LG Smart TV sends over one hundred requests to advertisers and trackers within minutes of booting up
Over the course of dinner, an LG smart TV monitored by Ouzel issued 838 DNS queries, 73% of which are stopped by our blocklists while we retained full functionality of the TV.
What did we measure
A device on the internet makes DNS queries to turn human-readable website names like "example.com" into computer-readable IP addresses.
These DNS queries can't be used to tell you what data the device is sending. Instead, they tell you where data will be going, like the address on an envelope, with the contents sealed inside.
During the test, Ouzel's ad blocker was monitoring these queries, blocking some of them, and noting down what exactly the TV tried to reach.
The short version
- 72Different hostnames queried
- 838Total queries seen
- 73.4%Of those queries blocked
Why we should care
A smart TV carries a massive amount of information about you.
It's not just about your viewing habits. LG Smart TVs also collect nearby wifi networks, which are used to locate where you live within about 30 feet. LG's Automatic Content Recognition system identifies what shows you watch, streaming services you use, and subscriptions you have.
Automatic content recognition (ACR) is a technology used to identify content played on a media device... This information may be collected for purposes such as personalized advertising, content recommendations, or sale to companies that aggregate customer data.
Although this data collection may seem standard, it gets much worse.
The United States FTC caught Vizio combining the user data they collect with information from data brokers. This included "sex, age, and income." The court decided that Vizio needs to list data collection in their privacy policy, which most people will never read.
As if it couldn't get worse, the tech journalist Gamers Nexus recently found LG Smart TVs recording their passing conversations from up to 70 feet away. In the video, they say the TVs are capable of being used as "eavesdropping listening devices."
This massive data collection makes smart TVs a treasure trove for trackers and hackers. Your location, sex, age, viewing habits, and more may be sent to people you will never know. Stopping data collection is the one sure-fire way to prevent your data from winding up in other people's hands and improve your privacy.
How we monitored traffic and blocked trackers
Ouzel is a small device that acts as a wireless router. It allows all connected devices to freely access the internet, except to certain blocked servers. These blocked servers come from a customizable list of common ads, trackers, and spam.
Ouzel figures out what a connected device is trying to reach by the website address in its DNS queries. By blocking a query, Ouzel prevents tracking data from reaching its recipient.
These blocked domains are pre-loaded but adaptable. As Ouzel monitors a smart device's traffic, the list of what gets blocked is refined.
There are limitations to what this setup can block. Certain devices use workarounds like hardcoded addresses and proxied traffic. Ouzel has defenses against some of this behavior, but it's not 100% accurate.
What the TV tried to reach
This data was not surprising. A smart TV has many apps that it must initialize as it is powered on. Some of these 838 queries were for Youtube, some for Netflix, but a large chunk of them were to advertising and tracking servers.
What was more interesting was how many of these queries were in our blocklist. Let's take a look at how many Ouzel blocked:
The graph shows that the TV is sending off most of its necessary queries within the first few minutes. Queries for firmware updates, logins, and status checks were seen in this time.
As time goes on, Ouzel blocks an increasing percentage of requests made. By the time we were done eating dinner, about 97% of queries were being blocked. Put simply, the TV had already connected to the necessary servers for watching shows, but the TV retried failed requests to ads and trackers until we turned it off.
Lets zoom in on the boot-up sequence. Here are the first 5 queries:
| Host | Who runs it | What it seems to be for | Time after Bootup | Verdict |
|---|---|---|---|---|
aic.service.lgtvcommon.com | LG | Automatic Content Recognition. Identifies what's on the screen for targeted advertising. | 0 seconds | blocked |
lgtvonline.lge.com | LG | Checks if the TV is online, LG account login | 1 second | allowed |
www.youtube.com | YouTube app loading in the background | 1 second | allowed | |
aic.cdpbeacon.lgtvcommon.com | LG | Tracking/usage-reporting beacon for the ACR system | 1 second | blocked |
unagi-na.amazon.com | Amazon | Usage metrics from the Prime Video app (North America) | 2 seconds | blocked |
This result was shocking. The very first query the TV issues is for LG's Automatic Content Recognition (ACR) service. Before checking if the user is even online or logged in, LG is already initializing ACR.
Another way to understand ACR is as continuous monitoring of what's on your screen. When your TV opens a connection to LG's ACR system, LG can collect a "fingerprint" of what you are watching whenever they want. This fingerprint contains information about what was on the screen at the moment it was captured.
The TV is so persistent about its connection to ACR that over half of all blocked DNS queries were for this one purpose. Luckily, Ouzel was able to intercept and block these queries, preventing our watching habits from being sent to LG.
What it did and when
Power on, first 5 minutes
Initializing device and ad/tracking connections. TV initializes apps, like Netflix, even if you don't use them.
Sitting idle on the home screen
TV continuously tries to reach LG's ACR server to report on what you are viewing.
During playback
Youtube fetches videos and in-stream ads. In-stream Youtube ads are not defeated by DNS filtering.
What didn't work
Our blocking system is not perfect, and some trackers and ads did make it through. We are working to catch all of the sneaky ways that vendors try to get around our tech. Here are some of the ways we are working to improve Ouzel.
As Ouzel's development is continued, we will refine our blocklists and improve our techniques. Although the blocking is not perfect, we expect it to get much better as time goes on.
The domains that made it through Ouzel's filtering have already been added to our system. As the number of Ouzels grows, each device will contribute to the blocklists and ensure that any sneaky workarounds are caught quickly.
What this means for you
The main takeaway here is that smart devices are constantly reaching out for ads and trackers. This behavior is not usually obvious to the user, and very few people will read the terms of service to understand how their data is being used.
Advertisements can be manipulative and down-right annoying. Data sent by trackers can be sold and sometimes ends up in the hands of hackers. For these reasons, it is recommended to use an ad blocker like PiHole, uBlock, or Ouzel.
Users that find it difficult to configure servers and networking, and users that want insight into what their devices are doing, should check out Ouzel: the easy to use ad and tracking blocker. Find out how it works or learn about the project.
Want the device that made this possible?
Ouzel is in development, and we are targeting a 2027 release. We anticipate all of the functionality you've already seen and way more. Join our waitlist at no cost to stay up-to-date with the project.
Unsubscribe any time. Privacy policy