A comprehensive study conducted by Northeastern University has uncovered significant privacy concerns related to automatic content recognition (ACR) technology in U.S. smart TVs. The research, which analyzed 12 smart TVs from 10 manufacturers representing 95% of the U.S. smart TV market, found that 82% of U.S. households own smart TVs capable of taking screen snapshots and reporting them back to content recognition providers. The study measured where this data goes and whether turning off the feature actually stops data collection. Researchers discovered that ACR technology is active during antenna broadcasts on every TV tested, but does not track Netflix or YouTube content, which aligns with publicly reported agreements. However, Tubi, a free ad-supported streaming service, was tracked on Tizen OS and Google TV. Most operating systems also tracked their own built-in streaming services, with exceptions including Fire TV OS and Google TV on Sony. The study found that opting out of ACR does not always work as intended: Samsung’s Tizen OS continued to send ACR traffic after opting out in 41 of 60 antenna runs, and Vizio’s SmartCast OS sent ACR-pattern traffic even when the TV was idle on its home screen. The research also revealed that VIDAA OS sends unencrypted ACR data containing permanent device IDs, time zones, app names, input sources, and content categories, exposing sensitive information to anyone on the network path. Additionally, Vizio’s WatchFree+ streaming service reveals program titles through unencrypted DNS queries and SNI, which cannot be turned off. The study concludes that ACR should be fully disabled when users opt out, and recommends that manufacturers authenticate and encrypt all ACR traffic, list all inputs ACR monitors in privacy policies, and stop embedding viewing data in web addresses. The researchers also provided a blocklist for users to prevent ACR data collection on systems where opting out doesn’t work.