Researchers at Northeastern University who switched off tracking on a Vizio television found that the set kept talking to an advertising-linked server anyway. According to a study of 12 smart TVs from 10 manufacturers, Vizio SmartCast continued sending roughly the same volume of traffic to an Amazon Kinesis server associated with automatic content recognition after users opted out through the TV’s own settings menu.
The traffic did not stop when the screen went quiet. It persisted even when the television sat idle on its home screen with no content playing, the researchers reported in findings covered by Gadget Review.
What the Northeastern study found on Vizio SmartCast
The team ran each viewing scenario 30 times with automatic content recognition enabled, then repeated every scenario 30 times after opting out, a design intended to establish a reliable pattern rather than a one-off reading. The study covered operating systems used by roughly 95% of U.S. smart TVs, according to the researchers.
There are limits to what the results prove, and the researchers were explicit about them. Because the Vizio SmartCast traffic was encrypted, they could not confirm what the payload contained. They did not conclude that Vizio violated its 2017 settlement with the Federal Trade Commission. And only one Vizio television was tested, so the behavior may not reflect every model in the lineup.
How automatic content recognition turns a screen into a data source
Automatic content recognition, or ACR, is the data-collection engine behind much of connected-TV advertising’s value. It identifies what appears on screen across cable, HDMI inputs, streaming apps and over-the-air broadcasts, giving manufacturers and their advertising partners a detailed window into viewing behavior.
That is why an opt-out toggle matters commercially as well as technically. If the switch in the menu does not change what the hardware transmits, the consent choice a viewer makes on screen is disconnected from the device’s actual network behavior.
WatchFree+ exposed show and channel names over unencrypted DNS
The researchers flagged a second problem that is separate from ACR and, they said, has no user-facing fix at all. Vizio’s WatchFree+ streaming service sent unencrypted DNS lookups to Amagi, a streaming-delivery company. Those lookups exposed show and channel names to anyone with visibility into network traffic, and Vizio provides no setting to disable the behavior.
Network-level blocking of known ACR servers reduced exposure during testing, but it did not stop the WatchFree+ DNS leakage. Blocklists alone cannot resolve service-layer DNS exposure, according to the researchers’ own testing, which is why they described it as requiring a separate technical remedy.
Where LG, Fire TV, Samsung and Roku landed
The results were not uniform across the industry, and several platforms did what their menus promised. LG webOS, Fire TV, VIDAA and Sony Google TV stopped the relevant traffic after users opted out.
Two other platforms showed partial gaps. Samsung continued ACR-like transmissions during tests involving its own streaming service, the researchers found, and Roku’s opt-out did not cover The Roku Channel. The pattern points to a recurring issue in smart TV privacy controls: first-party streaming services sitting outside the scope of the setting a viewer just switched off. Television makers have faced similar scrutiny elsewhere, including allegations that LG smart TVs track viewing and scan home networks.
The 2017 FTC settlement and the $2.3 billion Walmart deal
The findings arrive against a specific regulatory history. In 2017, the FTC and New Jersey’s attorney general alleged that Vizio collected second-by-second viewing histories from 11 million smart TVs without user knowledge or consent. Vizio paid $2.2 million to settle.
The resulting order carried obligations that the new research puts back in focus. It required affirmative express consent, prominent disclosure of data practices, deletion of data collected before March 1, 2016, and a privacy program subject to biennial review. As Yahoo Tech noted in its account of the study, the Northeastern findings do not establish a violation of that order, but they raise questions that regulators and independent auditors would be expected to examine.
The ownership picture adds commercial weight. Walmart announced an agreement to acquire Vizio in February 2024 for approximately $2.3 billion, and the retailer was explicit that SmartCast’s advertising capabilities and platform were a primary driver of the deal, specifically citing expansion of its Walmart Connect ad business. An opt-out that does not stop data transmission is harder to characterize as an interface oversight when the acquisition was framed in substantial part around that advertising platform.
What the researchers tell viewers to do instead
Their strongest recommendation requires no settings toggle. The researchers advise keeping the television offline entirely and routing streaming through a separate device whose ACR behavior can be controlled independently.
For the industry, their prescription is narrower and more demanding than a better-worded menu:
- Opt-outs should reflect actual network behavior, encrypted or otherwise, rather than only the state of a settings screen.
- Manufacturers should publish independent audit results verifying the link between a user’s consent choice and what the device transmits.
- Unencrypted service-layer DNS exposure of the kind WatchFree+ creates needs its own fix, since blocking known ACR endpoints does not close it.
For now, the practical takeaway for Vizio SmartCast owners is narrow but concrete: on the single set the Northeastern team tested, the opt-out did not end the flow of traffic to an ACR-linked server, and the contents of that encrypted traffic remain unknown.
