BarcelonaWe have already accepted that a smartphone is a machine for capturing our personal data and digital activity. The operating system does it, most of the applications we install do it, and, above all, the ones the manufacturer leaves pre-installed do it. In the best cases, we have learned to mitigate this: we delete applications, adjust privacy settings, or add blocking tools. We have often talked about this in this space. Furthermore, these cleanups have a beneficial side effect: the device runs more lightly.
On the other hand, we may be less aware that other everyday devices have adopted the same pattern; specifically, connected televisions. If a mobile phone is a pocket-sized connected computer, a smart TV is a giant-screen connected computer. It carries an advanced operating system, often a variant of the Android used in mobiles, and applications –either standard or installable– that can also track us. In this case, what is recorded are viewing habits.
What the TV does with what you watch
This tracking technology is called ACR, an acronym for automatic content recognition. It takes samples of what appears on the screen, calculates a fingerprint, and compares it with a database to know if the viewer is watching a program, an advertisement, or a movie. The result is used to measure audiences and sell personalized advertising.
Two studies have verified this with network measurements. The first, from 2024, is from University College London, the University of California at Davis, and the Carlos III University of Madrid. The researchers analyzed a Samsung and an LG television and saw that ACR observes what arrives via the antenna and also what the television emits when it acts as a screen for an external device connected via HDMI. The second, from the end of last month, is from Northeastern University, and it tested twelve televisions from ten brands: all the devices analyzed monitored the antenna, and the majority—including Samsung devices with the Tizen system—also monitored what they received via HDMI.
There is usually a button to deactivate it, but it does not always do what it says. In Samsung devices, the Northeastern study detected traffic compatible with ACR after deactivating the option in 41 out of 60 tests with an antenna and in 18 out of 30 with HDMI. Since the network traffic is encrypted, it is not possible to know what it contains; Samsung claims that the user must explicitly activate ACR, and that when it is deactivated, it does not transmit information about viewing habits. For LG, on the other hand, the deactivation worked completely.
Cleaning with AI
Until now, an individual user could not do much to avoid tracking on their television. This is changing: with the help of AI, accessing the television's software and removing tracking codes, calls to ad servers, and other background functions – a job that required being an engineer – is now within reach of many users.
The first to try it is someone named Mert Cobanov. This AI engineer explained on X that he had activated the developer options on his Android TV and asked Claude Code, Anthropic's programming assistant, to connect to it. Claude deactivated television applications and installed an alternative menu, without the need for administrator permissions.
The process is relatively simple: you need to activate developer options by tapping the version number seven times, and enable network debugging. The AI connects via ADB (the official Android debugging tool), lists the installed packages, and deactivates, without deleting them, those related to ads, sponsored icons, telemetry, and ACR. Users have already started making their lists public in repositories on GitHub (tv-vibehack, cleanyourtv, dumbtv for Fire TV), which serve as context for the AI: what took the first person a full day now takes a quarter of an hour.
In the same operation, you can change the visual interface and replace the stock app menu with a lighter one tailored to your preferences. The first ones were simple menus, but in recent weeks, users have created ones with more elaborate graphic elements.
All interventions can be reversed. It should be noted that the operation carries some risk. If the original menu is deactivated before installing another one, the home button may end up pointing to a factory test application, and many package lists also deactivate the manufacturer's updater, meaning the television will stop receiving security patches.
Android TV and Fire TV, yes; Samsung and LG, no
This AI cleaning works with Android TV/Google TV televisions and some versions of Amazon's Fire TV, because it takes advantage of the open nature of Google's system. However, there is no record of versions for cleaning Samsung or LG TVs, which have their own systems: Tizen and webOS, respectively. There are already those who have obtained administrator permissions on a Samsung television with Tizen 9 system, but the changes made do not survive reboots. In the case of LG devices, the tools only work with firmware versions that are old.
The adapter resource
An alternative is to connect an external adapter to the Samsung or LG television, such as a Chromecast with Google TV or a Fire TV Stick, which cost about 100 or 150 euros depending on the model. These adapters also include tracking codes, but since they run on Android or Fire OS, they can be cleaned with Claude using the same procedure as above.
Mind you, even if we attach an adapter, the TV's ACR continues to analyze the signal coming in via HDMI, and we have already seen that there is no guarantee that the option to disable it stops it completely. What can be prevented is the television providing the data it captures to the company. There are two ways to do this. The most radical one consists of disconnecting the television from the internet (forgetting the Wi-Fi network and removing the cable), canceling its smart part and entrusting the connected functions and applications to the external adapter. In exchange, the television will stop receiving firmware updates. The less drastic one is to configure the home router to block any attempt to access Samsung's advertising and ACR servers; with a web search, it is easy to find a list of the domains that need to be blocked. The television will continue to observe what we do, but it will not be able to tell anyone.
Probably, many readers will find it too complicated and will prefer to continue letting themselves be tracked. But the existence of options to avoid it proves that digital self-defense is possible. I have already bought a 4K Chromecast to liberate it with Claude Code and put it on my Samsung television, a brand that makes better screens every year, but accompanies them with software that I find harder to put up with every day.
1.3 million set-top boxes rented as a botnet
It is not tracking of TV usage, but it is part of the same insecurity. Last Monday, Google announced that it had dismantled XCPE, a botnet (a network of infected devices controlled remotely by a third party) of more than 1.3 million Android devices, mostly set-top boxes that turn a non-smart device into a connected TV.
The Google Threat Intelligence Group attributes the operation to Videostrong, a manufacturer in Shenzhen that sells under brands like MECOOL. The most worrying aspect is that the malicious code was not an application installed by the user, but was included in the factory firmware and would reinstall itself from the system partition if someone deleted it. According to Google, Videostrong cheated to pass the Android TV certification tests: the code activated after the initial boot-up at the buyers' homes. That is why many of the affected devices had obtained Google's seal of approval.
The botnet operators rented remote access to the devices to scammers who used the home connections as residential proxies (so that third-party traffic appears to come from a household) and for ad fraud: generating fake ad views that are not actually seen by anyone but are billed to the advertiser. The code was also capable of disabling Google Play Protect, silently installing applications, and taking screenshots that were sent to the operators, according to Google.
The cybersecurity firm TrendAI, which collaborated on the investigation, counted at least 1,472,554 devices of 206 models in more than 170 countries between June 3 and October 1. The most affected are Malaysia, Brazil, Iraq, Mexico, and Taiwan; there is no data for Spain. Google claims that by blocking the domains from which the malicious functions are controlled, it has also rendered at least 10 million other devices, infected through other means, useless.
Google has taken legal action to take down domains and servers, has banned Videostrong from manufacturing devices that display the Android certification, and has changed the Android TV firmware review. It should be noted that the aforementioned server blocking does not clean the devices, because the backdoor remains latent in their firmware. TrendAI indicates that intervention by the manufacturer, platform protection, or replacing the device would be necessary. In practice, anyone with a MECOOL or white-label set-top box should disconnect it from the network and replace it with one from a trusted brand. At this point, it is almost more practical to buy a new connected TV.
