216 Million LG Smart TVs Privacy Crisis: Recording Audio Even When Screen Is Off

Recently, security researchers disclosed serious privacy issues with LG smart TVs—over 216 million devices worldwide may be continuously collecting audio and device information without users' knowledge. This discovery has once again pushed smart home device privacy protection into the spotlight.

Continuous Listening with Screen Off: Your TV Is More "Awake" Than You Think

According to an investigative report by Notebookcheck, LG smart TVs have been found to record ambient audio data even when the screen is turned off. In other words, while users believe the TV is "off," the device's microphone functionality may still be active, quietly collecting sounds within the room.

Modern smart TVs are essentially networked computers running dedicated operating systems. LG smart TVs run webOS, Samsung uses Tizen, while other brands may use Android TV. The fundamental difference between these systems and traditional TVs lies in their complete network communication capabilities, app ecosystems, and sensor arrays. The built-in microphone arrays in TVs typically employ far-field voice recognition technology, capable of clear audio pickup even at distances of 3-5 meters. In Standby Mode, the main display chip enters low-power mode, but critical components like network modules and audio processors may remain operational to support features like voice wake-up and remote power-on. This "partial sleep" architecture provides the technical possibility for background data collection.

More disturbingly, these TVs not only collect audio information but also actively scan other devices on users' home networks. Researchers discovered that LG TVs probe for information about smartphones, computers, tablets, and other devices on the same local network, thereby building a complete device profile of users.

LG TVs' home network scanning involves multiple network discovery protocols. Most common are UPnP (Universal Plug and Play) and mDNS (multicast DNS), protocols originally intended for automatic device discovery and interconnection, such as helping TVs find network printers or NAS storage. However, the same technology can be used to collect device fingerprint information—including device type, manufacturer, MAC address, operating system version, and more. Through SSDP (Simple Service Discovery Protocol) broadcasts, TVs can obtain detailed information about all responding devices on the network. More covert is passive detection: by analyzing network traffic patterns and device behavior, the existence and type of devices can be inferred even if they don't actively respond. This aggregated information can construct precise digital profiles of households.

This behavior, conducted without explicit user authorization, has seriously crossed personal privacy boundaries.

216 Million Devices: How Extensive Is the Data Collection?

The figure of 216 million reveals the severity of the problem. As one of the world's major TV manufacturers, LG smart TVs are deployed across major markets globally. If these devices commonly engage in similar data collection behaviors, the affected user base would be enormous.

The specific purposes for which LG collects this data remain unclear. Manufacturers typically claim data collection is for improving user experience, providing personalized recommendations, or optimizing product performance. However, conducting such large-scale data collection without transparency and explicit user consent has undoubtedly touched the bottom line of privacy protection.

Not Just LG: The Privacy Dilemma of the Smart TV Industry

LG is not an isolated case. In recent years, multiple smart TV manufacturers including Samsung and Vizio have been exposed for similar issues. These devices are equipped with cameras, microphones, and network connectivity, initially intended to provide convenient experiences like voice control and video calling, but simultaneously creating privacy vulnerabilities.

Privacy issues with smart TVs mainly concentrate in several areas:

• Audio monitoring: Continuously or periodically activating microphones to collect ambient sounds
• Viewing habit tracking: Recording content users watch, duration, and preferences
• Network device scanning: Detecting other smart devices on home networks
• Targeted advertising: Precisely pushing ads to users based on collected data

Smart TV content tracking primarily relies on ACR (Automatic Content Recognition) technology. ACR analyzes images or audio signals displayed on screen to generate unique "digital fingerprints," then compares them with cloud databases to identify the specific program, advertisement, or even game the user is watching. This technology can sample multiple times per second with second-level precision. Vizio was fined $2.2 million by the FTC (Federal Trade Commission) for using ACR technology without consent. ACR's commercial value is enormous: TV manufacturers can sell viewing data to advertisers, content providers, and data brokers, forming a data trading market worth billions of dollars. Users can hardly detect ACR operation because it runs at the system level without affecting normal viewing experience.

These behaviors are often buried in lengthy user agreement terms, making it difficult for ordinary users to realize exactly what permissions they've authorized.

How Can Users Protect Their Privacy?

Facing privacy threats from smart TVs, the following protective measures are worth serious consideration for every user:

1. Carefully review privacy settings: During initial TV setup, check item by item and disable unnecessary data collection options
2. Disable voice assistant features: If you don't use voice control daily, it's recommended to completely turn off microphone permissions in settings
3. Network isolation: Connect smart TVs to a separate Wi-Fi network or guest network to avoid sharing the same local network with sensitive devices like phones and computers
4. Physically cover cameras: Use cover stickers or tape to cover camera lenses, blocking video collection at the physical layer
5. Monitor firmware updates: Regularly check for security updates and privacy policy changes released by manufacturers

For users with technical capabilities, router traffic monitoring tools or network filtering solutions like Pi-hole can be used to observe TV data transmission behavior and promptly detect and block abnormal external connection requests.

Pi-hole is an open-source network-level ad blocker originally designed to run on low-power devices like Raspberry Pi. Its working principle is to act as a DNS server—when devices on the home network request domain name resolution, Pi-hole queries a preset blacklist, and if the request points to known advertising, tracking, or telemetry servers, it returns an empty or local address, thereby blocking the connection at the network layer. For smart TVs, Pi-hole can block upload requests to data centers of manufacturers like LG and Samsung. Users can view DNS query logs of all devices in real-time through Pi-hole's web interface to discover abnormal data exfiltration behavior. Advanced users can also use packet capture tools like Wireshark to deeply analyze TV network communications. This solution requires no TV setting modifications and operates transparently for all connected devices.

The Industry Urgently Needs Stricter Privacy Regulation

The LG smart TV incident exposes regulatory gaps in privacy protection within the smart home industry. Compared to smartphones and computers, privacy protection standards for smart TVs are significantly lagging, with users' right to know and right to choose not being adequately protected.

The industry and consumer organizations are calling for a more comprehensive regulatory framework requiring manufacturers to:

• Clearly disclose the type, frequency, and specific purposes of data collection
• Provide simple and intuitive privacy control options rather than burying settings deep in menus
• Adopt data minimization principles by default—don't collect unless necessary
• Regularly undergo independent third-party security audits
• Bear corresponding legal responsibility for unauthorized data collection

The EU's GDPR and privacy regulations emerging from various U.S. states provide reference directions for industry regulation, but more targeted technical specifications and compliance standards need to be formulated for the unique characteristics of IoT devices.

GDPR (General Data Protection Regulation) is the EU's privacy protection regulation implemented in 2018, considered the world's strictest data protection standard. Its core principles include: data minimization (collect only necessary data), purpose limitation (cannot use beyond scope), informed consent (requires explicit authorization), and right to be forgotten (users can request data deletion). Violating companies can be fined up to 4% of global revenue or €20 million. In the U.S., California's CCPA (Consumer Privacy Act), Virginia's CDPA, and other state laws have successively taken effect, but federal-level unified legislation is still lacking. Special challenges for IoT devices include: limited user interfaces making full disclosure difficult, always-connected devices difficult to audit, and complex data flows involving multiple parties. Existing regulations mostly target websites and applications, and their binding force on embedded devices needs strengthening.

Final Thoughts

Smart TVs should bring convenience to family life, but when convenience is built on sacrificing privacy, consumers have every right to refuse. This privacy incident exposed by LG is a clear warning signal—while embracing smart homes, we must maintain sufficient vigilance about privacy and security.

Only when manufacturers truly place user privacy at the forefront of product design can the smart home industry win consumers' long-term trust and drive technology toward healthier, more sustainable development.