A two-hour technical investigation published on September 7, 2026 put packet captures, firmware decompiles and on-camera sales pitches behind a claim the connected television industry has been arguing about for two years: that the consent architecture on a smart TV does not match what the hardware actually does. LG Electronics says the central claims are false.

In Short

Researchers bought LG televisions, watched the network traffic leaving them and took apart the firmware, then published what they found in a two-hour video. They say the sets keep scanning the home network, keep sending viewing fingerprints to LG's advertising arm, and in some cases keep recording after people think they have stopped. LG says the recording claims are not true and that its content recognition and voice features are opt-in, which leaves buyers of smart TV advertising data with two incompatible accounts of where that data comes from.

What was tested, and when

Gamers Nexus published the investigation, titled 216,000,000 Spy TVs | The LG Smart TV Problem, on September 7, 2026. The video runs two hours, fifteen minutes and fifty-one seconds and had accumulated 5,165,512 views and 18,488 comments at the point of the capture used for this article. It is available at https://www.youtube.com/watch?v=6IFVTcM28KA. The segment dealing specifically with LG Ad Solutions and Alphonso begins at 1:13:53.

The outlet said it spent more than a month and around $70,000 on the work, including over 500 hours of staff time, and that it bought the sets retail. Three independent security researchers worked on the analysis: MrBruh, who decompiled LG firmware, uturn, and Wendell of Level1 Techs, who built the interception rig. Further vulnerabilities were described as still inside a responsible disclosure window and were not detailed.

The models tested included an LG G5, an LG G3, a 43-inch QNED 73B and an LG smart monitor. Method was packet capture through a port mirror running Wireshark, supplemented by a man-in-the-middle certificate installed on the set and by firmware decompilation. An earlier instalment covering LG monitors and bundled software was posted on July 16, 2026.

The traffic volumes

The measured figures are the part of the investigation least dependent on interpretation.

With no agreements accepted at all, and the G3 used purely as a display fed over HDMI from a laptop, the set still reached eight distinct endpoints during an hour-long sample, including endpoints belonging to LG's customer data and smart advertising platforms. It moved roughly 8.9 megabytes in that hour, sent 38 DNS queries to LG domains, and repeatedly probed for nearby devices. Extrapolated, that is an estimated 6.4 gigabytes a month from a television functioning as a monitor for a computer. No automatic content recognition data appeared in that pre-consent sample.

After the agreements were accepted, and still using the G3 only as a monitor, the picture changed. The set connected to 29 endpoints a total of 107 times, of which 44 connections went to the Alphonso automatic content recognition service, carrying about 4 megabytes.

The QNED 73B produced two roughly 50-minute samples. Used as a monitor, it connected to 22 endpoints 157 times, with 54 of those connections going to Alphonso and 5.2 megabytes transferred. Running LG Channels, the free ad-supported channel service built into the set, it connected to 60 endpoints 847 times, 618 of those to Alphonso, sending 4.5 megabytes. Telemetry endpoints were observed firing anywhere between every 75 seconds and every ten minutes depending on activity.

The aggregate estimate for one television was roughly 4 gigabytes of content recognition data per month, described as predominantly text fingerprints rather than images. MrBruh set out the audio chain: the set downsamples to 8 kHz mono, runs a fast Fourier transform across 40 chunks of 100 milliseconds, combines the results into a fingerprint and uploads that. This is standard audio fingerprinting practice, and the same mechanism the measurement industry buys.

A detail with direct consequences for viewing confidentiality: DNS queries made while using LG Channels carried readable channel identifiers, meaning the channel being watched was legible to anyone on the local network, the internet service provider, or anyone with lawful access to that traffic.

How the fingerprinting survives a disconnected television

The finding that travelled furthest is also the one that needs the most careful reading. The investigation supports three separate propositions about a set without an internet connection, and they carry very different evidential weight. The video distinguishes between them, and secondary coverage has not always followed suit.

Why generation does not need a connection

Content recognition is built around small local captures. According to Wendell, the LG implementation samples roughly six seconds of audio or video, converts it into a fingerprint, then enters a dormant period before the next sample. He characterised the six-second limit as the industry's hedge against accidentally capturing continuous conversation, while noting that a great deal can still be derived from it.

Nothing leaves the set as a picture. A full frame is unnecessary when a heavily reduced image can be reduced further to a hash, and packet captures showed the television downloading what appeared to be a fingerprint database, giving the set local instructions for turning audio and video into that hash. That is the architectural point underneath the offline question: fingerprint generation happens on the device, and only matching and delivery happen at LG. A set with no network can perform the first step and hold the result.

It has room to hold it. The hardware carries 16 gigabytes of flash, of which roughly 4 gigabytes were described as available without further effort, and fingerprints are text. The sampling is also not confined to broadcast or streaming: MrBruh found an HDMI connection undergoing content recognition, which is why a television wired to a laptop and used as a display is still inside the system.

What the investigation claims happens offline

The stated position is conditional rather than absolute. If the agreements were accepted during setup, the set is very likely still collecting content recognition data after being disconnected from the internet and used only as a display, and retains the capability to transmit that data whenever it next reaches a network.

