LG Smart TVs Still Scan Homes Behind Apple TV

Gamers Nexus spent 135 minutes on YouTube showing that an LG OLED still fingerprints HDMI, maps phones, and stores voice after the screen goes dark. The September 6 video, made with Level1Techs and independent security researchers, tested retail sets including an LG G5.

An Apple TV on the HDMI port does not shut that collection down. LG Ad Solutions still sells the household around the glass.

A 135-Minute Tear-Down of an LG G5

Steve Burke of Gamers Nexus and Wendell of Level1Techs bought a G5, plugged Ethernet into it, and watched the traffic in Wireshark. They also worked with researchers credited as MrBruh and uturn. The native behavior, Burke said, was the part that worried them more than a hypothetical hacker.

The investigation video is the record of those bench tests, including a G5 that kept a connected microphone live after the team pulled the network cable.

WHAT THE TESTS PUT ON THE RECORD

• HDMI fingerprints: Automatic Content Recognition sampled audio and video from the screen, including feeds that did not come from LG’s own apps.
• LAN mapping: The set crawled the local network and listed phones, watches and other hardware that had never paired with the TV.
• Neighbor Wi-Fi: Packet captures showed nearby network names, signal strength and channel numbers, plus the set’s own location data.
• Stored voice: Audio kept writing to local storage with the screen dark and the Ethernet unplugged, then left the set once the cable went back in.

Burke put the LAN crawl in plain language: “The TV crawled our entire network and found dozens of unrelated devices, including smartwatches and phones of our staff who didn’t even know we were working on this.” The team blurred the Wireshark dump because, they said, every line had something they would not publish.

On the G5 they used for the demo, a connected microphone kept listening after the network drop. “What I’m saying is being stored by someone with remote access to the TV,” Burke said on camera, with the cable out. They later pulled that file back using webOS bugs that are still in responsible disclosure, so the public write-up stops short of exploit detail.

An Apple TV Leaves the Panel’s Sensors Running

The usual privacy move with a premium OLED is to treat webOS as hostile, skip the TV’s Wi-Fi, and park an Apple TV, Roku or Fire TV on HDMI. That advice has been common for years among people who already distrust smart-TV software. The September tests were built to see whether that bargain actually isolates the room.

ACR does not care which app drew the pixels. It samples whatever hits the glass, turns a slice of audio or video into a fingerprint, and sends that hash to LG’s ad stack so a server can name the title. Switching inputs does not switch it off. A laptop, a games console or a streaming box on HDMI is still a signal the panel can label.

The same independence shows up on the LAN. Discovery of phones and watches is first-party code, not an app the owner opened. Forgetting the TV’s Wi-Fi password helps only if Ethernet is out too, and even then the set can keep writing audio to local storage until someone plugs it back in.

Settings menus do not close that gap on their own. The researchers’ working advice was to pull the set off every network and drive picture through an external box, then treat the LG as a dumb panel. Firewall rules on a home router can do the same job for screens you cannot reach, including sets in another room.

The 363 Million Devices Behind 49 Million TVs

LG Ad Solutions, on its own site, pitches advertisers on 49 million US and 216 million global smart TVs. Burke used those TV counts to explain a larger number in the ad pitch: 363 million “addressable secondary devices” in the United States. Phones, tablets and PCs on the same network are the extra inventory. The LAN crawl is how a television becomes a household graph.

Julian Zilberbrand, global head of data solutions at LG Ad Solutions, said in a 2025 interview, “At LG, we know who’s in the LG household. We know which devices are there.” He added that the company knows what hits the screen and can push that reach onto mobile. Serge Matta, president of LG Ad Solutions, was more direct in a clip Burke played.

We own the glass. We own the TV.

Serge Matta, President, LG Ad Solutions

Matta also said the firm has first-party ACR and understands “everything that hits the screen.” Burke noted that LG Ad Solutions is a private company incorporated as Alphonso Inc., the ACR specialist LG took a controlling stake in during 2021, and that Matta is under an SEC ban from running a public company after settling fraud charges at an earlier firm.

SCALE THE AD PITCH USES

• Global glass: 216 million LG smart TVs on the LG Ad Solutions homepage.
• US glass: 49 million LG smart TVs in the United States on the same page.
• Secondary devices: 363 million US addressable devices in the advertising pitch Burke documented.
• ACR load: about 4 GB of ACR data a month leaving the test television, per the investigation.

In October 2023, Nielsen said a deal with LG Ad Solutions would give it the largest ACR data footprint for measurement in the United States, including household-level data for linear and connected TV. In December 2025 the ad unit said a local-data partnership covered all 210 US markets. The collection Burke filmed is the supply line for that product, not a rogue debug flag.

WHAT STILL RUNS IF YOU ONLY CHANGE THE HDMI BOX

Network discovery can have a boring explanation, such as finding shared folders. Burke did not treat it as innocent, given the secondary-device counts in the ad sales material.

Texas Closed the Viewing-Data Case in May

None of this arrived in a vacuum. Texas Attorney General Ken Paxton sued Samsung, Sony, LG, Hisense and TCL in December 2025 over ACR collection he described as spying in the home. Samsung reached a deal on February 26, 2026. LG followed on May 11.

Under that deal, LG Electronics USA agreed to stop collecting viewing data without consent, to put a pop-up on sets and on the company site, and to give users a clear opt-out. The judgment also bars transfers of viewing data to the Chinese Communist Party. LG did not admit liability. Paxton said, “LG has now taken important steps to ensure that users’ viewing data will not be collected without their informed consent and that consumers maintain their fundamental right to privacy in their own homes.”

