A television used to be a passive receiver. Broadcast signals came in, a picture went out, and nothing about your living room went anywhere. A smart TV running an operating system like Tizen is a different machine. It is a networked computer that can run machine learning models on the device, talk to peripheral hardware, and build detailed behavioral profiles of the household it sits in.
That shift came back into the news in October 2026, when a security researcher using the handle log4j published a set of technical claims about a 2025 Samsung TV. The trigger was a run of strangely specific, behaviorally targeted ads. The researcher reverse-engineered the set, got root access to its Tizen OS, and mapped what looked like a wide telemetry setup: automatic content recognition, audio-event classification, persistent advertising identifiers and local screenshot processing.
The full exploit chain and the raw firmware dumps have not had broad independent review yet. Still, the underlying technologies are documented and standard across the industry. They are how modern consumer electronics turn the living room into ad inventory.
What protects a Samsung Tizen TV
To appreciate what log4j had to get past, start with the platform. Tizen is not stripped-down embedded firmware. It is a full Linux-based environment hardened with Samsung’s Knox framework and hardware-backed isolation.
At the kernel level, Tizen uses SMACK (Simplified Mandatory Access Control Kernel), a Linux Security Module that enforces application sandboxing. Traditional discretionary access control ties file permissions to user ownership. SMACK instead gives every process and every object (file, socket or device node) a mandatory security label. A misbehaving app therefore cannot read the memory or configuration files of the TV’s core telemetry services unless a central security manager explicitly allows it.
The Tizen security manager daemon also mediates inter-process communication and enforces certificate pinning on network connections, which makes it hard for third-party apps to intercept the manufacturer’s own data streams. On the hardware side, modern smart TV chips use ARM TrustZone to create a secure world separate from the normal-world Linux kernel. In theory this protects cryptographic keys, the secure boot chain and debugging interfaces from software-based extraction.
How the researcher got root on the TV
According to the report, log4j first hit the firmware’s AES encryption, a standard way to protect intellectual property and block offline patching. Getting around it usually means one of two things: pulling keys out of the secure enclave with hardware fault injection, or finding a bootloader or early-init bug that leaves keys in volatile memory.
Once past the encryption, log4j says an undisclosed vulnerability gave a root shell. Root exposes the system’s daemons, configuration manifests and live network sockets. Security researchers often look at the Samsung Smart Development Bridge (SDB), a debugging service similar to Android’s ADB that has been a recurring source of privilege escalation bugs when it is poorly restricted or exposed on a local network.
Root also bypasses SMACK’s user-space protections. An investigator can dump the memory of telemetry daemons, intercept D-Bus or custom Tizen RPC calls, and watch exactly what the TV queues up to send out.
One caveat matters for everything that follows. A rooted, modified firmware environment is not the same as a retail unit running under its intended constraints. Finding a capability in a binary does not prove it runs in production, and responsible disclosure depends on keeping those two things apart.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →Automatic content recognition (ACR) explained
The most widespread and commercially important technology in this investigation is automatic content recognition. ACR turns the TV into an optical and acoustic sensor. It does not record and upload continuous video, which would swamp home broadband and cause an instant backlash. It fingerprints content on the device instead.
The TV’s chip continuously samples the audio and video pipelines and produces compact signatures of whatever is on screen. For video, that usually means shrinking the frame buffer, converting it to grayscale and applying a discrete cosine transform (DCT) to get a perceptual hash (pHash). That hash survives scaling, compression artifacts and small color shifts. For audio, the system extracts Mel-frequency cepstral coefficients (MFCCs) to build an acoustic fingerprint, similar in spirit to what Shazam does.
The fingerprints go to large cloud reference libraries and are matched against known broadcast TV, streaming catalogs and ads. Because ACR works at the display controller level, it does not care where the signal comes from. It can identify content from native smart TV apps, over-the-air broadcasts and external devices connected over HDMI.
ACR keeps running on HDMI inputs
That cross-input tracking was tested in a 2024 ACM Internet Measurement Conference paper titled “Watching TV with the Second-Party.” Researchers at University College London showed that smart TVs keep fingerprinting even when they serve only as external monitors for laptops, game consoles or set-top boxes.
