LG accused of 'egregious invasion of privacy' over TV data collection

REG AD

Security

Claims follow scrutiny over monitors installing adware without user consent

UPDATED LG is once again fending off allegations that its expensive consumer hardware gathers extensive information about users and their surroundings for the benefit of its advertising business.

The latest concerns center on smart TVs that researchers claim continued capturing audio after voice recognition was activated, including while the display was in standby.

The claims once again come from the folks behind the Gamers Nexus YouTube channel, which also claimed in July that LG's monitors were surreptitiously installing adware using an automatic Windows process.

After inspecting the TVs' network traffic and internal data, editor-in-chief Stephen Burke said the team found plaintext transcripts generated from audio captured by the TV, along with other information.

The Gamers Nexus crew said it observed the TV collecting IP addresses, location data, and the names, signal strengths, and channel numbers of nearby Wi-Fi networks.

The TV also enumerated devices on the local network that were not paired with it, including smartphones, watches, routers, thermostats, air purifiers, server baseboard management controllers, and PCs.

Burke added that Wireshark packet capture analysis revealed such a large quantity of private data that it couldn't be displayed in the video, and that this was all native behavior from LG's equipment.

He said the findings represented "an egregious invasion of privacy."

Burke and company also claimed that the TVs could continue capturing audio while disconnected from the internet, store it locally, and transmit related data after connectivity was restored.

Burke said the team was working with security researchers to disclose vulnerabilities responsibly, including an alleged remote code execution flaw.

LG previously told other publications that its TVs do not "collect, record, or store ambient conversations," and that voice recognition is an optional feature that processes voice data only when activated by the user.

LG's relationship with ads

LG does not hide the fact that its hardware incorporates technology from its advertising business, LG Ads Solutions.

In 2022, it announced that automatic content recognition (ACR) technology previously limited to its US smart TVs would be deployed in sets sold across 27 countries, with the resulting insights available through its advertising business.

LG said the ACR data was anonymized and handled in accordance with privacy regulations. Its advertising customers could use the resulting insights to measure campaign effectiveness and whether an ad led to registrations for an app or service.

LG is not alone. Most major smart TV manufacturers deploy some form of ACR in their hardware, although the controls available to users vary by vendor.

The source of so much frustration, however, is that manufacturers are not forthcoming with consumers at the point of purchase about the extent to which their data is collected or how.

Generating audio transcripts while the display is in standby is not something LG highlights in its product descriptions or marketing materials. According to Gamers Nexus, however, that is what its testing uncovered.

Instead, the company's website describes its TVs' voice features using terms such as "Intelligent Voice Recognition" and "Clear Voice Pro."

Customers who go digging for more details must navigate to an "LG Privacy" link most of the way down a lengthy product page. From there, they must sift through four links to understand its privacy policies more fully, although neither the documents nor the main product page references LG Ads Solutions.

Gamers Nexus claims LG sends all the data its hardware collects to the ads unit, which claims in its marketing materials that customers can "own the living room," having their ads appear on devices inside "the connected LG household."

LG Ads Solutions' official fact sheet, which predictably requires you to enter your personal and contact details to access, states that there are 49 million LG TVs in the US powered by its webOS, but the company's total reach extends to 363 million "addressable secondary devices."

To potential customers, it promises "precision targeting at the device level, across households."

ACR and other data-collection technologies have become commonplace across the smart TV market.

Research suggests that many consumers are willing to trade their data for tangible financial savings, but the privacy implications are compounded when you consider these devices can be found mounted in boardrooms and doctors' offices.

Twice bitten

The allegations come less than two months after Gamers Nexus reported that connecting certain LG monitors to an online Windows 11 PC could trigger installation of the LG Monitor App through Windows' device metadata system. The behavior depended on the user selecting Recommended Settings during Windows setup and being signed into the Microsoft Store.

"Additionally, to provide smart TV functionalities, LG TVs feature the ability to scan for and connect to nearby devices on the same network. This is a standard function commonly available on smart TVs and smart home devices.

"The ACR (Automatic Content Recognition) feature is provided on an opt-in basis to deliver personalized content recommendations, services, and advertisements. If a user does not consent to the applicable optional agreement, ACR data is not used for advertising purposes."