THE ACR TRAIL FROM VIZIO TO THIS VIDEO

1. February 6, 2017: Vizio pays $2.2 million to the FTC and New Jersey over ACR on 11 million TVs.
2. 2021: LG takes a controlling stake in Alphonso, later the corporate home of LG Ad Solutions.
3. October 19, 2023: Nielsen announces it will ingest LG ACR data for national measurement.
4. December 2025: Texas sues five TV makers, including LG, over ACR consent.
5. May 11, 2026: LG settles with Texas on viewing-data notices and opt-out.
6. July 17, 2026: Gamers Nexus publishes a separate investigation of LG monitor software and TV microphone terms.
7. September 6, 2026: The 135-minute G5 investigation lands on YouTube.

The May judgment is a viewing-data consent case. It does not, on its face, shut down LAN mapping, neighbor-Wi-Fi collection, or microphone buffering. Pop-ups and opt-outs also do nothing for a guest, a patient, or a colleague who never saw the setup screen. When Texas announced the LG deal, its cases against Sony, Hisense and TCL were still open.

Are LG TVs Always Recording Conversations?

LG has not issued a public reply to the September 6 video. In July, after the monitor investigation, the company said LG TVs “do not collect, record, or store ambient conversations,” and that voice recognition is an optional, user-started feature that processes voice only to fulfill a request.

The new tests do not flatten that claim into round-the-clock wiretapping. They do punch holes in it. After the assistant was invoked, speech-to-text landed in on-device logs as plain text, including test lines about a Social Security number and credit-card information. The microphone then stayed open for 10 to 15 seconds and transcribed talk that was not a command. That hangover is how a bystander who never addressed the TV still ends up in a log.

A close reading of those logs also cuts the other way. The Social Security and card phrases sat next to search-result replies, which means the team had run a voice search, not captured a random chat from a cold start. The always-on piece that does not need a wake word is still ACR and the network map.

WHAT WE KNOW

• Plaintext logs: Voice-assistant audio was converted to text and stored on the set, including speech after the command ended.
• Offline buffer: With Ethernet out, the G5 still wrote audio locally and uploaded it after the cable returned.
• Standby picture: Clean microphone capture continued while the screen looked powered down.

WHAT IS UNCONFIRMED

• Always-on wiretap: There is not public proof that every idle LG transcribes the room 24 hours a day with the assistant off.
• Live exploits: The remote-code bugs are in disclosure; there is no public evidence they are being used in the wild.
• Company reply: LG has not addressed this specific video.

Webcam audio showed up when the panel was used as a computer monitor, and that feed was also transcribed in memory. The investigation’s hospital and boardroom warning follows from that HDMI path. A clinic TV hanging on a guest network still sees the glass, and a compromised set can lift call audio off the same cable.

webOS Remote Code Bugs Stay Under Disclosure

Separate from the ad stack, the researchers reported remote code execution flaws in webOS and have not published the mechanics while LG is in the disclosure window. In the video they used that access to treat the G5 as a listening post: screen dark, cable out, then the file leaving the set after reconnect. Wendell’s on-camera recap with Burke is the reason they told owners to unplug rather than hunt for a toggle.

That is a second job for the same hardware. First-party ACR and device discovery run without a break-in. The bugs decide whether someone other than LG can also wear the microphones. A living-room panel already has a mic path, optional cameras, a view of the LAN, and a power cord that rarely gets pulled. It also gets less scrutiny than a phone.

App-store hygiene is part of the same picture. In June, research firm Spur found that 1,213 of 2,851 tested webOS apps, nearly 43 percent, let developers turn a TV into a residential proxy, routing other people’s traffic through the home connection. LG senior vice president John Taylor said a residential proxy network is not an intended use, and that LG was working with developers to strip the option or suspend the apps. Burke argued that volume of store listings is not something a platform misses by accident.

Vizio’s Fine Did Not Kill Automatic Content Recognition

On February 6, 2017, Vizio paid a $2.2 million FTC and New Jersey settlement over software that captured second-by-second viewing on 11 million smart TVs without informed consent, including HDMI and streaming-box picture, then sold insights for ads. The FTC said Vizio also made it possible to append age, sex, income and other household facts. Vizio had to delete data collected before March 1, 2016, and obtain express consent going forward. A later class action added a $17 million pool for about 16 million owners.

Nine years later the business is larger, branded more openly, and sitting on flagship OLEDs that sell for $2,400 and up. Burke said some TV makers now take more margin from targeted ads than from the hardware. The G5 the team bought at Best Buy is the current proof that a consent pop-up in Texas does not, by itself, make the panel quiet.

After the July monitor investigation, LG’s television terms added a forced-arbitration clause that blocks court and class actions. Combined with tens of thousands of words of TV and account agreements, that is a second lock on the same door Paxton spent a year pushing on.

Unplug Ethernet and Forget the Saved Wi-Fi

If the set must stay in the room, the investigation’s remaining control is physical. Forget the Wi-Fi network, pull the Ethernet cable, and put picture on an external box. A guest or IoT VLAN is a weaker substitute when you still want LG apps, because it only stops the TV from talking to your PCs and phones; it does not stop ACR from seeing HDMI.

HOW TO CUT THE PANEL OFF THE NETWORK

• Physical break: Remove saved Wi-Fi, unplug Ethernet, and leave both off after software updates, which can restore defaults.
• Router block: Sink LG MAC addresses in firewall rules when you cannot reach every screen in a house or office.
• Menus, then recheck: Turn off Viewing Information, Live Plus on older menus, personalized ads, and hands-free voice, then look again after firmware.
• Assume local storage: Audio written while offline can still leave the set the next time it sees a network, so “I unplugged it for a while” is not a wipe.

LG had not answered the September 6 findings by September 8. The webOS bugs remain unnamed in public. Until those two things change, the G5 on the bench is the working picture of the product: a display that still reports the house after you pay for an Apple TV to hide the smart OS.