Your Smart TV Might Be Eavesdropping: Behind The Security Flaws Compromising Your Living Room

First we were told routers can monitor breathing patterns, then that TVs are subtly lending Wi-Fi to total strangers, and now LG sets stand accused of bugging living rooms.

Published in early September by Gamers Nexus working alongside Level1Techs and independent security researchers, an investigation puts a spotlight on two overlapping risks that most owners never think about: aggressive advertising surveillance that maps viewing habits and nearby devices, and security flaws that could let an attacker turn the TV’s microphone into a living-room wiretap.

LG is certainly not the only manufacturer with this problem, however. Samsung, Sony, Hisense and TCL have all faced almost identical scrutiny over the past year, and understanding what’s actually going on requires looking at the whole industry.

How The LG Exploits Work

To see what was going on behind the scenes, the team ran deep packet analysis and firmware tests on standard retail LG OLEDs, including a 2025 G5 model.

The results showed continuous automatic content recognition tracking literally everything displayed on screen. Whether you were using built-in software or external HDMI devices like a PC or console, the set continually sampled audio and video to match against a reference database. To make matters worse, the TVs were busy mapping the wider home network, cataloguing every phone, printer and smart device in range alongside nearby Wi-Fi network names and signal strengths.

This endless stream of viewing metrics and home network maps feeds right into LG Ad Solutions, which claims coverage over hundreds of millions of devices in the US market alone. Things got worse when researchers tested the microphone, discovering the set could capture clean audio while being in standby mode too. Cutting the web connection proved useless, as the TV cached the recorded files locally before putting them online the instant it reconnected. On top of the surveillance concerns, the report notes critical remote execution bugs in webOS, with full technical teardowns currently held back for responsible disclosure.

LG disputes that it routinely records ambient conversations, saying voice data is only processed when a user presses the voice button or triggers the “Hi LG” wake-word detection, which it says runs locally and deletes audio if no wake word is recognised. Researchers maintain that the default configuration and data flows still create exposure regardless of intent.

How Modern TV Tracking Works

At its core, automatic content recognition works much like Shazam, but for everything displayed on your screen. The television grabs quick audio and visual fingerprints multiple times per second, checking them against a database to recognise programmes, video games and commercials.

Every viewing session is logged by title, duration, time of day and ad exposure. TV makers then collect these metrics to build audience segments, test ad engagement and trade data with ad platforms. LG allegedly goes a step further by cataloguing every phone, laptop and smart device on local networks, combining those network IDs with viewing records to map out the entire household.

Unwanted ad tracking is frustrating, but the microphone flaw is the real hazard. If a hacker uses an unpatched webOS vulnerability, they gain the ability to listen in while the TV is in standby mode, using the hardware as a jumping-off point to inspect every other device sharing a Wi-Fi. By linking live audio with content logs, an attacker could build a very detailed picture of household activity.

The FBI has highlighted this danger in a 2026 warning, noting that smart TV mics and cameras across all major manufacturers remain prime targets for remote hijacking.

This Is An Industry Problem, Not Just An LG Problem

Regulators have been taking notice, starting with the Texas AG’s legal campaign against Samsung, Sony, LG, TCL and Hisense for collecting ACR data without proper permission.

Samsung settled, promising to rewrite its privacy policies and stop all ACR tracking in Texas unless users explicitly opt in. LG reached its own settlement in May 2026, agreeing to clearer opt-outs and a specific ban on passing viewing data to the Chinese government. Meanwhile, the cases against Sony, Hisense and TCL were still making their way through the courts by mid-2026.

Independent testing by RTINGS across 15 models from Samsung, LG, Sony, Hisense, TCL, Vizio and Roku found active ACR tracking right out of the box. To make matters worse, opt-out toggles were buried deep in menus, given confusing names or failed to stop the data stream altogether.

None of this is an accident or a one-off engineering mistake; it’s a design feature of a business model that relies on ad revenue to subsidise low hardware prices.

Unplugging The Spy

Firmware updates are important because they fix the software bugs researchers keep digging up, including those found in webOS.

Most TVs hide these controls inside Settings under Privacy and Terms or User Agreements, where one can individually turn off ACR tracking, targeted ad IDs and background voice listening. Most of this is accepted by default during setup when people click through without reading. Some sets also feature a physical switch or menu setting that mutes the microphone or disables the camera completely.

Network segmentation is the other lever. A TV placed on a separate IoT or guest network can’t reach phones, laptops or work devices on the main network if it’s ever compromised. UPnP left enabled on a router makes it easier for a device to expose services directly to the internet without anyone realising.

The most complete option, for anyone who decides the trade-off is worth it, is treating the TV as a dumb display entirely: disconnecting it from the internet and routing everything through an external streaming device like Apple TV, Fire TV or Roku instead, which cuts off most of what the TV manufacturer itself can see.

The naming varies by brand, which is part of why so many of these settings go unnoticed. Samsung calls it “Viewing Information Services”, Vizio calls it “Viewing Data”, Sony calls it “Samba Interactive TV”. Different label, same underlying function and usually available even when it takes a few extra menu taps to find.