Product3 publishers3 min readPublished
LG's rebuttal shrinks the TV spying story to a wake-word question
Gamers Nexus and Level1 Techs say packet capture and firmware analysis show LG OLED sets inventorying nearby phones, watches and Wi-Fi networks for LG Ad Solutions. LG's published reply is about the microphone.
The Product Desk · Product desk
What happened
- Gamers Nexus and Level1Techs used packet capture and firmware analysis on retail LG OLED sets and concluded the TVs scan the local network to identify devices such as phones and smartwatches for LG Ad Solutions.
- The same report said the sets sample audio and video to identify content for advertisers, and that microphones capture audio even when the TV is on standby or disconnected from the network.
- It also describes the TVs collecting IP addresses, geographic locations and the names of nearby Wi-Fi networks, along with devices attached to those networks that were never connected to the TV.
- LG published a long response on its website a few days after the 135-minute Gamers Nexus video, saying recent media coverage may have contributed to misconceptions about how its smart TVs work.
- LG said Automatic Content Recognition, voice recognition and interest-based advertising are optional features that are not enabled by default on its TVs.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure On the report's findings, LG Ad Solutions ends up holding a picture of which phones and watches sit near the screen, which puts visitors and staff who never saw a setup screen inside the data set.
- constraint By LG's own account no connected product is immune from vulnerabilities, so the panel needs the patching and monitoring attention of an endpoint, on a network segment where it was bought as a display.
- contradiction LG's denial hangs on the word continuously, while Gizmodo reported the demonstration shows a set transcribing ambient conversation long after the authors stopped talking to it, and the two accounts cannot both be right.
- decision With the volume of collection and the sharing partners unanswered by LG, anyone sizing this has to decide VLAN placement as though the report's findings hold.
A facilities manager hangs a large OLED in a meeting room, joins it to the office Wi-Fi so people can cast slides, and writes one line in the asset register: display. On the findings of the joint report, which Gamers Nexus ran with Level1 Techs and independent cybersecurity researchers, the panel belongs on the same inventory as anything else that reads the network [3].
LG's answer is about conversations. The company said its "LG smart TVs do not continuously record or transmit users' conversations" [6], and that "Audio used for wake-word detection is processed locally on the TV and, if no wake word is detected, audio is not converted to text, stored, or transmitted" [7]. On content identification, LG said "ACR uses audio fingerprinting technology using the TV's internal audio processor (not a speaker) to identify content and does not collect screenshots, screen recordings, video recordings, voice recordings, or other audio recordings from the TV" [9]. Those three sentences describe the microphone and the fingerprinter. The list of phones, watches and neighbouring Wi-Fi networks is a separate finding, and LG's statement leaves it where the report put it [23].
The optional-and-off-by-default defence hands the decision to whoever runs the setup wizard. Gizmodo reported that LG's opt-in prompts sit in the middle of the user agreements during initial setup [16], and Pocket Lint's guide to switching the data collection off runs five separate steps [15]. An installer opts in with a tap while agreeing to everything else. Opting out means five deliberate steps on every unit [24]. "People often consent to things they don't fully understand during a speedy setup," Lillian Edwards, professor of law, innovation and society at Newcastle University, told TechRadar [17].
Teams treat a conference-room TV as a monitor with apps nobody uses. On the evidence of the capture, the device looks for its neighbours and reports what it finds to an ad business [1]. Two questions sort the rollout. Whether the screen needs to reach the internet to do the job it was bought for, and whether it needs to see other devices on the same segment. A panel fed over HDMI by a machine already under management answers no twice, which is roughly what Gizmodo's writer recommends: "Plug in an Xbox and never connect the TV itself to the internet in the first place" [20].
Where the answer is yes, because someone wants casting or a streaming app, the honest position is that the TV is a managed endpoint with an ad platform inside it. That means the five privacy settings go on the install checklist for each unit, and get checked again after firmware updates [15].
What to watch
- Whether LG publishes an answer on the local network scanning specifically, and on what LG Ad Solutions receives.
- Whether EU regulators test LG's setup-flow consent against GDPR and ePrivacy, as The Next Web suggested they might.
- Whether the same packet-capture method gets pointed at other TV makers' ACR, where Consumer Reports already documents the off switches.