Gamers Nexus did not present this as universally verified. It stated that it cannot test every LG television, monitor, display and firmware version, that the behaviour may not always hold, and that its account reflects situations it was able to verify or where third-party sources had verified it. The third party cited is a Center for Digital Democracy study reported by the New York Times, which found that content recognition on the LG and Samsung sets tested continued to run and capture data while the television was offline.

A related point complicates the word offline itself. Internet service providers operating dual SSIDs broadcast open neighbourhood hotspots from customer routers, with Comcast Xfinity and AT&T public hotspots given as examples, and devices sometimes join such networks automatically on discovery. In an apartment building, unplugging an Ethernet cable does not necessarily disconnect the set. This was framed as a category-wide concern for connected televisions rather than an LG-specific one.

Logs that outlive a reboot

A separate mechanism produces persistence of a different kind. Speech recognised by the television was found written as plain text into debug logs held on a RAM disk. Switching the set off did not clear them. Rebooting did not clear them. Pulling the mains cable did, although other log files persisted and were not exhaustively examined. Packet captures contained evidence that log material is transmitted to LG, and a clear-data instruction was described as a request sent to LG servers rather than a local wipe. LG's statement to Tom's Hardware did not address the storage of transcripts in plain text.

Where the exploit line falls

The demonstration in which a television recorded while unplugged from the network, then handed over the recording once reconnected, belongs in a different category again. The investigation was explicit that the network enumeration and content recognition behaviour required no vulnerabilities, and equally explicit that the offline audio capture did: the recording was retrieved through vulnerabilities and remote access on a set the researchers had already rooted. Wendell's estimate of the buffer available to an attacker in that scenario was roughly 4 gigabytes of audio out of the box, extending to weeks of material with a 256 gigabyte USB stick attached.

The distinction matters for how the finding is read. Offline fingerprint collection is presented as designed behaviour with partial verification. Offline microphone recording is presented as a capability under compromise, and the responsible disclosure window means the vulnerabilities enabling it remain undescribed.

Network discovery and the household map

The set scanned the local network continuously. The investigation counted at least 38 devices discovered on the Gamers Nexus network, capturing display names, MAC addresses, internal IP addresses and signal strengths. Among the items enumerated were staff smartphones and smartwatches belonging to people not involved in the project, a 3D printer, an air purifier, network switches and thermostats.

MrBruh gave a mixed reading of the purpose, noting that the scanning is likely partly legitimate auto-discovery and partly tracking, and offering the example that a household seen to own an older iPhone might receive advertisements for a newer one.

That is the commercial logic of a device graph stated plainly, and LG Ad Solutions has stated it in its own sales materials. In footage of a business-to-business appearance included in the investigation, company executives describe knowing who is in the LG household, which devices are present, and how to extend reach into mobile. LG Ad Solutions President Serge Matta and a research and development colleague are quoted saying the company understands what hits the screen because, in Matta's words, "We own the glass."

The reach claim is where an arithmetic problem surfaces. LG advertising materials cited in the video assert roughly 363 million addressable secondary devices in the United States against a stated 216 million smart televisions sold worldwide. Prior figures carried in PPC Land coverage run lower still: the company put its global installed base at 200 million LG Smart TVs when it placed a 33 million household viewership dataset on the Databricks Marketplace in October 2025, and described its United States footprint as 45 million connected devices when it integrated with Viant in July 2025. A secondary device count more than 1.6 times the global television count implies extension well beyond the sets themselves, which is precisely what the second screen product is sold to do.

The voice dispute

The sharpest disagreement concerns microphones. The investigation reported plain text transcripts of speech recovered from log files stored on a RAM disk, including speech that continued after a wake word command had been completed. The capture window was observed staying open for roughly ten to fifteen seconds after speech stopped, and longer if speech continued. Range testing put usable capture at more than 40 feet and, in some configurations, around 60 to 70 feet including around corners.

Researchers also described capturing audio through paths the on-screen microphone toggle does not cover: a USB webcam accessory, a remote control microphone, HDMI audio, and a low-bitrate feedback microphone. Under root access, menu settings governing voice recognition could be changed from a command line without a visible prompt.

LG's terms, as read out in the video, require United States customers to accept that voice information may be processed in other countries including Korea, that it is held for six months before deletion or anonymisation, and that the person accepting has obtained consent from every other member of the household whose voice may be captured.

LG's response

LG Electronics disputed the core allegations in a statement given to Tom's Hardware, published three days before September 12, 2026. The page carries a relative timestamp rather than a fixed date, which places publication on or about September 9.

According to LG, the claims in the video are not true. The company said its televisions process voice data only when the remote control voice button is pressed and held, or when a wake word such as Hi LG is recognised after the user has switched on far-field voice recognition, and that outside those cases the sets do not collect or record ambient conversation. Wake word detection, according to the company, is processed locally and deleted immediately, with nothing transmitted to servers unless the wake word fires.

