Does the meeting-room TV know what you show on it? ACR: how it works and how to check in your company

Updated October 27, 2026 · Texas cases partly ongoing · The technical study did not test Brazil

Many smart TVs include a feature that recognizes what is on the screen and tells the manufacturer. A 2024 study showed that, in the US, this includes what arrives over an HDMI cable, such as a laptop screen. In Brazil, we found no public measurement.

In this article: what it is · what happened · and in Brazil? · open questions · executive view · how it works inside · monitor and block at the firewall · configuration and prevention

What ACR is

ACR stands for Automatic Content Recognition. It works like the app that tells you which song is playing, only for video: the TV records snippets of what appears on screen, turns each snippet into a numeric signature (a fingerprint, or hash) and sends it to the manufacturer. On the other side, a server compares the signature with a base of known content and answers what was playing.

The stated purpose is recommending content and measuring audiences. The Texas authorities' allegation is that this data is also sold to advertisers, which the manufacturers dispute.

What happened

What is known and what is not

And in Brazil? Does it exist and nobody measured, or does it not happen?

This is the question the subject leaves open. The three hypotheses below are consistent with what is published today.

Only a measurement answers it, and it is cheap: a few hours of network capture on a test TV. The firewall section shows how.

Open questions this case raises

Technical

• Does a TV used as a monitor send signatures of what the laptop shows (video meetings, slides, spreadsheets)? How much becomes a signature and how much stays on the TV?
• Can a firmware update turn the feature back on or rename the menu? Olhar Digital warns that it can, and recommends checking after each update.
• Is the setting per TV or per manufacturer account? Can 50 TVs be managed at scale?
• Does blocking by DNS or firewall work without breaking the TV? The same doubts apply to projectors, reception panels and digital signage.

Policy and regulatory

• LGPD (Brazil's data protection law, Law 13,709/2018): a screen image may contain personal data of customers and third parties. Who is the controller: the company that owns the TV, the manufacturer, or both? What is the legal basis? We found no statement from the ANPD (the national data protection authority) on the subject, and this is a question for legal counsel, not a conclusion.
• Is there a similar case in Brazil (Senacon, Procon, Public Prosecutor's Office)? We did not verify.
• In sectors with confidentiality duties (law, health, banking, government), is the feature compatible with professional secrecy?
• Does a consumer TV in a corporate room violate internal IT and procurement policy?

Commercial

• Who profits? Texas alleges sale of data to advertisers. What is the revenue model of a cheap TV?
• Does the confidentiality agreement with customers cover equipment that sends data to a third party?
• Does the contract with the TV and audiovisual vendor have a data clause, audit rights and a way to switch the feature off?
• Does cyber insurance ask for a device inventory? Whoever proves control over meeting rooms scores points in tenders that require security.

Others

• Reputation: the headline “Company X's TV collects what the customer shows” does not depend on the collection having been proven.
• Third-party rooms: hotels, coworking spaces and rented rooms have TVs you do not configure.
• Home office: the living-room TV used as a second monitor.
• Neighboring topic: researchers already analyze what TVs send, and AI vendors already change the rules midway (see the Claude and reverse engineering case).

Executive view: risk, decision and 30 days

Risk. The risk does not depend on the collection happening in Brazil. It depends on the company being unable to prove it does not happen. A meeting-room TV is a computer connected to the network, with a feature that belongs to the manufacturer and not to the contract you signed with the customer. The risks are confidentiality, LGPD and reputation, and the one who answers for them is the company that chose the equipment.

Three questions for Monday

• How many TVs and connected screens are in our rooms and who configured them?
• Is the viewing information feature off, and did anyone check after the last update?
• What confidential content has already passed through those screens?

What to decide in the next 30 days

• Inventory of TVs, projectors and panels, with an owner.
• Configuration standard (feature off, interest-based advertising off) and who verifies it.
• A separate network for these devices, with traffic logging.
• A rule for rooms with confidential topics: a corporate monitor without a smart system instead of a consumer TV.
• One traffic measurement on a TV of each model, to replace assumption with evidence.

