How to know if your smart TV is spying on you

Have you ever wondered how smart TVs are so much more affordable than they used to be? Unfortunately, the answer isn’t that the TV companies are just being nice. The real reason is that smart TVs harvest your data and sell it to third parties.

Whenever you watch a show, download a movie, or buy a new game, your TV is watching you. It collects, processes, and sends that information right back to the TV company so it can be sold to advertisers.

And even worse than that, smart TVs can be vulnerable to hacking by cybercriminals, who can use your TV’s camera and microphone to record you without your knowledge.

I put this guide together to help you take control over how your TV is using your information, prevent smart TV cyber threats, and improve your overall privacy.

How smart TVs can spy on you

Smart TVs have an entire ecosystem based on collecting and trading your data. Often, the physical devices are sold at a loss or at break-even prices. The vast majority of the profits that a smart TV company generates are from data analytics, meaning they have heavy incentives to track you.

Here are a few of the ways smart TVs harvest your data.

Built-in microphones

Many smart TVs include always-on microphones. This means that everything that you say in front of the TV could potentially be recorded by your TV company.

If you’ve ever seen an advertisement for something soon after talking about it, that might be why. By signing the Terms of Service and not adjusting your privacy settings, you may have already given the company permission to spy on you.

Even worse, a cybercriminal might access your TV, for example, via a phishing attack or by exploiting a software vulnerability. Depending on the nature of the compromise, they could record your conversations, too.

Automatic Content Recognition (ACR)

Automatic Content Recognition (ACR) is a technology embedded in many smart TVs that tracks everything you watch, including streaming services, cable TV, DVDs, and even what video games you play. It’s not just logging your habits, either: it’s actually watching your screen and fingerprinting the content.

The service then uses this information to give you tailored recommendations. It also gets sent to streaming services and data brokers to build profiles and run targeted ads. Both of these have implications for your privacy.

ACR typically runs in the background and can be difficult to disable without navigating into your privacy settings, but disabling it is one of the most effective ways to reduce automatic data collection.

Data sharing with third parties

As mentioned above, smart TVs often transmit viewing history, location data, device IDs, and app usage patterns to manufacturers’ servers. These companies frequently share or sell this data to third parties, which some see as a privacy violation. And while the data gets anonymized, this anonymized data can potentially still be linked back to you.

Some services even allow their partners to track users across devices and services. For example, streaming services are constantly collecting your data and using it to fuel their wider ecosystem of advertisements, personalized content, and cross-app tracking.

Manufacturer agreements and TOS loopholes

When setting up a smart TV, you’ll usually need to agree to the company’s Terms of Service and privacy policy. Unfortunately, these are typically long and full of legal jargon, making it hard for customers to tell what their data is being used for. However, they often include language permitting manufacturers to collect and share behavioral, biometric, and location data.

By agreeing to these terms, you’re often giving the company wide-reaching data collection permissions without realizing it. And if you don’t agree, many smart TVs will remove access to various functions.

How to tell if your smart TV is spying on you

Pop-ups or ads tailored to your private conversations

If you're seeing highly personalized ads on your TV, your TV may be listening to you.

Smart TVs with voice assistant support are designed to only activate in response to certain phrases, but they’re always on standby, passively listening without passing any data downstream to the OS or other apps. However, if the system wrongly detects a “wake word,” it’s possible that whatever it records subsequently can be used for targeted ads.

If ad content feels uncomfortably specific or out of context based on what you’ve watched on your TV, consider disabling voice services and ACR tracking. You can also limit ad personalization in your TV’s privacy settings so it won’t show you tailored ads.

Microphone or camera light flickers unexpectedly

In a majority of newer models, smart TV cameras and microphones respond to voice commands, so it’s possible that the TV picked up audio that triggered a command. While not dangerous, it does mean that the device is potentially recording you and that this recording could be transmitted back to the TV company.

If you notice this behavior consistently, you should disconnect your TV from the internet and disable voice or camera features in settings. Physically covering your camera and microphone can also prevent someone on the other side from observing you. Then, follow all the steps below to secure your smart TV.

Dangers of smart TV spying

While it might not cause immediate harm, a television company spying on you raises serious privacy concerns, especially if they’re selling your data to third parties. And if a criminal is watching you, the consequences can be even more severe.

Invasion of privacy

Smart TVs collect far more data than you might expect, including viewing habits, voice commands, device identifiers, and, in some cases, visual data. This data is usually stored remotely and shared with advertisers or third-party analytics firms who use it for a variety of purposes.

The data can help your TV make better recommendations, but it also comes with some privacy trade-offs. As already mentioned, a lot of TV brands don’t make much money from the device itself, so they often rely on your data to boost their profits.