The team used custom router firmware and man-in-the-middle proxies that could intercept TLS-encrypted traffic. They found that the TV’s software picks up the incoming HDMI signal, extracts perceptual features and queries its ACR servers. A manufacturer can therefore watch viewing that happens entirely outside its own software.
The Texas lawsuits and the 500 ms sampling interval
The legal fight over ACR escalated in December 2025, when Texas Attorney General Ken Paxton sued several major TV makers, including Samsung, LG and Sony, alleging deceptive trade practices around ACR. The filings pointed to a sampling interval of 500 milliseconds, which works out to two audio-visual fingerprints every second.
In February 2026, Texas reached a major settlement with Samsung. It requires express, conspicuous consumer consent before any ACR data is collected in the state. The sampling rate is still worth dwelling on. At two samples per second, a TV produces more than seven thousand sampling events an hour. That gives a very fine timeline of what a household watches, when it pauses and which ads it skips. All of it is processed on the device before the resulting metadata leaves.
Audio classification: barking dogs and crying babies
The firmware analysis also turned up audio pipelines that go well beyond voice commands. log4j found internal telemetry counters and event logs tied to environmental sound classes such as dog barking and infant crying, tagged with internal identifiers like EV201.
That points to small neural networks running locally for acoustic scene classification. A signal processor would analyze the ambient noise floor and pull spectral features to match predefined sound signatures, rather than streaming raw audio to the cloud. Samsung does market features like “Pet Care” and “Family Care” that use sound detection to send alerts to your phone through SmartThings, so the capability itself has a legitimate use.
The concern is what happens to the output. Counters for these sound classes sit alongside the advertising and telemetry daemons, which raises a fair question about secondary use. A profile that knows a household has a barking dog or a baby is valuable to programmatic advertisers across the web. The technical question is whether the classifier’s output goes only to the local SmartThings notification service, or whether the tags get attached to the device’s persistent advertising identifier and passed to outside data brokers.
Can a smart TV use your soundbar as a microphone?
One of the more contested claims from the firmware work is that TVs without built-in microphones may try to collect audio through connected peripherals. Many home theaters route sound through a soundbar or AV receiver over HDMI ARC or eARC, or through Bluetooth audio devices, and Tizen has the driver-level access to query those devices for audio input.
Through HDMI-CEC, a TV can already send wake commands and audio-routing requests to a soundbar. Suppose the TV’s privacy settings say the local microphone is off, but the system asks a connected soundbar for an audio feed anyway, labeled “audio synchronization,” “room calibration” or “voice assistant passthrough.” That would bypass the user’s consent controls.
A separate test by Hugging Face engineer ngxson saw a rooted Samsung TV activate its microphone pipeline for about five seconds and then stop. One brief activation on a modified device does not prove a continuous, hidden room-surveillance network. It does show that the software can start the audio hardware without any visible indicator. To show that the audio is then packaged, encrypted and sent to advertising partners, you would need stateful packet inspection and process-level tracing on unmodified retail hardware. The public disclosures have not reached that standard yet.
On-device machine learning and the smart TV performance tax
Always-on ACR, environmental audio classification and local screenshot processing all need machine learning models running on the TV’s own silicon. log4j suggested these services could be a major cause of the laggy menus and input delay that smart TV owners often complain about.
TV chips are tuned for hardware video decoding (AV1, HEVC) and real-time upscaling, but their compute budgets are finite. When a neural network is analyzing UI navigation, spotting ad skipping and generating hashes for the ACR engine at the same moment, those jobs compete for memory bandwidth and NPU cycles. The firmware also appears to include models that classify what a user is doing inside third-party apps, which would form a shadow analytics layer separate from each app’s own telemetry.
This creates a privacy paradox. Processing on the device is usually seen as the privacy-friendly option, because raw video frames and continuous audio never leave the home. But the output of those models, such as a confidence score that you are watching a particular genre or a tag showing a pet is present, is exactly what ad exchanges want to buy. The TV absorbs the compute and bandwidth cost of crunching raw sensor data and ships out only the refined, sellable metadata. The slowdown you feel is, in effect, your hardware subsidizing the manufacturer’s data-processing costs.
