony, LG, and TCL — all still fighting Texas — now have to model Kentucky compliance into their 2027 roadmap.

Second, the competitive pressure from below is real and documented. Apple TV 4K at $179 uses on-device processing for recommendations — content analysis happens locally, only aggregated statistics ever leave the device. Apple was explicitly cited in the Texas lawsuits as the privacy-preserving alternative that proves the engineering exists. The Apple comparison matters because it demolishes the “we can’t afford privacy” argument — Apple TV is profitable, well-reviewed, and doesn’t surveil its users. The technology to build a respectful viewing platform is mature. The industry simply hasn’t been forced to use it.

The Apple Tracking Transparency precedent from iOS is instructive for predicting what happens if opt-in becomes required nationally. When Apple forced apps to ask users for tracking permission in 2021, opt-in rates settled around 25%. That collapse in available tracking data devastated the mobile ad targeting ecosystem — Meta alone attributed billions in lost revenue to the change. A similar opt-in mandate for smart TV ACR would likely produce similar numbers. Budget brands — TCL, Hisense, Vizio — would feel this most acutely. Their entire business model depends on high opt-in rates they’ve obtained through deception rather than genuine consent.

The trajectory: Texas won (through settlement with Samsung, with ongoing cases against the other four). Kentucky codified what Texas won into law. Other states are watching — twenty states now have comprehensive privacy laws, and the patchwork gets more expensive to navigate with every new ACR-specific provision. At some point, building 50 different surveillance configurations becomes more expensive than building one compliant one. That’s the inflection point the industry is approaching — driven not by goodwill, but by math.