LG smart TVs reportedly scan home networks and collect audio in standby

LG smart TVs are reportedly doing more than collecting information about what people watch. Testing by Gamers Nexus, Level1Techs and independent security researchers found that retail LG OLED TVs could scan devices connected to the same home network and, in some testing, capture microphone audio while the TV appeared to be turned off.

The findings come from network packet captures and other testing described in a 135-minute Gamers Nexus video. The testing included retail LG OLED models, including the LG G5.

The researchers’ findings raise questions about what information an internet-connected smart TV can collect in the background and how that information is used.

What the LG smart TV testing found

According to the testing, LG TVs were actively scanning the local network for other devices. This included unrelated hardware such as smartphones and smartwatches.

The researchers also found the TVs collecting information about nearby Wi-Fi networks, including network names and signal strengths, along with location data.

Network scanning by itself does not necessarily mean that the TV can access the contents of those devices. The concern raised by the researchers is that the TV is identifying other hardware and gathering information about the network around it.

That information can then become useful for advertising and device tracking.

The data can be used for advertising

The press release says the information collected by LG’s TVs feeds into LG Ad Solutions, the company’s advertising business.

LG says it has roughly 216 million smart TV sales globally. LG Ad Solutions, meanwhile, says it can reach 363 million secondary addressable devices in the US by tracking other hardware on the same network.

The distinction is important. The TV itself is one device, but information about other devices on the same network can potentially give advertisers a broader picture of the household’s connected hardware.

The reported network scanning is separate from another tracking system already used by many smart TVs: Automated Content Recognition, or ACR.

ACR already tracks what appears on the TV

LG TVs also use ACR, which identifies the content being watched by turning samples of audio and video into digital fingerprints.

In practical terms, this allows the TV to determine what content is being displayed or played, including content coming through different inputs.

ACR itself is not a new discovery. Smart TV content recognition has been documented for years, and users can generally find related privacy settings on their TVs.

The newer testing described by Gamers Nexus goes beyond what is being shown on the screen.

Researchers say microphone audio was captured in standby

One of the more serious findings from the testing concerns the TV’s microphone.

During bench testing, the researchers found that the television could capture what they described as clean microphone audio while the screen appeared to be powered down in standby mode.

The researchers also disconnected the TV from Ethernet. According to the report, the television continued storing voice input locally and then uploaded the stored files after network access was restored.

That does not necessarily mean every LG TV is continuously recording everything around it. The claim is that the researchers were able to demonstrate microphone capture under their test conditions while the TV appeared to be off.

That distinction matters because standby is normally understood by users as a low-power state in which the television is not actively being used.

Disconnecting the internet was the researchers’ recommendation

The researchers’ response to these findings was fairly direct: disconnect LG TVs from the internet and use a separate streaming device instead.

This would prevent the television itself from communicating with online services, although it would also remove internet-connected features that depend on that connection.

Using an external streaming device changes where the internet connection sits in the setup, but it does not automatically eliminate all privacy concerns. The specific recommendation from the researchers was aimed at preventing the LG television itself from carrying out the network and data-collection activity they observed.

For people who primarily use a TV as a display for an external streaming box, game console or other device, keeping the television offline may therefore be a practical option.

LG webOS vulnerabilities are also being investigated

The researchers also reported finding remote code execution vulnerabilities in LG’s webOS software.

Remote code execution is a security issue that can potentially allow an attacker to make a device run their own code. The researchers said these vulnerabilities are currently going through responsible disclosure, meaning the details are being shared with the affected company through a security disclosure process before being made public.

The findings around webOS are separate from the network and microphone observations, but they add another security concern for internet-connected LG televisions.

LG had not publicly commented on the findings at the time of the press release.

For now, the most important point for LG TV owners is that these findings come from independent testing and have not been addressed publicly by LG in the material provided here. Anyone concerned about the reported behavior can consider keeping the TV offline and using an external streaming device, while waiting for more information from LG and the researchers.