216M Spy TVs – The LG Smart TV Problem [video]
TL;DR
A Gamers Nexus investigation of LG's webOS smart TVs finds content recognition that fingerprints whatever is on screen. The TVs also scan and catalog other devices on the home network. They have several microphones the owner can't fully switch off. LG ad executives tell advertisers they "own the glass" and the living room. The video doesn't clearly show the TV recording the room on its own. Most of the microphone captures came after the team rooted the TV.
The article
Video (about 2 h 15 min); not summarized. The digest covers the HN discussion, which leans on the video and on a Notebookcheck write-up of it.
The discussion
A huge, angry thread. Most of it agrees LG crossed a line and argues over three questions. Can a terms-of-service clause make an owner responsible for wiretapping their guests? Is keeping the TV offline enough? Why haven't fines stopped this? A smaller group says the video and the Notebookcheck write-up blur LG's default behavior with what a rooted TV can do.
Can a ToS make you responsible for wiretapping your guests?
The top thread opens on LG's terms, which make the owner get consent from everyone whose voice the device might pick up. One commenter said that clause covers LG's appliances, but another found the same rule in the smart TV terms, plus six months of voice retention. Most think the clause is unenforceable, since guests, children and neighbors never agreed, and recording them is a crime in all-party-consent states. A minority found it reasonable for whoever controls the room to get consent, as a Zoom host does, and blamed how much data LG collects.
Not only can they listen in. You have a contractual requirement to tell everyone in range of an appliance that they may be eavesdropped upon.
The owner does not collect or process the data, so it's entirely on LG to ensure proper consent, not the owner.
Is keeping it offline enough?
The most common advice is to keep the TV off the network and stream from an Apple TV or another box. Many replies say the TV could store logs and upload them later, through a neighbor's open Wi-Fi, xfinitywifi, Amazon Sidewalk or a future cellular modem. Skeptics answer that nobody has shown an LG doing this, and one owner with an open guest network has never seen his LG on it. The firmest risk anyone named is a delayed upload, once someone connects the TV years later.
I have an unprotected guest network with a captive portal and an LG C1. I have never seen the LG pop up in the logs for the guest network.
I think the main risk is that if you - or your kids, or your spouse, or a guest, or someone you give/sell the TV to - do connect the TV to the Internet for even a moment years from now, then all those logs you wanted to keep away from LG are likely to delivered.
Did the video overstate the microphone story?
Several viewers of the full video say it doesn't show the strongest claim, that the TV logs room audio while it looks switched off. The audio recordings came after the team rooted the TV and ran the recording tool, or after someone started voice search. Defenders say the video set out to show capability, that the switch covers only one microphone, and that LG blocks inspection of its traffic. Even the critics say the content recognition and network scanning shown before the rooting are bad on their own.
Starting at 16:04, they say that they merely claim that the TV has the capability to be used as a listening device.
For example: the microphone switch only controls one of the onboard microphones.
Working around it: firewalls, surgery, dumb screens
Owners trade setups: an isolated VLAN with egress blocked, DNS redirects, rooting with rootmy.tv or OpenLGTV, or unplugging the Wi-Fi and Bluetooth board. Commercial signage displays with no radios cost about twice as much, and cheap dumb brands like Sceptre have worse panels. So the best OLEDs only come with the spyware attached. A side fight asked why anyone connects a TV at all, and others answered that ordinary buyers follow the setup screen.
Opened the back and unplugged the WiFi/BT chip, bought a cheap dumb universal remote with no mic in it, disagreed to all T&C in the TV, updated the firmware via USB and just use an AppleTV over HDMI for streaming.
The tradeoff is picture quality. Those panels are dumb and also bad.
Why nothing happens to LG
Many commenters ask why a company can do at scale what would get a person arrested for bugging a house. The usual answer is that fines are a cost of business, so commenters proposed fines tied to revenue and jail for executives who signed off. Europeans expect GDPR and the Cyber Resilience Act to bite. Americans are gloomier, citing forced arbitration and weak enforcement, though a few hope LG's own wealthy customers and their lawyers will force action.
If I bug your house I'd be charged with all kinds of crimes. If LG does it at scale nothing happens.
Corporate fines are paid by shareholders and customers, not by the people who made the decision.
Consensus
LG's ad business is indefensible. It fingerprints what's on screen, maps devices on the home network, and has executives boasting that they "own the living room." The practical defense is to keep the TV offline and stream from a separate box. Because the best panels come only in smart TVs, buyers can't solve this by choosing another product. Most commenters want regulation with criminal penalties.
Dissent
A vocal minority says the video and the Notebookcheck write-up mix LG's default behavior with what a rooted TV can do. No one, they say, has shown audio leaving the TV unprompted. Others call the fear of TVs sneaking onto open Wi-Fi or Sidewalk a rumor nobody has tested, since most owners connect the TV anyway.