LG confirmed that its televisions scan for and connect to nearby devices on the same network, describing this as a standard function across smart televisions and smart home products. On content recognition, the company said the feature is opt-in, that it delivers personalised recommendations, services and advertisements, and that without consent to the applicable optional agreement the data is not used for advertising.

The statement also included a topic-by-topic section committing the company to rejecting deceptive design and to separate explicit opt-in for content recognition, voice recognition and interest-based advertising, each disableable in settings.

Two things the statement did not address are worth recording. It did not respond to the reported storage of speech transcripts in plain text in device logs. It also did not address the separate finding on residential proxies. Tom's Hardware noted that it had independently verified neither the investigation's claims nor LG's counterclaims.

The consent question is where the investigation is most specific and where LG's opt-in framing is most directly contested. It is also the one area where the claims can be checked against a primary record rather than against packet captures, because LG publishes its current smart TV agreements alongside an archive of superseded versions at us.lgappstv.com. Reading the archive against the investigation changes the picture in both directions. Several of the investigation's structural claims are confirmed by LG's own drafting. Several others turn out to be narrower than the video implies, and one recent revision moves in the direction the critics asked for.

What follows is based on the published United States smart TV legal library: the Legal Notice, the Terms of Use, the Privacy Policy, and four optional agreements covering content recognition, voice, advertising and marketing, together with seven archived Privacy Policy versions running from January 2024 to May 2026 and four archived Terms of Use versions running from January 2024 to July 2026.

Seven documents, 22,000 words

The live library contains seven documents. The Legal Notice runs to roughly 1,270 words. The Terms of Use, in its July 2026 revision, runs to roughly 10,700. The Privacy Policy, in its May 2026 revision, runs to roughly 6,780. The ACR and Viewing Information Agreement adds about 1,580, the Interest-Based and Cross-Device Advertising Agreement about 1,085, the Voice Information Agreement about 865, and the Marketing Communications Agreement about 40.

The total is close to 22,300 words. At the reading speeds cited in the investigation, 220 to 350 words per minute, that is between 64 and 101 minutes of continuous reading, before any linked document is opened.

That figure is lower than the roughly 50,000 words the investigation reported, and the gap is explained rather than contradictory. The library above covers the smart TV stack only. The investigation counted the LG Account terms and conditions as a separate layer, which it put at nearly 12,400 words, and which are not published on the smart TV legal page. Its 18,500-word figure for the smart TV terms also reflects what was presented on the television during setup, which bundles documents the web archive lists separately. Both counts describe the same problem at different boundaries.

The Marketing Communications Agreement is worth isolating. At roughly 40 words, it is shorter than a product warranty sticker. Its presence in the consent flow adds a screen without adding meaningful disclosure, which is the mechanism the investigation describes when it reports six agreements appearing where two are required.

Two are mandatory. Four are not.

The arithmetic in that claim can be verified from the agreements themselves. Clause 1 of the ACR and Viewing Information Agreement states that consent to the Privacy Policy and Terms of Use is a prerequisite to accepting it. Clause 3 of the Voice Information Agreement says the same thing about voice functionality. Neither the ACR, voice, advertising nor marketing agreement is required for the Privacy Policy and Terms of Use to take effect.

So the library confirms the structure: two documents are load-bearing, four are optional, and all six are agreements. The investigation's account of six being presented with a select-all control highlighted by default is a claim about the on-screen flow rather than about the documents, and the documents cannot verify or refute it. What the documents do establish is that the count is right and that four of the six are severable.

The scope of the two that are mandatory

The mandatory pair is not a thin baseline, and it has widened.

The Privacy Policy defines two categories collected without reference to any optional agreement. Device Information covers identifiers including IP address, MAC address, Device ID, UDID and advertising identifier; device details including model, type, software version, manufacturer, screen resolution and language; connected devices including their type, model number, manufacturer and connection method; and network and location data including country code and postal code. Basic Usage Information covers which features, menus, apps and services are used, activity within apps and functions, the content accessed, and the channels available.

Two additions arrived in the January 2026 revision and are worth naming precisely, because they are the clearest documented expansion in the archive. The first is that Basic Usage Information now covers the URLs requested or visited through the device browser. The second is a new sub-category, activity on connected devices, covering how long an external device was used and what was accessed or interacted with on it. The same revision added the UDID to the identifier list, added smart bulbs, smart switches and smart appliances to the connected-device examples, and added photos provided when using image editing features. It also dropped the earlier policy's reference to collecting a truncated MAC address in some circumstances.

Set against the investigation's network-enumeration finding, this is the relevant point. A television that inventories the devices around it is doing something the Privacy Policy describes, in a document that must be accepted before any optional agreement is reached. The dispute is not whether the behaviour is disclosed. It is whether a document of that length, presented at that moment, produces informed consent to it.

The carve-out that survives refusal

The ACR and Viewing Information Agreement contains a clause that matters more than its placement suggests. It states that regardless of consent to the agreement, requesting content through a streaming service provided by LG, with LG Channels given as the example, causes Viewing Information to be collected. The agreement frames that collection as necessary to enable playback and says it will not be used in any other way absent consent.

