LG ships its Texas-mandated tracking opt-out switched off by default

LG smart TVs are still charting every device on a home’s Wi-Fi network and capturing microphone audio even while the screen appears off, four months after LG settled with Texas regulators over the same practice, a Gamers Nexus investigation found. Under the May settlement, LG’s TVs had to get informed consent before they could collect this kind of data. But the opt-out toggle that would meet that requirement ships disabled by default. The fix a regulator secured never reached buyers of the about 216 million LG TVs sold worldwide. Residential-proxy code turned up in 42% of webOS apps Hardware-focused YouTube channel Gamers Nexus conducted the investigation, investing over 500 hours and some $70,000 on the project. The team worked with reviewer Level1Techs and three independent security researchers, testing retail LG OLED models like the G5. The team used Wireshark to capture network packets and saw the TVs scan the local network using UPnP, a protocol that lets devices automatically discover each other. The sets recorded internal IP addresses and data from phones and smartwatches and collected the names and signal strengths of Wi-Fi networks in the area, along with location data. Researchers extracted clean microphone audio from an LG set while its screen appeared powered down. When they disconnected the TV from the internet, it continued to record voice input locally and sent the files when the connection was restored. It does this largely through Automatic Content Recognition, or ACR, software. It samples what’s on the screen and speakers, turns it into a digital fingerprint, and checks it against a reference database to identify the content. The feature still functions when the TV is being used as an HDMI monitor for a laptop, Gamers Nexus said. That data is sent to Alphonso Inc., an ad-tech company in which LG acquired a controlling interest in 2021. LG executives have been direct about it, saying the company “owns the glass.” Researchers muted the primary microphone of a set using the settings menu. Then they obtained usable audio from a second hidden microphone that the mute control never touches. LG’s TV operating system, webOS, logged user voice prompts in plain text. The team also separately detailed remote code execution bugs in webOS via responsible disclosure. Security firm Spur found a residential proxy code that reroutes the internet traffic of strangers through a buyer’s home connection. The code was found in about 42% of webOS store apps. LG Ad Solutions claims 363 million tracked devices The pooled data feeds LG Ad Solutions, the company’s targeted advertising wing. The division says it can track hardware on the same network to reach 363 million addressable devices in the US alone, more than LG’s own tally of TV sales worldwide.