Targeted advertising and manipulation

Once your viewing data is collected, it's often funneled into advertising ecosystems that tailor content, recommendations, and sometimes even pricing to your behavior. This can influence how you make decisions, such as what you watch and what you buy.

Smart TVs with ACR track your media consumption across platforms and feed that data directly into the servers of advertising conglomerates. Even if it’s only used for advertisements now, the whole process has deep implications for systemic content bias, propaganda distribution, and the harm you could experience if that data were stolen.

Cybersecurity and identity theft risks

Smart TVs, like all devices that connect to your network, can be hacked and used to spy on you. Bad actors can access your TV by learning your router password or exploiting insecure apps and poor network conditions. Once inside, a criminal can access your streaming credentials, microphone, camera, account data, and more.

More advanced attacks might use an exposed smart TV to scan and target other devices on your network, exploiting poorly secured smartphones, laptops, or NAS drives. This kind of extensive access to your sensitive data could even result in identity theft

Real-life examples of smart TV spying

• 2013: LG Smart TVs log filenames from USB drives. LG was found to be collecting filenames and viewing habits through its smart TVs even when data sharing was turned off. The company claimed it was for ad targeting. Public backlash led to firmware changes.
• 2015: Vizio collects viewing data without consent. Vizio was caught tracking millions of users’ activity and sharing it with advertisers without properly informing users. In 2017, the company paid a $1.5 million fine to the FTC and $1 million to the New Jersey Division of Consumer Affairs, with $300,000 of that amount suspended.
• 2015: Samsung warns about private conversations being shared. Samsung’s privacy policy warned that customers using the voice activation feature on their smart TVs might have their personal conversations listened to and shared with third parties. After public outcry, Samsung tweaked the policy to state that it only collected voice commands when users clicked an activation button and spoke into a microphone embedded in the remote and that viewers could turn the voice recognition feature off completely.
• 2019: FBI warns about smart TV surveillance risks. The Portland FBI office issued a public warning that smart TVs could be exploited to spy on users or be used as an attack vector by hackers.
• 2020: TCL vulnerability exposes root access. Security researchers discovered that TCL TVs allowed attackers in the same network to gain full root access and exfiltrate files or install malicious code. After the media began to cover the story, TCL released a security patch that fixed it.

How to stop your smart TV from spying on you

Turn off ACR

Automatic Content Recognition (ACR) allows smart TV companies to monitor your smart TV activity. To disable ACR, navigate to your TV's privacy or system settings and look for the relevant option. It’s one of the most important steps you can take to reduce the amount of personal data the TV company collects.

Disable internet access

If you disconnect your device from the internet, it can’t send out data to an external source. This simple solution prevents tracking, app telemetry, and ACR. You can do this either by turning off Wi-Fi in the TV’s network settings or by blocking the TV’s MAC address in your router’s admin panel.

Obviously, this option can limit your TV’s functionality, but using a streaming box or dongle instead can be a more privacy-friendly alternative.

Disable or unplug microphones and cameras

Many smart TVs have built-in microphones and cameras for voice commands or facial recognition. You can usually disable these options via the settings menu (the process varies depending on the device, so check your TV’s manual).

If there’s no apparent way to turn off your camera, you can use the tried-and-true method of taking some tape and placing it over the camera lens. This will block anyone on the other side from seeing you, but it may not look very sleek.

Use a VPN for your home network

A virtual private network (VPN) encrypts your inbound and outbound data and masks your IP address. This helps protect your privacy and prevents third parties from intercepting your data. It also prevents your ISP and websites from easily tracking your behavior.

ExpressVPN has dedicated apps for several popular smart TV providers, or it can be enabled at the router level to protect all of your devices at once. It also has an airtight and independently audited privacy policy, meaning your data is never logged, stored, or sold to third parties. You can set it up quickly and begin watching TV more privately.

Opt out of tracking in settings

Smart TVs often include options to limit ad personalization and disable data sharing, but these are typically buried deep in the menus. The process will depend on your particular model, but it’s definitely worth opting out to keep your viewing habits more private.

Perform regular firmware updates

Keeping your TV’s firmware up to date is crucial. Security patches fix known vulnerabilities that threat actors can exploit to hack into your TV. Outdated software leaves you exposed to a wide range of cyberattacks.

Most smart TVs have automatic updates enabled by default, but you can make sure by navigating to your settings menu and searching for the update field (the location varies by brand).

Use strong passwords

It’s important to choose strong, unique passwords for the accounts associated with your smart TV, such as streaming apps. A good password should be at least 12 characters and include a mixture of uppercase and lowercase letters, numbers, and symbols. When possible, enable two-factor authentication (2FA) as well to improve your security.

You can use a password manager like ExpressVPN Keys to generate and store passwords in a secure vault so you can protect and keep track of multiple complex passwords.