The investigation's LG Channels capture sits directly against this clause. During a roughly 50-minute sample, the set connected to 60 endpoints 847 times, of which 618 connections went to the Alphonso content recognition service. A destination is not a purpose, and a connection count cannot establish what payload travelled or how it was used. But a carve-out framed as playback-only, running against traffic concentrated on the advertising subsidiary's recognition endpoint, is the kind of gap a supervisory authority tests rather than accepts.

The pre-consent measurement cuts the other way and should be recorded alongside it. With no agreements accepted, the tested set produced no content recognition payload, which is consistent with the agreement's structure. It did still reach eight endpoints including LG customer data and advertising platform endpoints, which the Privacy Policy's Device Information category would cover if the Privacy Policy had been accepted, and which nothing covers if it had not.

Two controls where a user would expect one

The strongest documentary support for the investigation's dark-pattern argument is not in the interface. It is written into the agreements.

Clause 10 of the ACR and Viewing Information Agreement tells a user who has submitted a Do Not Sell request that the content recognition service is unaffected, and that it "will still be active unless I also turn off the Live Plus toggle" in the settings menu. The sale opt-out and the collection switch are separate controls, and the agreement says so in terms.

Clause 6 of the Interest-Based and Cross-Device Advertising Agreement repeats the pattern in the advertising layer. A user who revokes consent to the sale of personal information, whether through the Do Not Sell toggle, the web form, the telephone line or the Limit Ad Tracking option, may still receive interest-based and cross-device advertising directly from LG unless consent to that agreement is separately withdrawn. The same clause adds that consent is reaffirmed at least every two years, and a further clause describes a Reset AD ID button as a third, distinct control.

Naming compounds it. The switch that disables content recognition is labelled Live Plus. The label contains neither the acronym nor the word advertising, and the agreement has to explain the mapping in prose. That is the same category of complaint Texas brought against Hisense over a system labelled Enhanced Viewing Service, a case that turns on interface language rather than on any unusual capability.

The investigation's cookies-toggle finding maps onto this pattern rather than extending it. A setting labelled cookies, off by default, corresponded on inspection to advertising frequency capping cookies, a narrower function than the label implies in either direction.

What May 2026 improved

One change runs the other way and deserves recording. Until May 2026 the content recognition agreement was titled the Viewing Information Agreement. In the May 2026 revision it became the ACR and Viewing Information Agreement, and the Privacy Policy was updated in the same cycle to carry the new title through nine separate references. The acronym now appears in the title of the document a user is asked to accept.

That is a real improvement on the labelling complaint, made four months before the investigation was published, and it applies to the agreement rather than to the on-device toggle. The Live Plus label was not changed.

June 2025: the rights section moved to the back

The Privacy Policy archive shows one structural revision that no amount of interface testing would surface.

From January 2024 through March 2025 the Privacy Policy carried a section 5 headed Your rights, sitting fifth of fourteen sections. It set out the right to opt out of sales, the right to non-discrimination, and the mechanism for appointing an authorised agent to exercise rights on a person's behalf, and it explained the Do Not Sell toggle at length.

The June 2025 revision replaced that section with one headed Your choices and moved the rights content into a new section 15, headed US State Privacy Notice, at the end of the document. The new section is more comprehensive in one respect, listing sixteen states by name and stating that LG extends the core rights to all United States users voluntarily. It is also last of fifteen sections in a document of nearly 6,800 words.

Two counts track the move. References to Do Not Sell across the Privacy Policy fell from twelve in the March 2025 version to three in the June 2025 version. References to Alphonso fell from three to zero. The advertising subsidiary is no longer named anywhere in the document a user must accept, and now appears only in the two optional agreements a user may decline to open.

Neither change removes a right. Both change where a reader encounters one.

Three opt-out addresses, all current

The June 2025 revision also changed the opt-out contact, from a web form at lg.com/us/caprivacy and the number 833-660-0245 to a portal at privacy.us.lg.com/policies and the number 800-243-0000. The Privacy Policy uses the new pair consistently, four times.

The optional agreements did not follow. The ACR and Viewing Information Agreement, updated May 2026, still directs Do Not Sell requests to lg.com/us/caprivacy. The Interest-Based and Cross-Device Advertising Agreement, updated January 2026, still offers both lg.com/us/caprivacy and 833-660-0245. All three documents are live, and a user following the instruction in the agreement they actually accepted is sent somewhere the Privacy Policy retired more than a year ago.

The July 2026 arbitration rewrite

The investigation reported that LG changed its smart TV terms on July 28, 2026, twelve days after the first Gamers Nexus video, to require binding arbitration. The archive shows a rewrite considerably larger than that description.

The Terms of Use grew from roughly 7,720 words in the January 2026 version to roughly 10,700 in the July 2026 version, an increase of about 2,980 words, or 39 percent, in a single revision. For scale, the document had grown by 900 words in total across the preceding thirty months.

Section 21 was renamed from Dispute Resolution for United States Residents to Arbitration Agreement for United States Residents, and expanded from eight lettered subclauses to thirteen. The substantive changes are these.

