A 135-Minute Investigation by Gamers Nexus Exposes How 200 Million+ LG Televisions Harvest Data From Every Device on Your Home Network, Transcribe Voice Prompts in Plain Text, and Feed It All to an Advertising Engine, Even When the TV Is Off
Your living room television is doing a lot more than displaying content. A July 2026 investigation from Gamers Nexus found that LG smart TVs actively scan home networks for phones, smartwatches, and other connected hardware, capture microphone audio while the screen appears powered down, transcribe voice commands into plain-text logs, and upload it all to LG’s advertising division as soon as an internet connection is available. LG has sold an estimated 216 million smart TVs worldwide. LG Ad Solutions, the company’s ad division, markets access to 363 million “secondary addressable devices” in the US alone, a number that exceeds LG’s own installed base and points to network-level device enumeration happening inside people’s homes.
The investigation was led by Steve Burke of Gamers Nexus, working with Level1Techs and several independent security researchers. Over a 135-minute video and accompanying documentation, the team ran packet captures, bench-tested microphone behavior in standby, found remote code execution flaws in webOS, and traced the data pipeline from a living room to LG’s ad-targeting infrastructure.
LG has not publicly responded to the specific findings as of publication. The company’s existing privacy language states that its televisions “do not collect, record, or store ambient conversations.” The evidence in this investigation contradicts that.
The Network Sweep: Your TV as a Reconnaissance Tool
Using Wireshark packet captures on a retail LG G5 OLED, a 2025 flagship model, the research team found webOS actively performing LAN sweeps, probing the local subnet for devices that have nothing to do with video playback.
The TV broadcasts discovery queries across the local network and logs the responses. When a phone, smartwatch, tablet, laptop, or IoT device answers, LG’s television records internal IP addresses, device names, and MAC-derived identifiers. It also picks up the SSIDs and signal strengths of neighboring Wi-Fi networks visible to its wireless radio, building a rough map of the surrounding area, and includes location data tied to those network identifiers in what it collects.
This is active scanning, not passive listening: the television initiates the queries, processes the responses, and packages the results into structured data. The researchers confirmed the behavior happens out of the box, with no extra configuration needed, and found no setting that disables the LAN sweep on its own, separate from other smart features.
In practice, any LG smart TV on a home Wi-Fi network is cataloguing every device that shares it. A phone, a partner’s watch, a kid’s iPad, a work laptop: all of it gets logged and tied to the household. LG Ad Solutions uses this device graph to build “addressable audiences,” letting advertisers target ads based on all the hardware in a home, not just what’s showing on screen.
LG’s own numbers hint at the scale. LG reports around 216 million smart TV sales worldwide, but LG Ad Solutions tells advertisers it can reach 363 million secondary addressable devices in the US alone. The roughly 147 million device gap lines up with the network enumeration documented here. Every phone, tablet, and wearable sharing a router with an LG TV becomes an addressable data point.
Microphone Capture in Standby: The “Off” State That Isn’t
The team placed an LG G5 in what looked like standby, screen black, no sign of activity, and monitored the microphone. It captured clean, intelligible audio.
The audio wasn’t reduced to abstract wake-word feature vectors, which is what you’d expect from a dormant voice assistant. It was converted to plain text and stored in on-device logs.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →The capture window stays open for 10 to 15 seconds after someone stops speaking. Say a voice command, then turn and keep talking to someone in the room, and the microphone is still recording. Anyone in earshot who never addressed the TV gets swept into that window too.
The researchers then tested exfiltration. They pulled the Ethernet cable, cutting all network access, and spoke into the room. The TV, still apparently in standby, recorded the audio and stored it locally. When they reconnected the cable, the television uploaded the stored files to LG’s servers. Disconnecting doesn’t stop the collection; it just queues the data until the connection comes back.
That behavior sits uneasily next to LG’s statement that its TVs “do not collect, record, or store ambient conversations.” Plain-text transcription, a 10-to-15-second extended capture window, and a store-and-forward upload mechanism point to a system built for ongoing audio logging, not momentary voice-command recognition.
What This Investigation Adds to ACR
Automated Content Recognition isn’t new. It’s been documented in Samsung, Vizio, and LG televisions for years. ACR samples on-screen audio and video, fingerprints it, and matches the fingerprint against a database to identify what’s playing. It runs across every input, including HDMI, so it works even when the TV is just a monitor for a console, Blu-ray player, or streaming stick.
Earlier reporting on ACR mostly stopped at content identification: the TV knows what you’re watching. This investigation shows the collection goes further. The ACR pipeline feeds into the same telemetry system as the network scanning, location harvesting, and audio logging. The content fingerprint is one data point in a larger household profile, not a separate function.