Why TV makers collect this data: the ad-tech business model
Margins on large OLED and QLED panels have shrunk a lot over the past decade, so manufacturers increasingly treat the set as a low-margin or loss-leading way to deliver their software platforms. Vizio’s financial disclosures have shown this plainly: its platform and advertising segments have brought in hundreds of millions in gross profit, far above the razor-thin or negative margins on hardware sales.
Samsung’s “Viewing Information Services” and related ad networks rest on the same idea. The living room captures attention like few other places, and measuring it at 500-millisecond resolution is worth a great deal to brands and media buyers.
Once a TV creates a persistent cross-device advertising identifier (AID) and ties it to a timeline of viewed content, skipped ads and inferred household demographics, the profile can be synced with data brokers and mobile ad networks. Say you watch a car commercial on the living room TV and later see an ad for the same vehicle on your phone during your commute. That link usually comes from the shared AID plus probabilistic matching on your IP address and Wi-Fi network topology.
The TV ends up as the anchor of a household’s digital identity, with ground-truth viewing data that beats the cookie-based tracking of the desktop and mobile web. The Texas enforcement actions are, at bottom, a fight over transparency in this exchange. They demand that consumers be told explicitly when their attention is being packaged and sold.
How to reduce smart TV tracking: network segmentation
If you care about privacy or run a home network, flipping the “ACR” toggle in settings is not enough. The most effective control is strict network segmentation. Put the TV on an isolated IoT VLAN or a guest network and use stateful firewall rules to stop it from opening connections to your computers, NAS or home automation server. Then even a compromised or misbehaving telemetry daemon will have a hard time mapping your internal network or pulling out local data.
Segmentation also lets you filter outbound traffic aggressively. You can allow the TV to reach only the IP ranges it needs for DRM authentication and core streaming.
Why DNS blocking with Pi-hole often fails
Blocking known ACR domains through a local DNS tool like Pi-hole or NextDNS worked well a decade ago. Today it runs into trouble. Many smart TV operating systems use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT), which encrypts domain lookups and skips local port 53 interception entirely.
Many telemetry services also live on large multi-tenant CDNs shared with essential streaming infrastructure. Block the wrong domain or IP and you can break authentication for Netflix or Disney+, leaving the TV unusable.
The more advanced route is deep packet inspection or a transparent proxy that can read TLS-encrypted traffic. That requires installing a custom root certificate in the TV’s trust store, which is usually impossible without the same kind of root access log4j had to exploit in the first place.
Firewall rules and IP sinkholing
Another option is editing the TV’s host file or setting up a sinkhole routing policy at the network edge. If you can identify the IP addresses or CIDR blocks used by the manufacturer’s ACR and telemetry servers, a stateful firewall can silently drop outbound TCP SYN packets to them.
This differs from a DNS block, which the TV’s OS may detect and bypass using hardcoded fallback IPs or secondary DoH providers. A network-layer drop looks like an unreachable destination, and the telemetry daemon often backs off its retries and saves resources.
The catch is upkeep. Ad-tech networks rotate their IP allocations often and use domain fronting to disguise telemetry as ordinary content delivery, so the block list needs constant updating. Cutting off network access completely will stop data leaving, but it may also trip the TV’s DRM anti-tamper checks, and then licensed streaming apps may refuse to play HD content.
What the evidence shows so far
The log4j investigation highlights the gap between what people expect from their TV and what it does. The set on your wall senses, computes and classifies, using local neural networks, acoustic classifiers and optical fingerprinting at high frequency.
Whether a feature like pet monitoring is a convenience or an ad-profiling pipeline depends entirely on where the processed data ends up, since the hardware capability is the same either way. Settling that question takes reproducible, network-level evidence. A binary that can classify audio does not mean private conversations are being recorded, and an ACR module does not mean raw household video is being uploaded.
What the evidence does support is a combination of 500-millisecond perceptual hashes, acoustic event counters and cross-device advertising identifiers that adds up to behavioral tracking of unusual intimacy and scale. Until manufacturers offer verifiable privacy controls and regulators limit secondary use of environmental sensor data, the smart TV will stay one of the least understood data collection points in the home.
