In brief
- Gamers Nexus found LG TV sets still scan a household's entire Wi-Fi network and can capture microphone audio while appearing off or unplugged from the internet.
- LG settled with Texas regulators in May, agreeing to stop collecting viewing data without informed consent.
- Separate security researchers found unpatched remote-access bugs and residential-proxy code, software that quietly reroutes strangers' internet traffic through a buyer's home connection.
Editor's note: This article has been updated with a response from LG. A company spokesperson disputed the Gamers Nexus findings, saying LG TVs process voice data only when the remote's voice button is pressed or a wake word such as "Hi LG" is detected after a user activates Far-Field voice recognition, and that the sets do not otherwise collect or record ambient conversations. LG also said its network scanning is a standard smart-TV function and that its ACR content-recognition feature is opt-in.
What does an LG smart TV do when nobody’s watching? Digital media company and popular YouTube channel Gamers Nexus spent more than 500 hours and about $70,000 finding out. The answer, per a new investigation, is a lot more than advertised.
Working with hardware reviewer Level1Techs and three independent security researchers, the team found LG's sets scanning a home's entire Wi-Fi network using UPnP, a protocol that lets devices find and talk to each other automatically, mapping every phone, laptop, and smart device connected to it.
In one test, they pulled clean microphone audio off a TV with a dark screen, then did it again after yanking the set off the internet entirely. LG signed a privacy settlement with Texas regulators four months before any of this ran.
An LG spokesperson disputed the investigation's central claims, telling Decrypt that "the claims made in the recently published video are not true." According to the spokesperson, LG TVs "process voice data only when the voice button on the remote control is pressed and held, or when a wake word such as 'Hi LG' is recognized after the user has activated the Far-Field voice recognition feature."
Outside those instances, the LG spokesperson said, "the TVs do not collect or record ambient conversations," adding that when a wake word isn't recognized, no voice data is sent to LG's servers and the audio is processed locally and immediately deleted.
Most of the tracking runs through Automatic Content Recognition, or ACR, software that samples what's on a screen or coming through the speakers, turns it into a digital fingerprint, and checks that against a reference database to identify what's playing, according to Malwarebytes' review of the findings.
Gamers Nexus found LG's version keeps working even when a TV is used purely as an HDMI monitor for a laptop. Switching inputs doesn't switch it off. The LG spokesperson said ACR is "provided on an opt-in basis to deliver personalized content recommendation, services, and advertisements," and that if a user doesn't consent, "ACR data is not used for advertising purposes."
The TVs are also capable of scanning the network and mapping out all the devices connected to it. The LG spokesperson characterized that behavior as routine, saying the sets "feature the ability to scan for and connect to nearby devices on the same network" to enable smart-TV features such as device connectivity and content sharing, and called it "a standard function commonly provided by smart TVs and smart home devices."
Researchers muted a TV's main microphone through the settings menu, then pulled a usable recording off a second, hidden microphone the mute switch never touches. So much for the mute switch.
In another test, they left a TV unplugged from ethernet, spoke near it, and watched it upload the stored audio the second it reconnected, picking up speech from roughly 60 feet away through a wall.
Voice commands get converted to plain text and saved in on-device logs. The microphone stays live for 10 to 15 seconds after someone stops talking, catching whatever the room says next, whether or not anyone addressed the TV. LG told reporters in July that its sets "do not collect, record, or store ambient conversations."
The footage says otherwise. But addressing the standby scenario specifically, the LG spokesperson said that when a set appears off, "it only monitors for the wake word if you have previously enabled the Far-Field feature," and that any audio used for wake-word detection is "processed locally on the TV, promptly deleted, and is not transmitted to LG servers."
LG's ad executives are refreshingly honest about the payoff, at least on camera. Multiple LG Ad Solutions leaders are shown saying the company "owns the glass," and they mean it: the pitch to advertisers is tying a household's TV habits to the phones and other devices under the same roof.
Per the company, you bought the television. LG owns what it sees.
That data runs through Alphonso Inc., the ACR partner LG took a controlling stake in back in 2021 and has been locked in lawsuits ever since. LG Ad Solutions' president of global ad sales, Serge Matta, previously ran ad-measurement firm Comscore, which the SEC charged in 2019 with inflating revenue by roughly $50 million. Matta personally paid a $700,000 penalty, repaid Comscore $2.1 million, and accepted a 10-year ban from running a public company.
Nobody said anything about a private one.
Security concerns
Researchers also found remote-code-execution bugs, flaws that let an attacker run their own commands on a TV from across a network, that LG hasn't fully patched. One trick fools the TV's built-in browser into pairing with a fake mobile-device pop-up, handing over remote access without anyone touching the set. LG asked researchers to hold technical detail while disclosure is still in progress.
A hacked TV isn't just a listening device. Security firm Spur found residential-proxy code, software that quietly reroutes someone else's internet traffic through a buyer's home connection so it looks like ordinary household browsing, tucked inside roughly 42% of apps on LG's webOS store, per Krebs on Security. LG senior vice president John Taylor said the company is working with developers to strip it out or suspend the apps that carry it.
On the security questions broadly, the LG spokesperson said data security is "a top priority" and that the company "continuously monitors" its platform and partners with independent security experts "to identify vulnerabilities and deliver timely security updates."
The spokesperson added that LG is "committed to providing transparency and rejecting deceptive practices," saying features including ACR, voice recognition and interest-based advertising "each require separate explicit user opt-in consent and can be disabled at any time through the TV settings."
LG's television and account agreements run past 30,000 words combined, or roughly three to four hours to read at an average pace. Days after Gamers Nexus published its first LG report in July, LG added a forced-arbitration clause to those terms, blocking buyers from suing in court or joining a class action. Convenient timing.
In May, Texas Attorney General Ken Paxton announced a settlement requiring LG to get informed consent before collecting ACR viewing data and to give users a clear opt-out, following a December lawsuit that also named Samsung, Sony, Hisense, and TCL. Gamers Nexus found the Do Not Sell My Personal Information toggle still off by default, before a buyer connects to the internet or agrees to anything. So much for that.
This seems to be a recurring issue with tech companies that decide to compromise privacy for convenience. From Meta's AI glasses recording strangers without consent to millions of people rushing to delete their data from ChatGPT this spring over privacy issues. Gamers Nexus says it is now crowdfunding a follow-up investigation into Samsung, Vizio, and other smart TV brands, while Texas' cases against Sony, Hisense, and TCL remain open in court.