The researchers also showed that a compromised LG television can pull audio directly from an HDMI feed. In a hospital or corporate setting, where an LG display might sit connected to a computer running a video call, the television’s ACR sampling can capture that call’s audio. One surgeon who reviewed the findings asked Gamers Nexus directly what this means for patient confidentiality if a hospital’s LG display is capturing audio from a telemedicine session over HDMI.
There’s no standard user setting that fully disables ACR. It runs as a background process in webOS, independent of whatever input is active. Even when the TV displays content from an external device over HDMI, the fingerprinting engine keeps running.
webOS Vulnerabilities: Remote Code Execution
The investigation also turned up remote code execution vulnerabilities in webOS. The specifics are moving through responsible disclosure: the researchers reported the flaws to LG and are giving the company a window to patch before publishing exploit details.
What’s known is that the flaws live in webOS’s network-facing services, the same broad network listeners that enable the LAN sweeps and device enumeration described above, which widens the attack surface considerably. A remote code execution flaw here means a skilled attacker could potentially run arbitrary code on the television over the network, turning it into a persistent surveillance device with no physical access required.
The team demonstrated a proof-of-concept compromise on an LG G5, converting it into a listening device under external control. In that state, the TV recorded room audio with the screen appearing off and the Ethernet cable unplugged, then exfiltrated the file once the connection was restored. That was a controlled exploit, not a field-deployed attack, but it shows what a webOS vulnerability could enable in the wild.
Always-on network listeners, microphone access, local storage for offline data, and remote code execution flaws together add up to a threat model more typical of dedicated surveillance hardware than consumer electronics.
“We Own the Glass”: The Advertising Machine
The data collected by LG televisions flows into LG Ad Solutions, the company’s targeted advertising division. Its pitch materials to advertisers include the line “We own the glass,” referring to the screen itself, and promise the ability to “own the living room” using data pulled from hardware people already paid for.
That’s the business reason the collection architecture exists. The television isn’t just a display; it’s an acquisition terminal. Every device on the network, every voice prompt, every piece of content ACR fingerprints, every neighboring Wi-Fi network: it all feeds a targeting model that personalizes ads on screen and profiles the household across the wider ad ecosystem.
The 363 million secondary addressable devices figure LG Ad Solutions cites to US advertisers isn’t a projection. It’s the direct output of the network enumeration this investigation documented. Every LG smart TV on a home network counts every other device that shares its subnet.
LG isn’t alone here. Samsung’s ad platform, Vizio’s Inscape (now part of Walmart’s ad-tech stack), and Roku’s content recognition systems all use similar ACR and data-collection mechanisms. What sets the LG findings apart is the combination: aggressive network-level scanning, plain-text voice logging, standby microphone capture, and store-and-forward uploads when connectivity drops.
Where Are These TVs?
LG displays sit in hospitals, medical offices, corporate boardrooms, hotel lobbies, conference centers, and government buildings, often connected to networks carrying sensitive data, sometimes used for telemedicine sessions, confidential presentations, or video conferences.
If ACR can pull audio from an HDMI feed, a telemedicine call running through a laptop connected to an LG display could be audible to the television’s fingerprinting engine. In a hospital, that’s protected health information under HIPAA. In a law firm or boardroom, it could be privileged communication or trade secrets. In a hotel, it could be a guest’s conversation, recorded by a device they assumed was just a monitor.
The surgeon who wrote to Gamers Nexus wasn’t raising a hypothetical. If an LG display in a clinical setting runs ACR and network enumeration by default, and a webOS vulnerability opens remote access to the microphone or HDMI audio, the compliance exposure is real. HIPAA, GDPR, and other sector-specific rules impose strict requirements on sensitive audio and personal data. A television that logs voice input in plain text and maps every device on the network doesn’t meet that bar in any regulated environment.
Why Unplugging Doesn’t Stop the Collection
The usual advice for smart devices, unplug it from the network, doesn’t fully work here. When the team pulled the Ethernet cable, the TV kept transcribing voice prompts and queuing network scans, writing everything to its internal flash storage. When they reconnected the cable, whether minutes or days later, it uploaded the full queued dataset to LG’s servers.
So the collection runs continuously regardless of connectivity. Going offline doesn’t pause it, it just delays the upload. Someone who unplugs their TV overnight and reconnects it in the morning has still had it logging audio, scanning the network, and fingerprinting content the whole time, and all of it goes out the moment the connection returns.
The research team’s only fully effective mitigation is disconnecting the LG television from any network permanently and using an external streaming device, an Apple TV, Chromecast, or similar box, for smart functionality. That removes the TV from the network entirely and leaves it as a pure display, driven by the external device’s HDMI output.
Smart TV Privacy Has a Lof of History
LG isn’t the first case here. In 2015, Samsung drew criticism when its privacy policy seemed to suggest that voice commands near its TVs could be shared with third parties, including Nuance Communications, for speech recognition. Samsung later clarified the language, but the incident stuck.
