A Northeastern University study found that a Samsung TV running Tizen continued sending encrypted network traffic consistent with automatic content recognition after researchers switched the feature off. The result does not prove that Samsung kept collecting or storing viewing history: the traffic was encrypted, so the researchers could not inspect its payload or determine what happened on the server. It does show that the privacy switch did not silence the identified ACR endpoints on the tested TV.
The finding arrives as preliminary reverse-engineering claims about Samsung televisions are spreading online. A researcher using the name log4j says a rooted 2025 model contained software for processing screenshots, audio categories and advertising identifiers. Those posts have not yet been backed by a full technical report, independently reproduced on an unmodified TV or answered in detail by Samsung. The new university study offers firmer evidence about network behavior, while also drawing a clear line around what it cannot establish.
What the Samsung TV study measured
The paper, Watching the Watchers, tested 12 televisions covering eight smart-TV operating systems and roughly 95% of the U.S. market. Researchers ran 5,943 controlled experiments across antenna broadcasts, built-in streaming, Netflix, Tubi, YouTube, HDMI and screen mirroring. Every scenario ran with ACR enabled and again after the setting was disabled.
Automatic content recognition identifies what appears on a television independently of the app or external device producing it. A TV periodically derives a compact fingerprint from the picture or sound, sends it to an ACR provider and compares it with a reference library. That can identify a broadcast, program or advertisement for audience measurement and targeted advertising.
On the Samsung Tizen set, the study determined that ACR was video-based: traffic disappeared when the researchers supplied sound over a black screen, but removing the sound from moving video did not stop it. With ACR enabled, Tizen tracked the test antenna feed, Samsung’s built-in streaming service, Tubi and HDMI. It did not track the researchers’ Netflix or YouTube sessions.
The opt-out did not stop all traffic
After the researchers opted out through the TV’s settings, traffic consistent with ACR remained in 41 of 60 antenna runs, 18 of 30 HDMI runs and six of 30 Tubi runs. All 30 runs of Samsung’s built-in streaming service continued showing the same kind of traffic. Some traffic also appeared in idle, Netflix and YouTube tests, although those scenarios did not meet the study’s tracking threshold while ACR was enabled.
The distinction between an endpoint contact and confirmed viewing-data collection matters. Because Samsung encrypted the connection, the researchers inferred ACR activity from destinations, timing, volume and how traffic changed with controlled content. They could not read the messages, confirm that fingerprints were inside them or see whether Samsung processed or retained anything received after opt-out. The paper describes the behavior as a potential privacy violation, not a proven one.
Samsung’s current U.S. support page calls ACR optional and says it runs only after a viewer consents to Viewing Information Services. It lists viewing history, a Personalized Service ID and IP address among the information that may be captured, while stating that Samsung does not record or watch displayed content. The company also says turning ACR off stops collection of viewing history.
An earlier 2024 audit of Samsung and LG TVs found that opting out eliminated traffic to identified ACR domains. The broader Northeastern study reports a different result on the Samsung model and firmware it tested. That difference is one reason not to assume a setting behaves identically across every model, software release or region.
What the viral audio claims do and do not show
The rooted-TV findings circulating this week go beyond the university paper. According to posts quoted by Tom’s Hardware, log4j found components that appeared capable of categorizing audio, processing images and using microphones on connected devices. A second tester saw a rooted Tizen TV open a microphone for about five seconds once, then could not reproduce continuing access over the following hours.
That is not enough to conclude that Samsung TVs continuously record rooms, use a soundbar to listen for advertising purposes or upload raw screenshots. A rooted device differs from a retail configuration, the behavior was not repeatedly demonstrated, and the claimed code paths have not been documented in a complete reproducible analysis. Samsung’s known ACR implementation is still privacy-sensitive, but the new university experiments indicate that the tested Tizen system recognized content from video rather than audio.
How to reduce tracking on a Samsung TV
Menu names vary by model year and country. On many recent Samsung TVs, start with Home > Settings > All Settings > General & Privacy > Terms & Privacy. Then review these controls individually:
- Viewing Information Services: disable it to withdraw consent for Samsung’s ACR feature.
- Interest-Based Advertisement Service: disable personalized advertising separately; turning off ACR may not change every advertising preference.
- Privacy Choices: review sale, sharing or targeted-advertising choices offered in your region.
- Voice Recognition Services: disable them if you do not use voice commands, and check microphone switches on the TV, remote or connected audio equipment where available.
- Advertising ID: reset it if the model exposes that option. A reset does not prevent future tracking, but it can break continuity with an existing profile.
Restart the TV after changing the settings and check the controls again after a major Tizen update or factory reset. Avoid the setup screen’s blanket Agree to all option; accept only the terms required to operate the device.
For a stronger block, separate the screen from the internet
The most dependable consumer control is to disconnect the television itself from Wi-Fi and Ethernet, then supply video over HDMI. That prevents the TV from contacting Samsung’s servers, although the streaming box or console may have its own tracking settings. Choose the external device based on its privacy controls rather than assuming a separate box is automatically private.
Network administrators can instead block known ACR domains at a router or DNS resolver. The Northeastern team publishes a maintained smart-TV ACR blocklist and reported no viewing-quality problems in its tested scenarios. Domain lists can age, however, and blocking may affect recommendations, channel guides or other connected features on different models. Watch DNS logs after firmware updates and treat the list as a starting point, not a permanent guarantee.
The practical conclusion is narrower than the most alarming posts online and more actionable: Samsung documents an opt-in viewing-recognition system, independent researchers observed Tizen contacting its ACR infrastructure after opt-out, and the encrypted payload prevents anyone outside Samsung from proving what those later messages contained. Owners who want a clear technical boundary should disable every related consent, advertising and voice control, or keep the TV itself offline.
