LG smart TVs may be collecting and processing far more information than buyers realize, according to a new investigation from digital media company and YouTube channel Gamers Nexus. The outlet said it spent more than 500 hours and about $70,000 on the work, teaming up with hardware reviewer Level1Techs and three independent security researchers.
Researchers say LG TVs scan home Wi-Fi networks
The investigation says LG sets scan an entire household Wi-Fi network through UPnP, a protocol that lets devices automatically discover and communicate with each other. In the tests described by Gamers Nexus, the TVs were able to map phones, laptops, and other smart devices connected to the same home network.
The report adds that the TVs are capable of scanning the network and identifying connected devices, extending their visibility beyond the television itself and into the broader household device environment.
ACR reportedly keeps running even in HDMI monitor mode
According to Malwarebytes’ review of the findings, much of the tracking flows through Automatic Content Recognition, or ACR, software. That system samples what appears on a screen or comes through the speakers, converts it into a digital fingerprint, and checks it against a reference database to identify what is playing.
Gamers Nexus said LG’s implementation continues to work even when the TV is used purely as an HDMI monitor for a laptop. Changing inputs, the report said, does not shut the system off.
Tests claim audio can still be captured or uploaded after the screen goes dark or the TV goes offline
In one test, researchers pulled clean microphone audio from a TV with a dark screen. They then repeated the exercise after disconnecting the set from the internet entirely.
In another, the team muted a TV’s main microphone through the settings menu but still recovered a usable recording from a second, hidden microphone. The report says the mute switch does not affect that microphone.
A separate test left a TV unplugged from ethernet while people spoke nearby. Once the set reconnected, researchers said they watched it upload stored audio. The footage cited in the report says the TV picked up speech from roughly 60 feet away through a wall.
The investigation also says voice commands are converted into plain text and saved in on-device logs. After someone stops talking, the microphone can remain live for 10 to 15 seconds, capturing whatever is said next in the room whether or not anyone was speaking to the TV.
Decrypt noted that LG told reporters in July that its sets “do not collect, record, or store ambient conversations.” The new footage, according to the report, points in the opposite direction.
Advertising data practices drew added scrutiny
The article says multiple LG Ad Solutions executives are shown on camera saying the company “owns the glass.” In the report’s description, that sales pitch to advertisers centers on tying a household’s TV viewing habits to phones and other devices under the same roof.
That data pipeline runs through Alphonso Inc., the ACR partner in which LG took a controlling stake in 2021. The article says the companies have been tied up in lawsuits since then.
Decrypt also noted that Serge Matta, president of global ad sales at LG Ad Solutions, previously ran ad-measurement firm Comscore. In 2019, the U.S. Securities and Exchange Commission charged Comscore with inflating revenue by roughly $50 million. Matta paid a $700,000 penalty, repaid Comscore $2.1 million, and accepted a 10-year ban on running a public company, according to the report.
Remote-code-execution flaws remain a security concern
Beyond privacy questions, researchers said they found remote-code-execution bugs that could let an attacker run commands on a TV from across a network. The report says LG has not fully patched those flaws.
One method described in the article tricks the TV’s built-in browser into pairing with a fake mobile-device pop-up, giving away remote access without anyone touching the set. LG asked researchers to hold back technical details while disclosure is still underway.
webOS app store apps were also flagged
The article cites Krebs on Security as saying security firm Spur found residential-proxy code inside roughly 42% of apps in LG’s webOS store. That software quietly reroutes other people’s internet traffic through a buyer’s home connection so it appears to be ordinary residential browsing.
LG senior vice president John Taylor said the company is working with developers to remove the code or suspend apps that include it.
Texas settlement and updated terms added to the backlash
LG’s television and account agreements run past 30,000 words combined, which the article says would take roughly three to four hours to read at an average pace. Days after Gamers Nexus published its first LG report in July, LG added a forced-arbitration clause to those terms, preventing buyers from suing in court or joining a class action.
In May, Texas Attorney General Ken Paxton announced a settlement requiring LG to obtain informed consent before collecting ACR viewing data and to provide users with a clear opt-out. That settlement followed a December lawsuit that also named Samsung, Sony, Hisense, and TCL.
Gamers Nexus said the “Do Not Sell My Personal Information” toggle was still off by default before a buyer connected the TV to the internet or agreed to anything.
More investigations may follow across the smart TV market
Decrypt places the findings in a broader run of privacy disputes in tech, citing Meta’s AI glasses recording strangers without consent and the wave of ChatGPT data deletions this spring over privacy concerns.
Gamers Nexus said it is now crowdfunding a follow-up investigation into Samsung, Vizio, and other smart TV brands. Texas cases against Sony, Hisense, and TCL remain open in court, the article added.