What happened
Researchers behind the Gamers Nexus YouTube channel say LG smart TVs collect far more data than the company discloses. Inspecting the TVs' network traffic and internal data, editor-in-chief Stephen Burke said the team found plaintext transcripts generated from audio captured by the TV, along with IP addresses, location data and the names, signal strengths and channel numbers of nearby Wi-Fi networks.
The TVs also enumerated devices on the local network that were not paired with them, including smartphones, watches, routers, thermostats, air purifiers, server baseboard management controllers and PCs. Burke said Wireshark analysis revealed so much private data it could not be shown in the video, all of it native behaviour from LG's equipment. He called the findings "an egregious invasion of privacy." The team also claimed the TVs could keep capturing audio while offline, storing it locally and transmitting it once connectivity returned. It said it is working with security researchers on responsible disclosure of vulnerabilities, including an alleged remote code execution flaw.
LG has previously said its TVs do not "collect, record, or store ambient conversations," and that voice recognition is optional, processing voice data only when activated by the user. The Register said it had asked LG for comment. The claims follow a July report from the same channel alleging LG monitors installed adware through an automatic Windows process.
Why this is a GRC story
Smart TVs sit in living rooms, boardrooms and doctors' offices, so what they capture is rarely just household data. The claims expose a gap between the privacy policy and the product's apparent behaviour, and that gap is a governance problem, not just a technical one.
Start with disclosure. LG markets its voice features as "Intelligent Voice Recognition" and "Clear Voice Pro." The Register notes the LG Privacy link sits near the bottom of a long product page, several clicks deep, and neither the page nor the linked documents mention LG Ads Solutions, the company's advertising unit. If the testing is accurate, generating audio transcripts while the display is in standby is not something LG highlights at the point of purchase, and that is where consent is actually formed. Data collection that surprises the user is data collection that was never properly consented to.
Automatic content recognition is industry-wide, and LG is not alone among smart TV makers. In 2022 LG said it would deploy the technology in sets across 27 countries, with insights available through its advertising business and data it describes as anonymized. The GRC questions are the familiar ones: data minimization, purpose limitation, and whether "anonymized" still means anything when the vendor promises device-level ad targeting across an estimated 49 million US TVs and 363 million claimed "addressable secondary devices."
What to watch
Watch for LG's response, whether the alleged remote code execution flaw is confirmed through responsible disclosure, and whether regulators take an interest in how ACR and voice data are disclosed to consumers. For any organisation buying connected devices, the deeper question is vendor due diligence: what data does this thing collect, who receives it, and what does the contract actually say. In connected hardware, the privacy policy is a control, and it deserves the same review as any other security control.
Attribution: Analysis based on The Register's reporting and related public reporting. This article is original commentary, not a repost of the source material.