The forum changed. The January 2026 version routed disputes to the American Arbitration Association under its Consumer Arbitration Rules. The July 2026 version routes them to National Arbitration and Mediation under its Comprehensive Dispute Resolution Rules, supplemented where applicable by the NAM Mass Filing Supplemental Rules.

The fee undertaking was removed. Under the January 2026 terms LG promised to pay arbitration filing fees to the AAA on receipt of a written demand, with a threshold at claims above $25,000, and to pay filing, administration and arbitrator fees for arbitrations brought under the provision. The July 2026 text instead states that responsibility for NAM fees and costs falls as set out in the applicable NAM fee schedules.

A mandatory precondition was added. Before arbitration can begin, a sixty-day Informal Dispute Resolution process must run, initiated by written notice containing the model number, serial number and MAC address of the television at issue. Either party may require a telephonic conference. That conference must be individualised, and the clause states expressly that multiple people cannot share one conference even where the same law firm or group of firms represents them, unless all parties agree.

The jury trial waiver was separated into its own capitalised subclause. The class waiver was widened, from a clause headed No Class Actions to one headed Waiver of Class and Other Non-Individualized Relief, extending to collective and representative proceedings and limiting declaratory and injunctive relief to the individual claimant. Its operative sentence reads: "ONLY INDIVIDUAL RELIEF IS AVAILABLE."

An entire mass arbitration regime was added. Where twenty-five or more substantially similar demands are filed against LG by or with the assistance of the same law firm, group of firms or organisations within a reasonably proximate period, given as ninety days by example, each side selects five demands to proceed as Bellwether Arbitrations. The remainder are stayed, limitations periods are tolled, no further cases may be filed, and the arbitration body may not assess additional fees on the stayed demands. Each bellwether is to conclude within 120 days. A global mediation follows within ninety days, paid for by LG. Anything unresolved thirty days later is administered in batches of 100 demands, one arbitrator and one award per batch.

Three further additions carry practical weight. All materials exchanged in arbitration must be kept confidential and shared only with a party's lawyers, accountants or business advisers, who must agree to the same restriction. An offer-of-judgment mechanic allows either party to serve written terms at least fourteen days before a hearing, after which a party that rejects the offer and does not obtain a more favourable award may be denied post-offer costs. And a two-year limitation period was added: any dispute must commence within two years of the cause of action accruing or is permanently barred.

The opt-out was narrowed on four axes. The January 2026 version allowed opt-out by email or by telephone on a toll-free line. The July 2026 version permits email only. It must be sent by the individual personally, from an email address belonging to them, and notices from any third party purporting to act on their behalf have no effect. The thirty-day clock, previously running from the date of first consumer purchase, now runs from the date the person first becomes subject to the agreement. And opting out of the current version has no effect on any earlier version a person did not timely opt out of, which remains in force.

A severance clause closes it. If any part of the arbitration agreement other than the mass arbitration subclause is held invalid, that part is severed and the rest survives. If the mass arbitration subclause itself is held invalid, the entire arbitration agreement falls away except the informal dispute resolution requirement, and disputes return to the courts.

The same revision added an Exhibit B setting out AI-Based Service Terms, covering image generation, content recommendations, information retrieval, subtitle translation and picture and sound enhancement. Section 3 of the Terms of Use binds a user to Exhibit B by use rather than by a separate acceptance, and states that it may be amended from time to time. The smart monitor notice the investigation recorded, giving thirty days to an August 26, 2026 effective date and naming the arbitration agreement and AI-based service terms, matches this revision.

The drafting, and what it suggests

The investigation described a level of sloppiness it would not expect from a large company's lawyers, citing legal pages that displayed only the word test. The archive supports the characterisation on different evidence.

The January 2026 arbitration clause, sitting at section 21 of the Terms of Use, refers to the document as "this EULA" throughout and cross-references its own exceptions subclause as Section 12(a). It is an end-user licence agreement clause pasted into a terms-of-use document, carrying its original numbering, and it survived at least two revision cycles in that state before the July 2026 rewrite replaced it.

Unresolved square brackets appear across the live library. The Legal Notice gives the corporate registration number, the contact email and its own last-updated date inside brackets. The July 2026 Terms of Use carries the contact email in brackets four times, plus the registration number and two LG Apps URLs. The May 2026 Privacy Policy brackets its own date. The Interest-Based agreement brackets the link to the list of data purchase partners, in the same clause that tells a user to review that list before consenting. Section 15 of the Privacy Policy carries a stray backtick in its heading.

The registered office appears twice with different postcodes. The Legal Notice gives Seoul 150-721, a format South Korea replaced in 2015. The July 2026 Terms of Use gives Seoul 07336.

None of this is actionable on its own. It matters because of what the same documents ask a reader to do. The Interest-Based agreement asks a user to review a third-party list at a bracketed link before consenting, and states that the list may be updated at any time. The arbitration modification clause directs users to check us.lgappstv.com/main/terms regularly for changes, the same page that returns no readable content to a request without JavaScript. The consent architecture assumes a reader who will follow links, monitor a page for amendments, and distinguish between four separate controls with different names, in a library that its own drafters have not fully proofread.

