“Despite its importance, little is publicly known about the privacy implications of deployed ACR implementations—in part due to the opaque nature of their deployments and challenges with automated testing,” the report says.
The size of the TV market makes dissecting ACR deployments difficult, the paper says, because doing so requires “large numbers of devices and experiments.”
Another obstacle is that “smart TVs are locked down,” making “techniques like rooting and TLS interception generally unavailable [and creating] a need instead for techniques that reliably infer ACR activity,” the report says.
Avoiding smart TV tracking
Smart TV manufacturers’ persistent, opaque tracking practices have prompted more people to explore modifying their device’s software, including using a growing number of software tools designed to turn smart TVs into dumb TVs. Meanwhile, US nonprofit Software Freedom Conservancy is suing Vizio in an effort to make it easier for people to control their TV’s software, including disabling ACR.
To help people reduce the risk of their TVs tracking them without consent, the report’s authors created a list of network addresses, domains, and URLs that people can block “to prevent devices or apps from communicating with ACR services” without affecting TV viewing quality.
On the paper’s website, the researchers recommended that TV manufacturers “list every input that ACR watches, such as antenna, HDMI, apps, and screen mirroring, in the privacy policy” and “authenticate and encrypt all ACR traffic.”
The paper recommends that users remove smart TVs from their network and “use an external streaming device that does not perform ACR, or use the ACR opt-out on OSes where it was effective in our measurements.”
For tips on avoiding smart TV snooping, check out our guide on how to break free from smart TV tracking.
Leave a Reply