Commercial application

• Contract: NDAs and security contracts with customers usually talk about systems and people, and rarely about room equipment. Review the clause and, on new purchases, require the manufacturer's data-flow documentation.
• Competition: being able to tell a customer “our rooms have an inventory, the feature off and monitored traffic” is a differentiator in tenders and audits.
• Insurance: prepare the device inventory before the insurer asks for it.
• Brand: press coverage of the Texas case shows the topic becomes a headline even without a conviction.

Operational view

• Owner: one owner for the screen fleet (IT or facilities), with a backup.
• Routine: a configuration checklist when each TV is installed and after each update.
• Procurement: require pre-configuration or a corporate model. Do not accept a retail TV without review.
• People: make clear that confidential meetings do not use a consumer TV or third-party TVs without a verified configuration.
• Continuity: if the TV loses internet because of the block, does the room still work as a display? Test first.

Infrastructure view

• Network: a dedicated VLAN for TVs and room devices, with no access to the internal network. Details in the firewall section.
• Cloud and third parties: the ACR server is the manufacturer's infrastructure, in a third-party cloud. The study located servers in London, Amsterdam, New York and the US, which also raises the question of where the data resides.
• Dependencies: some TV functions (updates, apps) need the internet. Blocking everything may break them.
• Inventory: DHCP and the hardware address (MAC) help find TVs nobody registered.

Security view: prevent, detect, respond

These are good practices and our recommendations, not results of the study.

Technology: how ACR works inside

1. Capture

According to the study, which cites the manufacturers' own documentation, LG captures image frames every 10 milliseconds and Samsung every 500 milliseconds. ACR may use image, audio or both. Capture happens inside the TV, after the signal reaches the set's processor. That is why the source can be an antenna, the TV's own free channels (FAST), HDMI or another. Our inference for why HDMI is captured: the image goes through the TV's system before appearing on screen.

2. Fingerprint and watermark

There are two general recognition methods. With a fingerprint, the device computes a signature from the content itself and needs nothing embedded in the video. With a watermark, the broadcaster inserts invisible tags in the transmission (channel, program, time), which the device only reads. The study treats the signatures as hashes and reminds us that a hash does not make data anonymous by itself.

3. Batch sending

The authors observed LG traffic every 15 seconds and Samsung about once a minute, and infer that frames are grouped and sent in batches. Samsung sent up to about twice as much data, and more often, than LG. These intervals are the authors' inference, not documentation.

4. Comparison on the server

The server compares the signatures with the reference base and returns or records what was identified. What is kept and for how long the study does not show, because the traffic was not decrypted.

5. Protocols: what is known and what is not

• Confirmed: the traffic is encrypted, goes to specific server names (domains) and follows a periodic pattern.
• Not reported in the study: ports, TLS version and payload format. The study did not decrypt the traffic.
• Expected, to confirm in your test (our inference): a DNS query to resolve the name, a TLS connection (usually HTTPS, TCP port 443) and the server name visible in the TLS handshake (SNI). It is through these signals, not the content, that a company can observe ACR.

6. Domains observed in the study

The domains were found by the term “acr” in the name. According to the study, LG's belong to Alphonso, which runs LG Ad Solutions. The list varies by region, so do not assume Brazil's is the same: measure.

7. How much traffic, for each use of the TV

Being logged in or not to the manufacturer's account did not change the traffic. The authors suppose ACR uses the TV's advertising identifier or its IP address, but did not test it.

8. Types of feature and where to turn them on or off

The study turned off ACR together with other privacy options. According to the authors, ACR is turned off specifically through the viewing information service. The other items are advertising and personalization features that usually sit in the same group of menus.