Vizio settled with the FTC for $2.2 million in 2017 after the agency found the company had collected viewing data from 11 million smart TVs without adequate disclosure. Vizio’s ACR system tracked viewing across all inputs, including HDMI, and shared the data with third-party advertisers. The settlement required affirmative consent going forward and deletion of previously collected data.
Roku, Amazon Fire TV, and Apple TV have all faced scrutiny over their data practices too, though the scope varies by platform. What sets the LG findings apart is the full combination operating at once: network-level device enumeration, plain-text voice logging, standby microphone capture, and store-and-forward uploads. No earlier smart TV investigation has documented all of these together on a retail device.
The regulatory backdrop matters too. The EU’s GDPR sets strict requirements on data collection, processing, and consent. The California Consumer Privacy Act and the California Privacy Rights Act give consumers rights over data collected by connected devices. The FTC has been paying closer attention to smart home device practices generally. If these findings hold up under regulatory review, they could trigger enforcement action in more than one jurisdiction.
What LG Has Said, and Hasn’t
LG hasn’t addressed the specific findings publicly as of publication. Its existing privacy language says its televisions “do not collect, record, or store ambient conversations.” The evidence here, plain-text transcriptions stored in on-device logs, microphone capture during apparent standby, and a 10-to-15-second post-speech capture window, directly contradicts that.
LG’s privacy policy and webOS terms do reference data collection for advertising and content recommendation, but in broad terms that don’t specifically disclose network device enumeration, standby microphone capture, or the store-and-forward upload mechanism. The open question is whether a reasonable person reading that policy would understand their TV is mapping every device on their home network and logging their voice in plain text while the screen is off.
Responsible disclosure for the webOS remote code execution flaws is still underway. LG has been notified, and the researchers are giving the company a standard remediation window before publishing exploit details. Whether LG issues patches, a public statement, or policy changes remains to be seen.
What You Can Actually Do
The research team’s core recommendation: disconnect your LG smart TV from the internet entirely and use an external streaming device for smart functionality. That’s the only step that removes the network scanning, upload, and remote attack surface completely.
If you’re not ready to go that far, a few partial mitigations help without eliminating the problem:
Turn off voice recognition and microphone features. Disable ThinQ AI, Alexa, or Google Assistant integration in settings. This may not stop all microphone access, since the investigation found audio capture in standby that appeared independent of any active voice assistant session.
Check advertising settings. Look in webOS settings for personalized advertising, content recommendations, and data sharing toggles, and turn them off. These settings likely don’t touch the network-level scanning.
Put the TV on an isolated VLAN or guest network. If your router supports it, connect the TV to a segment that can reach the internet but can’t see your other devices. This limits what the TV can enumerate on your main network, though it won’t stop the TV from uploading its own telemetry.
Use Ethernet with a firewall instead of Wi-Fi. A hardware firewall between the TV and your router can block known LG telemetry endpoints. This takes ongoing maintenance, since LG can change endpoints.
Replace the smart features with an external device. Connect an Apple TV, Nvidia Shield, or Chromecast with Google TV over HDMI, disable every smart feature on the LG set, and use it purely as a display. This is what the Gamers Nexus team recommends.
Install firmware updates when LG releases them. Patches for the webOS vulnerabilities won’t address the underlying data collection design, but they’re still worth installing.
Who Owns Your Living Room
“We own the glass” isn’t just a slogan. It describes a model where the hardware you bought functions as a permanently leased data-collection terminal, with video display as a secondary feature.
Other manufacturers do versions of this too, but this investigation lays it out with unusual technical detail: network sweeps, plain-text voice logs, standby microphone capture, offline data queuing, and remote code execution vulnerabilities, all in the same device.
There are roughly 216 million LG smart TVs in homes, hospitals, offices, and hotels worldwide. Each one maps its local network, fingerprints its content, and logs audio, on or off, whether you’re talking to it or to someone else, whether you’re online or not, and feeds that into an ad engine that sells access to your living room.
Smart TVs collecting data isn’t news. What this investigation raises is whether that collection has moved from passive content recommendation into active, persistent surveillance, and whether current regulation can catch up before the next wave of connected devices pushes further.
For now, the simplest answer that still works – unplugging it.
This article will be updated if LG responds publicly to the Gamers Nexus investigation, or if the webOS vulnerability disclosures result in published CVEs and firmware patches. The responsible disclosure window for the remote code execution findings remains open as of publication.
Sources: Gamers Nexus investigation (July 2026), Level1Techs collaborative testing, LG Ad Solutions marketing materials, FTC v. Vizio settlement (2017), Samsung voice recognition privacy controversy (2015), webOS architecture documentation.