Proxies, platform vetting and the commercial stakes

The residential proxy finding is the one element already carried in the trade record. Research by the security firm Spur, published by KrebsOnSecurity on July 2, 2026, found 1,213 of 2,851 tested applications in LG's webOS store, close to 43 percent, permitted developers to route third-party internet traffic through the household connection. According to Spur, a one-time consent prompt buried inside a television application is not a substitute for meaningful transparency, ongoing control and platform oversight, a concern the firm sharpened by noting that the person tapping accept may be a minor.

LG Electronics USA said in the week of July 21, 2026 that non-compliant applications would be suspended, with senior vice president John Taylor saying that a residential proxy network is not an intended use for LG smart TVs. Samsung followed with a platform-wide ban on proxy software development kits in August 2026, after Spur found similar components in more than a quarter of Tizen applications.

The financial reason manufacturers build any of this is documented in filings rather than inference. Alphonso, incorporated separately and rebranded as LG Ad Solutions after LG acquired a controlling stake in 2021, generated 273.698 billion Korean won in sales and 32.646 billion won in profit in the first quarter of 2026, roughly $185 million and $22 million. Vizio's last annual report before the Walmart acquisition showed about $1.1 billion from its device group in 2023 against roughly $598 million from Platform Plus, but the device business ran at a gross margin of negative 0.8 percent while the advertising-led segment ran at 61 percent. PPC Land tracked that logic through the Walmart acquisition, which handed the retailer content recognition data from millions of households alongside its transaction record.

Governance at LG Ad Solutions also carries a documented history. The Securities and Exchange Commission charged Matta and Comscore, where he was previously chief executive, over a scheme to overstate revenue by approximately $50 million. He settled in 2019, paying a $700,000 penalty and reimbursing Comscore $2.1 million, and accepted a ten-year bar from serving as an officer or director of a public company. LG Ad Solutions is private.

Relations between parent and subsidiary have been litigious. According to reporting by AdExchanger cited in the investigation, LG orchestrated a boardroom manoeuvre in 2022 after Alphonso outperformed expectations; Alphonso sued and won, and has filed four suits against LG in recent years.

Beyond content recognition

Fingerprinting the screen is the part of the system that has a name. The investigation, and LG's own agreements, describe several further collection and monetisation layers that do not depend on identifying what is playing.

The identifier bundle

According to the investigation, Alphonso collects an LG advertising identifier, a non-resettable device UUID, an Alphonso user identifier, the active input, the active application, the MAC address, signal strength, device attributes, location, system power on and off timestamps, privacy consent flags recording whether the household opted in or out, and the nearby Wi-Fi networks the set can detect. When an advertisement is viewed, hovered over or clicked, LG passes the locale, language and device identifier to the third-party advertiser.

Several of those fields describe the household rather than the programme. Power timestamps describe occupancy patterns. The active input distinguishes a games console from a streaming stick. Neighbouring network names and access point addresses supply geolocation on a set carrying no GPS receiver and no wireless connection of its own, because the map of surrounding networks is itself the coordinate.

From exposure to transaction

The commercial extension runs past the television. LG Ad Solutions partners with Affinity Solutions on a product called Loop IQ, which joins advertisement exposure to card and bank transaction records. Matta described the intent through a retail example on camera: establishing whether a household that saw a Target advertisement, delivered either on a managed or a programmatic basis, subsequently spent money at that merchant on a specific day. The stated direction of the partnership is tying connected television exposure to a merchant and to a completed purchase.

That sits alongside distribution arrangements already in the trade record. LG Ad Solutions placed viewership data on the Databricks Marketplace in October 2025, connected television exposure to site visits and conversions with Taboola in December 2025, and extended shoppable formats across four further regions in August 2026. The company also described cross-device measurement reaching mobile, tablet and desktop households when it opened Australian operations in July 2025.

Scene-level and agentic layers

Executives on camera described the next step as content recognition combined with contextual targeting driven by artificial intelligence, scanning a scene for product placement and matching the following break to it. The worked example given was a bar scene triggering an alcohol brand advertisement rather than a generic packaged goods spot, with the scene data carried as metadata in the bitstream. LG Ad Solutions placed more than twenty artificial intelligence agents into an operations platform called Agentiv on October 30, 2025.

Political targeting appears as a named application. The investigation cites LG material referring to voters that matter, and to the use of secondary household devices in political campaigns.

Outside the television entirely

LG's United States privacy policy reaches beyond the set. It covers the company's website, its appliances, the ThinQ application, LG robots, customer service calls and marketing activity, and states that information collected under the smart TV agreement may be combined with information associated with use of other LG services. Categories listed include demographic information such as gender and birthdays, contact data including addresses and telephone numbers, and user-generated material including profile photos, images, videos and music. Collected data is combined with private and public third-party sources, among them social media platforms, utility and energy companies, data licensers and data providers.

Marketing documents published by LG Ad Solutions and examined in the investigation segment audiences into racial and demographic cohorts, with separate analyses of the media interests of Asian-American, Black American, LGBTQ+ and Hispanic American households.