9. Limits of the study

Two brands, two countries, one TV per scenario, one-hour tests and domains found by a heuristic. The authors acknowledge these limitations. There is also an internal inconsistency: the text says there is no ACR on Netflix and YouTube, and the tables show low but non-zero traffic. We use the numbers from the tables.

Monitor and block at the company firewall

It is possible, with limits. The firewall cannot see the content, which is encrypted, but it can see where the TV talks to, how often and how much. That is enough to confirm whether ACR is active and to stop it.

What can be monitored

What it cannot do: read the content. Opening the traffic (interception with your own certificate) normally does not work with devices that validate the server's certificate (our inference; the study proposes this analysis as future work) and raises a legal question. For the company's decision, it is not necessary.

A lab test in about half a day

Copy the study's design: same TV, the scenarios, on and off.

1. Put the TV on an isolated VLAN and mirror its port to a capture computer.
2. Baseline: idle TV for 1 hour.
3. HDMI: a laptop with a presentation for 1 hour, with no streaming apps.
4. Comparison: repeat step 3 with streaming (OTT) and screen casting.
5. Turn off: disable the viewing information feature, restart the TV and repeat idle and HDMI.
6. Read the result: list the names and the rhythm. Look for names containing “acr” and regular contact. The study's criterion: after turning off, contact with those names must stop.

# capture on the mirrored port (eth1), filtering by the TV's IP
sudo tcpdump -i eth1 -w tv.pcap host 10.20.30.15

# names queried (DNS), with relative time
tshark -r tv.pcap -Y "dns.flags.response==0" \
  -T fields -e frame.time_relative -e dns.qry.name

# servers contacted over HTTPS (SNI), with the destination IP
tshark -r tv.pcap -Y "tls.handshake.type==1" \
  -T fields -e frame.time_relative -e ip.dst \
  -e tls.handshake.extensions_server_name

# count names that contain acr
tshark -r tv.pcap -Y "dns.flags.response==0" -T fields \
  -e dns.qry.name | grep -i acr | sort | uniq -c | sort -rn

Record the model, system version and test date. A result is valid for that model in that version.

How to block

Level 1, on the TV: turn the feature off in the menu. This is what the study documented as enough to stop the contact. It can be turned back on by an update.

Level 2, in DNS: a DNS filter on the firewall or internal resolver (RPZ, Pi-hole, AdGuard Home or the firewall's equivalent feature) with the ACR names. To avoid being bypassed, the TV VLAN should reach only your resolver: redirect or block DNS (ports 53 and 853) to any other destination and block public DNS-over-HTTPS providers.

Level 3, at the firewall: an outbound rule by name (FQDN object) and a deny-by-default policy for the VLAN, allowing only what is needed.

# generic example, TV VLAN 10.20.30.0/24 (validate in the lab)
permit  10.20.30.0/24 -> internal-resolver   dns (53)
deny    10.20.30.0/24 -> any                 dns (53), dot (853)  log
deny    10.20.30.0/24 -> fqdn *.alphonso.tv                       log
deny    10.20.30.0/24 -> fqdn acr-*.samsungcloud.tv               log
deny    10.20.30.0/24 -> fqdn *.samsungacr.com                    log
deny    10.20.30.0/24 -> fqdn acr*.samsungcloudsolution.com       log
deny    10.20.30.0/24 -> internal-network (any)                   log
permit  10.20.30.0/24 -> internet  (only what the room needs)
deny    any                                                       log

Level 4, no network: if the TV is only an HDMI display, leaving it without Wi-Fi or a network cable is the strongest block. The cost is losing updates and apps.

Cautions

• Block specific names, not whole domains. The same parent domain may serve other TV functions.
• The name in Brazil may be different. In the study, the UK and the US use different names. Use your test to find the local ones.
• The TV may react: loss of functions, error messages or new attempts through other names. Test before applying to all rooms.
• Blocking does not replace turning off the feature and handling the contract and LGPD side.
• Repeat the test after each firmware update.

