Turning off a setting is supposed to mean something. A Northeastern University study examined 12 smart TVs from 10 manufacturers and found that Vizio’s SmartCast platform kept secretly tracking users by sending roughly the same volume of traffic to an Amazon Kinesis server associated with automatic content recognition after users opted out through the TV’s settings menu.
That traffic persisted even when the television sat idle on its home screen, with no content playing.
What ACR Does
Automatic content recognition is the data-collection engine behind much of connected-TV advertising’s value.
Automatic content recognition, or ACR, identifies what appears on screen across cable, HDMI inputs, streaming apps, and over-the-air broadcasts. It gives manufacturers and their advertising partners a detailed window into viewing behavior.
How the Study Worked
Northeastern researchers repeated every test condition 30 times to establish a reliable pattern.
Researchers ran each viewing scenario 30 times with ACR enabled, then repeated every scenario 30 times after opting out. The study covered operating systems used by roughly 95% of U.S. smart TVs, according to the researchers.
Because the SmartCast traffic was encrypted, researchers could not confirm what the payload contained. They explicitly did not conclude that Vizio violated its 2017 FTC settlement. Only one Vizio TV was tested, so the result may not reflect every model in the lineup.
The WatchFree+ Problem
The DNS exposure through WatchFree+ is a separate issue from ACR and has no user-facing fix.
Vizio’s WatchFree+ streaming service sent unencrypted DNS lookups to Amagi, a streaming-delivery company. Those lookups exposed show and channel names to anyone with visibility into network traffic. Vizio provides no user setting to disable this behavior.
How Other Platforms Compare
The findings suggest a broader gap across several tested platforms, though some manufacturers performed better than others.
LG webOS, Fire TV, VIDAA, and Sony Google TV stopped relevant traffic after users opted out. Samsung continued ACR-like transmissions during tests involving its own streaming service. Roku’s opt-out did not cover The Roku Channel.
Vizio’s Regulatory History
The 2017 FTC settlement established clear obligations around consent and disclosure that make the new findings difficult to set aside.
In 2017, the FTC and New Jersey’s attorney general alleged the company collected second-by-second viewing histories from 11 million smart TVs without user knowledge or consent , behavior reminiscent of a surveillance app operating beyond users’ awareness. Vizio paid $2.2 million to settle.
The resulting order required affirmative express consent, prominent disclosure of data practices, deletion of data collected before March 1, 2016, and a privacy program subject to biennial review. The Northeastern findings do not establish a violation of that order, but they raise serious questions that regulators and independent auditors should examine carefully.
What Walmart’s Ownership Adds
Walmart’s stated rationale for buying Vizio makes the opt-out gap commercially significant, not just a software quirk.
Walmart announced an agreement to acquire Vizio in February 2024 for approximately $2.3 billion. Walmart was explicit that SmartCast’s advertising capabilities and platform were a primary driver of the deal, specifically citing expansion of its Walmart Connect ad business.
That context matters. An opt-out that does not stop data transmission is not a minor interface oversight when the acquisition was framed in substantial part around that advertising platform.
What Should Actually Change
The industry needs opt-outs that hold at the network level, not just at the settings screen.
Opt-outs must reflect actual network behavior, encrypted or otherwise. Manufacturers should publish independent audit results that verify the connection between a user’s consent choice and what their device actually transmits.
Service-layer DNS exposure, the kind WatchFree+ creates, requires a separate technical remedy. Blocklists alone cannot resolve it, according to the researchers’ own testing.
What Readers Can Do Now
The researchers’ strongest recommendation requires no settings toggle at all.
The researchers advise keeping the television offline and routing streaming through a separate device whose ACR behavior can be controlled independently. Network-level blocking of known ACR servers reduced exposure in testing but did not stop the WatchFree+ DNS leakage , for more on how to stay safe from hidden device-level threats, independent precautions remain essential.
A setting that says “off” should mean off.
