200 Million LG Smart TVs: Device Tracking and Voice Log Controversy

Legacy TVs and the 200 Million Problem

On the first week of September 2026, a new investigation video by hardware reviewer Gamers Nexus was released. The title is the slightly exaggerated "216 Million Spy TVs."

LG smart TVs are scanning devices around them and keeping records of voice commands, raising concerns alongside security researchers.

Source: Gamers Nexus YouTube Video

Here, 216 million units refers to the entire installed base of connected smart TVs that LG Ad Solutions claims to reach. The core of the investigation is as follows. Even without opt-out consent, basic data collection occurs, and advertisers can confirm purchasing intent, meaning voice whispers, screen content, and more can be exposed.

The data collection itself and the post-hoc "settlement" are clearly separated and analyzed. It also shows how far IoT device business models can be twisted.

ACR Fingerprints Viewing Without Permission

The biggest issue is ACR (Automatic Content Recognition). In short, it fingerprints video images or audio streams to create a "private viewing log" linked to a viewer database and matching technology.

I haven't reviewed the original document in full. Even with just small screen fingerprints—just luminance values from small frames—it can identify "what movie is playing now."

The issue also becomes problematic when monitors connected via HDMI are displayed. Even if you run TV as a monitor, the fingerprinting can still be created.

Confirming the appendix, methods to create audio fingerprints were also clearly identified. Using FFT (Fast Fourier Transform) on 40 audio clusters across 100 milliseconds after an 8kHz monitor, and matching the results to a database.

The advertising products operated by LG Ad Solutions connect this viewing data to other devices of the same household. Following the TV-viewing content, household composition, and device information, advertising delivery expands to mobile as well.

There's a business that connects ads to TVs and smartphone screens and merges automatic viewing data with third-party data. The phrase "We own the glass," repeated by advertising executives, summarizes this well.

Finding Devices Inside and Outside the Screen

The TV doesn't just watch its own screen. Test TVs repeatedly scanned the LAN cable and discovered at least 38 other devices.

3D printers, public access points, internal servers, network switches, routers, and employee phones, tablets, smart watches, and more. Some used usernames and were identified, and even equipment of employees who didn't participate in the test was listed.

Identified information included device names, MAC addresses, internal IP addresses, and password candidates. Neighboring WiFi names, channels, and access point information were also read.

The investigation notes that such scanning can overlap with normal features like network sharing automatic search and target advertising, and warns about it. Neighboring WiFi information can also be used to determine location without GPS, effectively functioning as location tracking data.

Even If Opt-Out, Surveillance Persists

"You might think opting out helps, but the measured data tells a different story. Even during a 1-hour test with an LG G3 that wasn't fully opted out, ACR collection and transmission continued after opt-out."

Connected to 8 endpoints including LG customer data, smart advertising platforms, and transmitted about 8.9MB.

If you simply calculate this for a month, it's about 6.4GB.

Data explodes after opt-out. The same G3, when monitored for 29 days, connected to a total of 107 endpoints, with only 44 being Alphonso ACR connections.

Original measurement requests were repeated at intervals of 75-90 seconds, 300 seconds, and 5-10 minutes. Only ACR data alone accumulated to about 4GB per month going to LG.

DNS queries also revealed that channel names are being leaked. When watching channels like CNN US and NBC News Now on LG Channels, DNS queries that can identify those channels are generated.

Similarly, LAN observers or ISPs could learn the viewing channel through this, meaning surveillance is possible even without internet—a different kind of threat.

Voice Logging and Mic Feature Gaps

There are also problematic parts in regular use. If you look at normal voice features, voice input was transmitted in plaintext and stored in memory logs.

The logs had to be accessed via system access rights, but voice files were generated without separate notice. Birthday, social security number disclosures, and conversations not directly spoken to the TV were also logged.

After the 'Hi LG' wake word, input contents were retained longer than expected, and even conversations occurring within a few meters of the TV during phone calls were collected. Mic sensitivity during testing leaked about 60-70 feet (about 18-21m) away, including through walls.

LG claims the TV does not collect, record, or store all conversations, and that voice features only process specific requests activated by the user and are protected. But the investigation found that even after wake-up, other people's conversations continue to be transmitted, contradicting this explanation.

Removing the mic isn't the only solution. Even with the internal mic disabled, audio could still be accessed via HDMI, Bluetooth, USB webcam, and other audio inputs.

The remote's lost-and-found feature also continued to work. 'Mic removal' and 'all sound blocking' are different issues.

What If the Screen Is Off?

The situation becomes even more absurd after disconnecting the TV. Even while appearing off, USB webcams could still record video and audio.

When disconnecting the network of the LG G5, which had started recording, recording and storage continued, and after reconnection, about 30 minutes of audio was copied and regenerated. Only covering the camera with a post-it during the meeting couldn't block the recording.

Test TVs had 16GB of flash storage and relatively strong computing power, using about 4GB in default state. Video recording, audio recording, and streaming are possible, and with a 256GB USB, long-term recording is also possible.

Simple advertising requests include device information retrieval, internal chip access control, firmware usage, and more.

More seriously, "functional availability" is an issue. Such recording and transmission are impossible to verify without purchasing intent, and there is no proof that LG is not doing similar recording by default.

The detailed contents of the opt-out are not yet publicly known as the investigation is ongoing.

43% of webOS Apps Are 'Household Profiling' Recommended

Security company Spur found that out of 2,851 webOS store apps in June 2024, 1,213, about 43%, could be used as household profiling TVs.

Household profiling is technology that connects external tag data to data controllers at specific advertiser IP addresses rather than data centers. The TV may act as an intermediate node leaking the home's real IP.

Spur noted that insufficient attention is being paid to proportionality, locality, and platform security in this area, and that it has been overlooked. LG did not develop a proper way to use profiling, and developers are warned that if they don't provide appropriate options, the app will be rejected and returned.

Gamers Nexus noted that 1,200 apps with related SDKs have issues with store approval and security.

What Can Be Done Today

LG isn't doing nothing. LG stated that 2022 ACR data related to personal information regulations was collected in an anonymized, pseudonymized way and disclosed in the privacy policy.

The investigation says the device design and collection scope contradicts this explanation and criticizes it. While some traffic to LG is encrypted, the actual transmitted content could not be confirmed. "Everything is true" remains an uncheckable scope.

The practical guide written by the investigation is clear. If possible, separate all LG smart TVs from the network, and connect streamers to external devices (game consoles, cameras, mini PCs) via HDMI instead.

If the TV is already connected to the internet, data flow may start after an opt-out agreement, so you should disconnect before changing settings. Once transmitted data cannot be retrieved.

Since internal mic drivers intercept all audio inputs, to physically block internal mic calls, you need to use a mechanical switch. It's also recommended to set the Wi-Fi password announced to the TV to an incorrect value.

In the event of a node-type hack where the TV doesn't automatically connect, it's effective to remove the connected network from the list.

This investigation specifically targets LG. Smart TVs with cameras, microphones, advertising SDKs, etc., all pose privacy model risks.

Manufacturers should raise the standards of data collection, and users need to be clearly aware of network boundaries.

Reference Links

• Gamers Nexus Investigation Video — 216,000,000 Spy TVs
• GeekNews Thread — 200 Million Surveillance TVs