Continuous monitoring

• An alert for any new name contacted by the TV VLAN.
• A weekly volume report per TV. A TV whose volume doubles for no reason deserves a look.
• An alert for periodic contact (every 15 s or 60 s) with an external server outside the allowed list.
• A scheduled retest, for example every quarter and after updates.

Configuration and prevention: step by step

Menu names change with brand, model and year. The paths below come from the cited Brazilian guides and the study, and must be checked on your TV.

Samsung (Tizen)

1. Menu or Settings, All Settings, General and Privacy, Terms and Privacy.
2. Turn off Viewing Information Services.
3. Turn off interest-based advertising and the customization service. Turn on “Do not track”, if it exists.
4. In Settings, turn off voice recognition, if you do not use it.

LG (webOS)

1. All Settings, General, System, Additional Settings: turn off Live Plus.
2. Under Ads, turn on Limit Ad Tracking.
3. Under Support, Privacy and Terms: turn on “Do not sell my personal information” and turn off the viewing information and interest-based advertising agreements.
4. Turn off home screen promotions and content recommendations.

Sony, TCL, Hisense and other brands: we found no verified path. Look for “viewing information”, “ACR” or “advertising” under Privacy, and measure the traffic the same way.

Checklist for the company

• Before buying: ask the vendor for data-flow documentation and a corporate or signage model, which usually has fewer retail features. We did not verify whether this holds for every line.
• At installation: do not accept the default terms without reading, turn off the features above and record who configured it and when.
• In confidential rooms: use a monitor without a smart system or leave the TV without a network.
• Day to day: prefer presenting through a corporate meeting system instead of plugging the laptop into a consumer TV.
• After updating: check the menu again.
• In third-party rooms: do not assume. Bring your own equipment or avoid sensitive content.

If you are an everyday user

• Look in your TV settings for “viewing information” or “Live Plus” and turn it off.
• When you turn on a new TV, read the consent screens instead of accepting everything.
• If you use the TV as a work monitor, treat it as a connected computer.
• Also turn off interest-based advertising and recommendations.

Terms used in this article

ACR · HDMI · Hash (fingerprint) · DNS · VLAN · Firewall · Encryption · HTTPS · Third-party platform · Data breach

Sources

Primary

• Anselmi et al., ACM IMC 2024 (Nov 4 to 6, 2024): Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs · arXiv version
• Texas Attorney General, Feb 26, 2026: Samsung agreement
• Texas Attorney General: LG agreement (the page carries no date; the settlement was submitted on May 11, 2026, according to MediaNama)
• FTC, Feb 6, 2017: Vizio to pay $2.2 million

Journalistic and specialist

• UC Davis, Dec 18, 2024: Your smart TV is watching what you watch
• The Record, Feb 27, 2026: Samsung updates ACR privacy practices after Texas action
• The Record: Texas sues 5 smart TV makers over ACR tech
• MediaNama, Jun 2026: What's inside the Texas Attorney General's lawsuits
• Olhar Digital, Feb 27, 2026: guide to stop tracking (in Portuguese)
• Canaltech, Jul 11, 2025: how to turn it off on Samsung and LG (in Portuguese)
• Xataka Brasil, Jan 6, 2026 (in Portuguese)
• Wikipedia: Automatic content recognition (context on fingerprints and watermarks)

Technical discussions (context, not a source of facts)

Communities such as r/pihole, r/privacy and Hacker News often swap lists of ACR names for blocking. Check any list in your lab before applying it.

Reading notes

• Accusations: what Texas describes in the lawsuits are the state's allegations. Samsung says its original policy followed Texas rules and that its TVs “do not spy on customers”.
• Single source: petition details that appear in only one report (device counts and sensitive data profiles) were left out of the conclusions.
• Case status: the status of Sony, Hisense and TCL is that of the latest sources we found (June 2026) and may have changed.