One consequence noted by the researchers is that a household profile may outlive the television that created it. Opting out and disposing of the set does not necessarily break the link, because network characteristics persist, and a later LG device carrying comparable functionality, with an air purifier and an air conditioner given as examples, can attach to the same profile.

GDPR exposure and the question of who would act

Nothing in the investigation was tested against European law, and the findings were produced on United States hardware running United States firmware. The consent design, the network scanning and the voice handling nevertheless describe processing that LG also performs inside the European Economic Area, which puts the EEA rulebook in play on the same facts.

Where LG sits in Europe

LG Electronics Inc., headquartered in Seoul, names itself as the data controller in its European privacy documentation. The European point of contact is not in Seoul. According to the policy published at lg.com, last updated on September 16, 2025, the EU Data Controller contact and the European Data Protection Officer sit at LG Electronics Deutschland GmbH, Alfred-Herrhausen-Allee 3-5, 65760 Eschborn, reachable at dpo-eu@lge.com and at a German telephone number. Eschborn is in the state of Hesse, on the western edge of Frankfurt.

That entity is not merely a mailbox in LG's own description. The company's United Kingdom consumer policy states that the local LG entity and LG Electronics Deutschland GmbH are joint controllers for profiling purposes. Profiling is the category the whole content recognition business sits inside.

Which regulator would have competence

Article 56 of the GDPR routes cross-border cases to the supervisory authority of the controller's main establishment, the mechanism known as the one-stop shop. Two readings follow from LG's documentation, and they lead to different regulators.

On the first reading, decisions about the purposes and means of profiling are taken at least in part in Eschborn, which would make LG Electronics Deutschland GmbH a main establishment in the Union. Hesse's supervisory authority is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, seated at Gustav-Stresemann-Ring 1 in Wiesbaden, which has supervised private companies based in the state since July 1, 2011. On that reading, Wiesbaden would be the lead authority and every other European regulator would participate as a concerned authority through the cooperation procedure.

On the second reading, the decisions are taken in Seoul and the German entity implements them. A controller outside the Union with no establishment determining purposes and means has no lead authority at all. The Court of Rome set out that position in the case that annulled the Italian regulator's fine against OpenAI, reasoning that before an EEA establishment existed each member state held concurrent supervisory power over processing affecting its own residents. Applied here, that would leave any of the thirty national authorities free to open a file on LG televisions sold in its own market, with no obligation to defer to Wiesbaden.

One limb escapes the argument entirely. Article 5(3) of the ePrivacy Directive governs storing information on terminal equipment or gaining access to information already stored there, and it requires prior consent that is freely given, specific, informed and unambiguous, with a narrow exemption for what is strictly necessary to deliver a service the person explicitly requested. Reading a fingerprint off a screen, writing an advertising identifier to a set, and enumerating the devices on a household network all sit inside that provision. National ePrivacy transpositions are not administered through the one-stop shop, so a regulator that wanted to act on the device-access question would not need to establish lead competence first.

What the findings would have to answer to

Several provisions map onto specific items in the investigation.

The consent standard in Article 4(11) requires a freely given, specific and informed agreement. Six agreements presented where two are required, with a select-all control highlighted by default, is the design pattern regulators have repeatedly treated as defective. Article 7(3) requires that withdrawal be as easy as granting; a final snapshot transmitted at the moment of opting out points the other way. Article 25 requires data protection by design and by default, which is difficult to square with a do-not-sell control disabled before any network connection exists.

Transparency duties under Articles 12 to 14 require information in a concise, intelligible and easily accessible form using clear and plain language. Roughly 50,000 words across four documents, reached through more than 2,700 remote clicks, is the kind of fact pattern that invites a finding rather than a defence. Data minimisation under Article 5(1)(c) meets the enumeration of 38 unrelated household devices. Purpose limitation meets the combination of viewing data with information bought from third-party sources.

The household consent clause is structurally awkward under European law. LG's terms require the person accepting to have obtained consent from all other household members whose information may be collected. The GDPR does not recognise consent given by one adult on behalf of another, which leaves the lawfulness of processing a guest's voice resting on a warranty the controller cannot verify.

International transfer is the one area where LG has a clean answer. Its own policy notes that European law recognises the Republic of Korea as providing adequate protection, and the Commission adequacy decision covering Korea has been in force since December 2021. The transfer of voice data to Korean servers is therefore not the exposure; the lawfulness of capturing it is.

Penalties under Article 83(5) reach 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. Applied to LG Electronics rather than to LG Ad Solutions, that ceiling is measured against a consolidated electronics business, not against the roughly $185 million in quarterly advertising sales recorded by Alphonso.

Whether anyone will actually do it

The precedent is unusually direct, because German regulators have run this exercise before on this product category. Between December 2014 and January 2015 the Bavarian data protection authority led a nationwide technical examination of smart televisions from 13 manufacturers representing around 90 percent of the German market, with the authority locally competent for each manufacturer taking part. The output, published in September 2015, was the Düsseldorfer Kreis guidance document on data protection requirements for smart TV services. It was guidance. No manufacturer was fined, and the consumer association Verbraucherzentrale Nordrhein-Westfalen pursued Samsung through the civil courts rather than waiting for a regulator.

