From London: There is a reasonable assumption most people make when they sit down in front of their television: that the screen is a one-way affair. You watch it; it does not watch you. That assumption, researchers and regulators on both sides of the Atlantic have confirmed, is badly out of date.
The technology responsible is called Automatic Content Recognition, or ACR. Built into smart TVs at the chipset level, ACR can identify almost any kind of content appearing on screen, including movies, television episodes, advertisements, games, and live sport, regardless of the source feeding it. It does not matter whether you are streaming through Netflix, watching free-to-air through an antenna, or playing a game via an HDMI-connected console. ACR records everything, including security camera feeds, personal photo slideshows, or content cast from a phone or played via a connected device.
Think of it as Shazam for your living room, except that unlike the music app, nobody has asked for your permission to keep it running. Just as Shazam identifies songs by analysing brief audio samples, ACR identifies video content by capturing what is displayed on screen. Unlike Shazam, which a user activates intentionally, ACR runs continuously in the background, whether users know it or not.
Who Is Collecting What
Smart TV manufacturers work with their advertising technology partners to construct detailed consumer profiles based on ACR data and to target future advertising on that basis. The data does not simply stay with the manufacturer either. Large amounts of data can go to TV manufacturers, streaming services, advertisers, and data analytics firms. One striking illustration of how lucrative this model has become: it was reported in November 2021 that smart television manufacturer Vizio profited more from the sale of its customers' data than from the televisions it sold.
University researchers who tested LG and Samsung sets in 2024 found the scale of this surveillance was not trivial. Tests conducted in the UK and the United States showed that LG devices were sending digital fingerprints every 15 seconds and Samsung devices every minute to external network domains. That is a constant stream of household viewing data being transmitted to servers, in many cases without consumers having consciously agreed to it.
The legal pressure has been building. In December 2024, Texas Attorney General Ken Paxton filed lawsuits against five major TV manufacturers, namely Samsung, Sony, LG, TCL, and Hisense, alleging they unlawfully collected personal data through ACR technology. The lawsuits alleged smart TV manufacturers did not adequately provide meaningful notice about this scope of monitoring and instead focused on disclosures during the device's setup. A similar case a decade earlier, brought by the US Federal Trade Commission against Vizio, resulted in a US$2.2 million fine, though the core issue at stake then was inadequate disclosure rather than any prohibition on the tracking itself.
The Consent Problem
For those who take privacy seriously, the most troubling aspect of ACR is not that it exists but that opting out is made deliberately inconvenient. Public awareness of ACR is low, due in part to manufacturers' practice of burying information about it deep in terms and conditions. Manufacturers like LG and Samsung bundle ACR with smart services that request blanket consent during setup, burying tracking permissions within lengthy user agreements.
The process of switching ACR off, once a consumer discovers it exists, varies considerably by brand and is rarely straightforward. Consumer Reports documented that disabling LG's equivalent feature entirely took 27 clicks. Samsung calls its ACR system "Viewing Information Services" and buries the toggle under Settings, Support, Terms and Privacy, and then Privacy Choices. Particularly troubling is one detail reported by researchers: firmware updates can quietly reset privacy settings, including ACR configurations. Manufacturers typically package ACR within broader user agreements or settings menus, which can change after an update. When new firmware installs, it may revert previously disabled ACR functions to their default, active state without prompting the user to review the changes.
The strongest counter-argument from the industry is that ACR enables genuinely useful features, from personalised content recommendations to the ability to resume a live broadcast from the beginning. Samsung has also argued that its approach is more restrained than critics suggest. A Samsung spokesperson stated that the company provides consumers with the choice to explicitly opt in to receive targeted advertising, and does not follow a default opt-in approach, with user preferences governing how data is processed to serve personalised ads. That defence carries some weight: there is a meaningful difference between opt-in and opt-out systems, and not every manufacturer's approach is identical.
What Australian Viewers Can Do Now
For Australians watching this from home, the practical steps are available regardless of brand. On a Samsung TV, disabling ACR means finding Settings, then navigating to All Settings, Terms and Privacy, Privacy Choices, and unchecking the Viewing Information Services box. LG uses the term "Live Plus" for its ACR technology; to turn it off, press the settings button on the remote and head to All Settings, General, System, then Additional Settings. On Roku-based sets, including many TCL models, selecting Smart TV Experience and disabling "Use Info from TV Inputs" turns off ACR for content from external devices. Disabling ACR will not remove all data collection from streaming apps, which maintain their own tracking, but it does substantially reduce the most invasive layer of household surveillance.
The regulatory context in Australia is shifting. The Office of the Australian Information Commissioner has new enforcement powers under the Privacy and Other Legislation Amendment Act 2024, with the OAIC focusing regulatory activities on privacy harms arising from online platforms and services, including opaque information-sharing practices. Separately, from 4 March 2026, the Cyber Security (Security Standards for Smart Device) Rules 2025 will introduce mandatory cybersecurity standards for most smart devices acquired in Australia by a consumer. Those rules address security vulnerabilities rather than data collection consent directly, but they signal a government that is at least beginning to treat connected devices as a regulatory priority.
The question of how far government should go in mandating privacy-by-default settings on consumer electronics is a legitimate one. A blanket prohibition on ACR would cost broadcasters and manufacturers a revenue stream that, in part, funds the subsidised hardware prices Australians enjoy. Personalisation, when genuinely consented to, has real value. The Australian Competition and Consumer Commission has spent years examining digital platform data practices, and has identified a number of challenges that consumers face in controlling how their data is collected and used across digital services, as that problem continues to grow as digital ecosystems expand.
The reasonable middle ground is not a ban on ACR but a meaningful, informed, and easy-to-exercise choice. Consent buried in a setup wizard or reset by a firmware update is not consent in any practical sense. Requiring opt-in rather than opt-out for ACR, and prohibiting manufacturers from reverting privacy settings during updates, would protect individual liberty without dismantling the advertising model that keeps smart TVs affordable. In the meantime, the most practical thing any Australian can do this weekend is pick up the remote, find the settings menu, and start reading. What is there may surprise them.