Why Smart TVs Can Be Security Risks

Your TV may be watching what you watch — every 500 milliseconds, by default. Here's what that actually means, and the settings that turn it off.

By TechODash.com  ·  11–13 minute read  ·  Published 2026

Smart TVs occupy an unusual position in the smart home risk picture. The security vulnerabilities covered in Guide 1 of this series apply to them like any other device, but TVs carry an additional layer most people never think about: a feature called Automated Content Recognition, or ACR, that identifies and logs what you're watching — and this has become a genuine, active legal issue in 2026, not just a theoretical privacy concern.

This guide covers both layers — the network security basics that apply to your TV like any smart device, and the ACR-specific privacy settings that are unique to this category.

This guide is for anyone with a smart TV — which by 2026 describes the overwhelming majority of televisions sold — who wants to understand what their TV actually collects and how to limit it.

What ACR Actually Does

Automated Content Recognition identifies what's displaying on your screen in real time — not just what you stream through the TV's own apps, but content from cable boxes, gaming consoles, and any other HDMI-connected device. It works by analyzing the screen and matching it against a database, similar to how music recognition apps identify a song.

The data collected isn't limited to simply what you watched. It can include how long you watched it, whether you skipped or rewound sections, and contributes to a household viewing profile that gets used for targeted advertising. Most TVs ship with this enabled by default, and the setting is rarely prominent in the initial setup process.

This Has Become a Real Legal Issue, Not Just a Privacy Theory

In late 2025 and through 2026, the Texas Attorney General filed a series of lawsuits against Samsung, LG, Sony, Hisense, and TCL specifically targeting ACR practices, alleging viewing data was collected and monetized without proper consent. Samsung settled, agreeing to stop collecting ACR data from Texas residents without explicit, informed consent and rewriting its on-screen privacy disclosures. LG settled separately in May 2026, agreeing to clearer disclosure and opt-out mechanisms — with an added provision specifically prohibiting the transfer of viewing data to the Chinese government, given LG's manufacturing relationships.

As of mid-2026, lawsuits against Sony, Hisense, and TCL remain active and unresolved. Kentucky became the first state to pass dedicated ACR privacy legislation, requiring explicit consent before a smart TV can collect viewing data — passed nearly unanimously, which suggests more states are likely to follow.

The practical takeaway: regulation is actively catching up to this practice, but coverage varies significantly by state and by manufacturer settlement terms. Don't assume your TV has stopped tracking just because you've heard about these cases — check your specific settings regardless of where you live or which brand you own.

How to Turn It Off

The exact menu path varies by manufacturer, but the setting exists on every major smart TV brand. Look in your TV's settings under labels like:

• "Viewing Information Services" or "Viewing Data" (Samsung)
• "Live Plus" (LG)
• "Automatic Content Recognition" directly (most other brands)
• "Interest-Based Advertising" or "Personalized Content" — a related setting worth disabling at the same time

Turn off all of these where present. It's worth checking again after any major software update, since some manufacturers have a history of re-enabling data collection settings during updates.

A VPN Helps Less Than People Assume

A VPN encrypts the connection between your network and the VPN server, which prevents your ISP from logging which ACR servers your TV is contacting. It does not stop the ACR servers themselves from receiving and recording whatever your TV is sending them, since that data leaves your TV before it reaches the VPN tunnel in most consumer setups. A VPN is genuinely useful for broader network privacy, but disabling ACR directly in your TV's settings is the actual fix for this specific issue — not a substitute.

Don't Forget the Network Security Basics

Beyond ACR, your smart TV is still a connected device with the same fundamental risks covered in Guide 1 of this series. Change the default password on any TV account, keep firmware updated, disable voice control features you don't use, and place it on a separate guest network away from your main devices. A TV that's privacy-conscious but still running outdated firmware on your main network hasn't actually solved the bigger risk.

The FCC's Cyber Trust Mark program, rolling out through 2026, places a shield logo with a scannable QR code on devices meeting baseline security standards — letting you check what data a device collects and how long it receives security updates before you buy, rather than discovering it after the fact in a settings menu.

Smart TV Checklist

Where to Go From Here

ACR is one specific risk unique to smart TVs. The broader security fundamentals apply across every device in this category.

Sources

Malwarebytes — Samsung Texas ACR settlement details
LegalClarity — ACR lawsuit and settlement tracker (Samsung, LG, Sony, Hisense, TCL)
ModemGuides — Kentucky ACR law and state-by-state status
The Global Frame — FCC Cyber Trust Mark program overview

Privacy settings matter most alongside real network isolation.

The SOHO 2026 Guide covers the complete network architecture for home offices and small businesses — segmentation, device isolation, and Wi-Fi optimization. Written in plain English. Built on 25+ years of real-world IT experience.

TechODash.com

Calm, practical guides for remote workers, content creators, and small business owners who want networks that work reliably and safely — without the enterprise complexity. Built on 25+ years of hands-on IT experience.