All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
Are you seeing highly personalized ads on your Samsung TV lately, similar to the ones you’re accustomed to seeing on your phone? It’s unfortunate, but TVs are quickly climbing up the list of devices that are allegedly collecting and profiling your data behind your back.
Security researcher @log4j on X got inside his 2025 Samsung TV using a zero-day to obtain a root shell. He examined the Tizen OS code and found several alarming issues with Samsung TVs.[1] There’s a microphone that’s always on, a camera that can record you, an ACR button that doesn’t work, and an AI model watching your every move.
Here’s everything you should know about the new research findings, along with the steps you can take to stop your TV from spying on you.
It all started when log4j (X username), a cybersecurity bounty hunter, noticed that the ads on his Samsung TV were far too personalized and targeted. He then reverse-engineered the Tizen OS on his 2025 Samsung TV, only to discover some alarming privacy issues. Here’s what he found.
According to log4j, the Tizen code includes a microphone function that’s always listening. Now, any TV with voice control has to listen for a wake word, so the real question is: what happens to that audio once the wake word is detected?
Hugging Face engineer Xuan-Son Nguyen (@ngxson on X) said that he tested the mic and observed that it was active for about five seconds but then stayed off for hours. However, that was on an already-rooted television. If the TV has no mic, Samsung can allegedly look for a connected device, such as a soundbar or a Bluetooth device, to pick up audio samples.
Additionally, the TV sorts the sound into categories and even keeps counts of events such as a dog barking or a baby crying, which eventually go into the telemetry sent to Samsung’s servers.
Log4j found that when a supported camera is connected to the television, the TV automatically starts a preview. Recording capabilities are present in the code, and there’s a separate, non-normal power indicator.
Credentials are also streamed to Samsung’s servers over TURN, a relay channel typically used for video calls, and the telemetry records how long the camera has been streaming.
One of the most concerning findings is that the ACR switch may not fully work on Samsung televisions. ACR is a built-in feature in many modern smart TVs that regularly samples what’s on screen as audio and video “fingerprints.” It then matches those samples against a database to work out what you’re watching. This data comes in handy for targeted ads and is even sold to advertising platforms.
However, most television manufacturers are required to offer an opt-out or off button so that viewers can switch off this setting. Log4j noted that several parts of the Tizen code that check whether the user has disabled ACR are either broken or missing. He didn’t confirm whether this was a deliberate design choice or sloppy coding. If this finding holds up, it would mean that the privacy setting most people rely on doesn’t work at all.
This aligns with Northeastern University’s findings from a few days earlier, when researchers observed that a Samsung TV continued to send telemetry-like data even after the switch was turned off. However, the traffic was encrypted, so they couldn’t confirm exactly what data was being sent.
Log4j also found a neural network, an AI model tuned to a specific region, that could recognize what’s on screen even inside apps like YouTube, including the videos you watch, the ads you skip, and how far into videos you get.
It works by scanning on-screen elements, and Samsung might even send new modules later to cover more apps. This is concerning because YouTube doesn’t share this data with Samsung, so the TV would be figuring it out by watching the screen itself.
The researcher also found a service called “rmdemon,” which would start a packet logger on your home network, meaning it can record your entire network traffic. Everything on your network travels in small chunks of data called packets, and a packet logger records them for later analysis.
Log4j believes that “rm” stands for remote management because the same service can also open a remote live-viewing stream of the TV, letting someone see your screen in real time. The most likely legitimate use for both is troubleshooting.
However, there are still concerns, such as who can switch it on. Is it only you or a support agent with your permission? Or can Samsung’s servers start it silently in the background? And then there’s the question of where the logs go and whether such packet logging is tied to any consent.
Additionally, about 20 minutes after the TV starts, and then every hour, a service sends ARP probes to collect the MAC and IP addresses of other devices on your network. MAC addresses don’t just identify the devices you have but also their manufacturers. They can reveal whether you have an Apple phone, a Sony PlayStation, an Amazon Echo, or an HP printer.
This could allegedly help with presence detection. For instance, if your phone appears on the network, it means you’re home. If it disappears, you’ve left. Samsung SmartThings uses this information for automation, such as turning on the lights when you get home. So, a likely legitimate use might be SmartThings device discovery for home automation.
However, log4j found that the decompiled Wi-Fi presence code doesn’t contain anything that checks whether the user has opted out. It’s still unclear whether this data stays on the TV for smart home features or is sent to Samsung. Such repeated hourly scans could reveal how many people live in your household, when you have guests with new, unfamiliar devices, and details about your lifestyle and spending habits.
For example, the presence of gaming consoles, baby monitors that suggest you’re a new parent, or premium smart home gear that suggests you’re in a higher income category could reveal a lot about your household.
Log4j says he’s still working on a detailed report that will give us a comprehensive idea of what Samsung TVs are doing in the background. Here are a few steps you can take in the meantime to limit data sharing.
Log4j also suggests that while the toggle settings may not fully work, they likely reduce some data collection and cost nothing to try. On Samsung TVs, look for privacy settings for “Viewing Information Services,” “Internet-based Advertising,” and “Voice Recognition.” Menu names and locations may vary by model and year.
Samsung TVs might not only listen to your conversations through a microphone but also access audio through soundbars and Bluetooth devices. The ACR off button might not work completely either, potentially allowing telemetry data to continue being sent to Samsung even when you opt out.
Since most of these behaviors are defined by the Tizen code, there’s not much you can do to stop this data collection directly. For now, you can take the TV offline by disconnecting it from Wi-Fi and Ethernet and use a streaming stick or box of your choice for the apps you watch.
VPN that earned the only Platinum rating in a five-way independent speed and security test by Artifact Security
Historically unlocks Netflix libraries in the US, Canada, UK, and Australia with no errors
Bundles with ad blocker, data removal, and encrypted storage for a more complete privacy setup
/images/2023/05/18/deleteme_review-1.jpg)
/images/2023/10/12/best_identity_theft_protection_with_dark_web_monitoring.jpg)
/images/2026/10/26/google-gmail-photos-personalized-ads.jpeg)
/images/2026/10/26/samsung-tv-privacy-tracking-risks.jpeg){kind=tracking}
/images/2026/10/23/smart-tv-tracking-privacy-opt-out.jpeg){kind=tracking}
/images/2026/10/23/hackers_changed_users_passwords_in_11.7m-account_capcom_breach.png)
/images/2026/10/22/closeup_of_the_signal_messaging_app_icon_on_a_smartphone_screen_displa_ESczEq4.jpg){kind=icon}
/images/2026/10/22/beware_these_phishing_tricks_after_historic_internet_meltdown.png)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2022/05/26/logo-nordvpn.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)