“Despite their importance, little is publicly known about the privacy implications of deployed ACR implementations, in part due to the opaque nature of their implementations and challenges with automated testing,” the report says.
The size of the television market makes it difficult to analyze ACR implementations, the paper says, because doing so requires “a large number of devices and experiments.”
Another obstacle is that “smart TVs are locked,” making “techniques like rooting and TLS eavesdropping generally unavailable.” [and creating] instead, techniques that reliably infer ACR activity are needed,” the report says.
Prevent smart TV tracking
The persistent and opaque tracking practices of smart TV manufacturers have led more people to explore the possibility of modifying their devices’ software, including using a growing number of software tools designed to turn smart TVs into dumb TVs. Meanwhile, the US nonprofit Software Freedom Conservancy is suing Vizio in an effort to make it easier for people to control their TV software, including disabling ACR.
To help people reduce the risk of their TVs tracking them without consent, the report’s authors created a list of network addresses, domains, and URLs that people can block “to prevent devices or applications from communicating with ACR services” without affecting TV viewing quality.
On the article’s website, the researchers recommended that TV manufacturers “list all inputs that ACR looks at, such as antenna, HDMI, apps, and screen mirroring, in the privacy policy” and “authenticate and encrypt all ACR traffic.”
The document recommends that users remove smart TVs from their network and “use an external streaming device that does not perform ACR, or use ACR opt-out on operating systems where it was effective in our measurements.”
For tips on how to avoid smart TV spying, see our guide on how to free yourself from smart TV tracking.