Three structural factors weigh against a rapid opening this time.

The first is that European data protection enforcement is complaint-driven in practice. As of September 12, 2026 no European supervisory authority has publicly opened a file on the investigation, and no complaint has been reported. The cases that move are the ones an organised complainant files and then pushes.

The second is venue. Cross-border advertising enforcement has concentrated in Dublin, Brussels and Hamburg. Eschborn is not a habitual venue for this category, and the Hessian authority's public casework has centred on credit reference agencies and public-sector processing rather than on connected consumer hardware.

The third is the enforcement record itself. PPC Land's review of eight years of GDPR enforcement found roughly 40 percent of the 7.1 billion euros in issued fines annulled or under challenge, with privacy group noyb putting collection at 0.6 percent of Irish totals. The European Data Protection Board's own March 2026 case digest found the legitimate interest balancing test systematically underestimated across 62 one-stop-shop decisions, which is an admission that the analytical work upstream of a fine is uneven.

Set against that, two factors point the other way. Consent design on connected devices is already an active file: Norway's Datatilsynet fined Elkjop 20 million kroner in 2026 over loyalty club consent architecture, and the Texas action against Hisense turns on the same category of interface question on the same category of device. And the ePrivacy limb gives any motivated national authority a route that does not require winning a jurisdictional argument first.

The Digital Omnibus package proposed on November 19, 2025 adds a further variable. The Council position published on June 18, 2026 has not yet met a European Parliament vote, and several of the provisions under negotiation touch consent and device access directly.

Why this matters for the marketing community

The buy-side exposure here is not reputational. It is about whether the permission attached to a dataset is what it is represented to be.

Content recognition data from LG sets is not a niche input. Nielsen secured access to LG's ACR footprint in October 2023for national television measurement, and buyers transact against the resulting datasets in the ordinary course of planning connected TV.

The trade body position already flags the dependency. The Video Advertising Bureau warned in July 2026 that ACR viewership data rests on uneven household opt-in and named Vizio Ads and LG Ad Solutions as examples. If a consent flow presents six agreements where two are required, with select-all highlighted, the opt-in rate a dataset reports and the informed opt-in rate a regulator would recognise are not necessarily the same number.

Enforcement precedent exists. Texas sued Hisense in December 2025 over content recognition consent design affecting an estimated 1.27 million residents, alleging the system was labelled Enhanced Viewing Service during setup. That case turns on interface design rather than on any exotic capability, which is the same ground the LG allegations occupy. A separate proceeding, the Software Freedom Conservancy source-code case against Vizio, could compel disclosure of the Linux-derived software underpinning smart television data collection across manufacturers, webOS included.

There is a measurement problem underneath the compliance problem. If a set transmits to advertising and customer data endpoints before any agreement is accepted, and if an advertising identifier can arrive by firmware update on a set whose owner never accepted terms, then the boundary between an opted-in household and an unmeasured one is less crisp than a dataset description implies. Census-level claims rest on that boundary.

For political buyers the exposure is sharper. Connected television spending for the 2026 United States midterm cycle has been projected at $2.7 billion, and several products route voter data through streaming targeting, a category with its own legal sensitivities in several states.

Nothing in the investigation has been tested in court, and LG has denied the central allegation. What is not in dispute is that the commercial value of an LG television, on the manufacturer's own numbers and on Vizio's, sits increasingly in what the screen observes rather than in the screen itself.

Timeline

Summary

Who: Gamers Nexus, working with security researchers MrBruh, uturn and Wendell of Level1 Techs, examined televisions and a monitor made by LG Electronics. LG Ad Solutions, incorporated as Alphonso Inc. and led by president Serge Matta, sells the resulting viewership data. LG Electronics responded through a statement to Tom's Hardware.

What: A two-hour investigation reporting that LG sets scan household networks, transmit an estimated 4 gigabytes of content recognition data monthly, retain speech transcripts in plain text logs, present more consent agreements than required with select-all highlighted, and carry security vulnerabilities permitting remote code execution. LG says the recording claims are untrue, that voice processing requires a button press or an enabled wake word, and that content recognition is opt-in.

When: The investigation was published on September 7, 2026, following a first instalment on July 16, 2026. LG's denial reached Tom's Hardware on or about September 9, 2026. LG's arbitration terms changed on July 28, 2026, with a further update effective August 26, 2026.

Where: Testing took place at Gamers Nexus facilities and at Level1 Techs, on sets bought retail in the United States, covering LG G5, G3, QNED 73B and smart monitor hardware running webOS. In Europe, LG names LG Electronics Deutschland GmbH in Eschborn, Hesse, as its EU data controller contact and the seat of its European Data Protection Officer, which would place any one-stop-shop case with the Hessian supervisory authority in Wiesbaden.

Why: Content recognition data from smart televisions has become a measurement and targeting input transacted across Nielsen, Databricks, Taboola, Viant and political audience products. If the consent flow behind that data does not match its description, the exposure runs to the buyers and measurement firms relying on it, and to the regulators already litigating identical questions against another manufacturer.