Gamers Nexus found LG TV sets still scan a household’s entire Wi-Fi network and can capture microphone audio while appearing off or unplugged from the internet.
LG settled with Texas regulators in May, agreeing to stop collecting viewing data without informed consent.
Separate security researchers found unpatched remote-access bugs and residential-proxy code, software that quietly reroutes strangers’ internet traffic through a buyer’s home connection.
What does an LG smart TV do when nobody’s watching? Digital media company and popular YouTube channel Gamers Nexus spent more than 500 hours and about $70,000 finding out. The answer, per a new investigation, is a lot more than advertised.
Working with hardware reviewer Level1Techs and three independent security researchers, the team found LG’s sets scanning a home’s entire Wi-Fi network using UPnP, a protocol that lets devices find and talk to each other automatically, mapping every phone, laptop, and smart device connected to it.
In one test, they pulled clean microphone audio off a TV with a dark screen, then did it again after yanking the set off the internet entirely. LG signed a privacy settlement with Texas regulators four months before any of this ran.
Most of the tracking runs through Automatic Content Recognition, or ACR, software that samples what’s on a screen or coming through the speakers, turns it into a digital fingerprint, and checks that against a reference database to identify what’s playing, according to Malwarebytes‘ review of the findings.
Gamers Nexus found LG’s version keeps working even when a TV is used purely as an HDMI monitor for a laptop. Switching inputs doesn’t switch it off.
The TVs are also capable of scanning the network and mapping out all the devices connected to it.
Researchers muted a TV’s main microphone through the settings menu, then pulled a usable recording off a second, hidden microphone the mute switch never touches. So much for the mute switch.
In another test, they left a TV unplugged from ethernet, spoke near it, and watched it upload the stored audio the second it reconnected, picking up speech from roughly 60 feet away through a wall.
Voice commands get converted to plain text and saved in on-device logs. The microphone stays live for 10 to 15 seconds after someone stops talking, catching whatever the room says next, whether or not anyone addressed the TV. LG told reporters in July that its sets “do not collect, record, or store ambient conversations.”
The footage says otherwise.
LG’s ad executives are refreshingly honest about the payoff, at least on camera. Multiple LG Ad Solutions leaders are shown saying the company “owns the glass,” and they mean it: the pitch to advertisers is tying a household’s TV habits to the phones and other devices under the same roof.
Per the company, you bought the television. LG owns what it sees.
That data runs through Alphonso Inc., the ACR partner LG took a controlling stake in back in 2021 and has been locked in lawsuits ever since. LG Ad Solutions’ president of global ad sales, Serge Matta, previously ran ad-measurement firm Comscore, which the SEC charged in 2019 with inflating revenue by roughly $50 million. Matta personally paid a $700,000 penalty, repaid Comscore $2.1 million, and accepted a 10-year ban from running a public company.
Nobody said anything about a private one.
Security concerns
Researchers also found remote-code-execution bugs, flaws that let an attacker run their own commands on a TV from across a network, that LG hasn’t fully patched. One trick fools the TV’s built-in browser into pairing with a fake mobile-device pop-up, handing over remote access without anyone touching the set. LG asked researchers to hold technical detail while disclosure is still in progress.
A hacked TV isn’t just a listening device. Security firm Spur found residential-proxy code, software that quietly reroutes someone else’s internet traffic through a buyer’s home connection so it looks like ordinary household browsing, tucked inside roughly 42% of apps on LG’s webOS store, per Krebs on Security. LG senior vice president John Taylor said the company is working with developers to strip it out or suspend the apps that carry it.
LG’s television and account agreements run past 30,000 words combined, or roughly three to four hours to read at an average pace. Days after Gamers Nexus published its first LG report in July, LG added a forced-arbitration clause to those terms, blocking buyers from suing in court or joining a class action. Convenient timing.
In May, Texas Attorney General Ken Paxton announced a settlement requiring LG to get informed consent before collecting ACR viewing data and to give users a clear opt-out, following a December lawsuit that also named Samsung, Sony, Hisense, and TCL. Gamers Nexus found the Do Not Sell My Personal Information toggle still off by default, before a buyer connects to the internet or agrees to anything. So much for that.
This seems to be a recurring issue with tech companies that decide to compromise privacy for convenience. From Meta’s AI glasses recording strangers without consent to millions of people rushing to delete their data from ChatGPT this spring over privacy issues. Gamers Nexus says it is now crowdfunding a follow-up investigation into Samsung, Vizio, and other smart TV brands, while Texas’ cases against Sony, Hisense, and TCL remain open in court.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
