LG’s TV privacy defense leaves its data lifecycle unanswered

LG’s response to allegations about smart-TV surveillance addresses a claim it can answer: its sets do not continuously record or transmit conversations. It does not resolve the broader questions raised by packet captures, firmware analysis, and privacy researchers: what data an LG TV collects through voice, Automatic Content Recognition (ACR), and network-discovery features; where that data goes; how long it persists; and how it is used after an owner declines advertising consent.

On September 12, 2026, LG published an official statement on smart-TV privacy after a 135-minute investigation by Gamers Nexus, Level1Techs, and independent cybersecurity researchers alleged that retail LG OLED TVs collected more than viewing preferences. The investigation said it observed local-network scans that could identify nearby devices and Wi-Fi networks, geographic data, and ACR-related collection. It also presented evidence it said showed ambient speech being transcribed after a voice interaction should have ended.

LG denies listening indiscriminately. The company says speech-to-text processing starts only after a supported wake word or a press of the voice button on the remote, and that wake-word detection is local. If no wake word is detected, LG says audio is not converted to text, stored, or sent to its servers. It also says speech information recorded while a TV is disconnected is not retained for later upload.

Recommended reading

Age checks are becoming social media’s next privacy fight

Sophia Reynolds • Sep 1, 2026 • 6 min read

“LG smart TVs do not continuously record or transmit users' conversations.”

“Not continuously” is not the same as “never outside an intentional voice command,” and it does not address the allegation that a TV may have continued processing ambient speech after a command interaction. The supplied reporting does not establish independent reproduction of that behavior across TV models, firmware versions, regions, or voice-assistant configurations. LG’s rebuttal does not identify the models or software builds to which every part of its statement applies.

LG separates voice commands from ACR

×

LG treats voice handling, ACR, network discovery, and advertising as separate features. That separation is technically reasonable, but it can obscure how much information a connected TV can assemble when those systems coexist.

For voice interactions, LG says the microphone pathway is activated by a wake word after a user enables Far-Field voice recognition, or by holding the voice button. The company says failed wake-word detection stays on-device and is immediately deleted. Its longer statement acknowledges that the process can create voice-recognition results and related technical logs used to support voice features.

For ACR, LG says its implementation uses audio fingerprinting through the TV’s internal audio processor rather than recording from a speaker. The company says ACR does not collect screenshots, screen recordings, video recordings, voice recordings, or other audio recordings. An audio fingerprint is not a conventional media recording, but it can identify what is playing. ACR matches a short audio-derived signature to known content so a platform can recognize programming and associate it with recommendations, services, or advertising.

LG says ACR, voice recognition, and interest-based advertising are optional and off by default. It says ACR requires opt-in consent and that, without acceptance of the relevant optional agreement, ACR data is not used for advertising.

Privacy researchers distinguish between a limit on advertising use and a complete account of processing. A statement that data is not used “for advertising purposes” does not say that no ACR-related data is collected, transmitted, retained, or used for non-advertising functions. It also does not specify the retention period, recipients, or technical controls around those purposes.

ACR can see beyond streaming apps

×

The main technical finding in the privacy criticism is not that ACR exists. ACR is broadly used across connected televisions and streaming devices. The issue is that its content-recognition boundary may be wider than a buyer expects.

Anna Maria Mandalari, an associate professor at University College London and co-author of a 2024 study of ACR behavior on Samsung and LG TVs, said research observed ACR-related communications from an opted-in LG television while it displayed both linear TV and content from HDMI-connected devices. The University College London study summary describes privacy concerns around connected-TV tracking.

“Our research demonstrated that ACR-related communication occurred when an opted-in LG television displayed linear television and content from HDMI-connected devices.”

A TV’s own apps are not necessarily the entire surface area. A set used as a display for a game console, laptop, cable box, or other HDMI source could still provide ACR signals if the feature is enabled. Mandalari said the advertising reporting she tested stopped after users opted out. She also called for clarity about the complete data lifecycle: what is collected, whether it is retained, where it travels, and all purposes for which it may be processed.

Manufacturers often frame ACR as a recommendation feature. A user may understand “personalized content recommendations” as activity inside webOS, rather than an opted-in recognition system that can identify programming delivered over HDMI. The supplied reporting does not establish that every LG model behaves identically, but it explains why an opt-in label may not adequately disclose a scope that includes external sources.

Consent is the product-design problem

×

LG’s position relies heavily on consent. The question is whether that consent is specific, legible, and easy to withdraw. The reporting says LG’s opt-in choices appear among multiple user agreements during initial setup, while a separate guide required five steps to disable data collection settings. Neither fact proves a legal violation, but both bear on whether a buyer can make a meaningful choice while trying to finish television setup.

Lillian Edwards, professor of law, innovation, and society at Newcastle University, said speedy setup flows create predictable consent failures: people want the device working, not a dense privacy-law exercise. She noted that the EU General Data Protection Regulation requires consent to be freely given, specific, informed, unambiguous, and expressed affirmatively.

“People often consent to things they don’t fully understand during a speedy setup — they just want to get the thing done and up and working.”

For US buyers, the regulatory picture in the supplied material is narrower. Cobun Zweifel-Keegan, managing director at the International Association of Privacy Professionals, said LG recently settled with the Texas attorney general and agreed to strengthen opt-in flows. The reporting does not provide the settlement’s terms, date, or whether its requirements apply nationwide. It does place the company’s insistence on opt-in consent against a prior state-level commitment to improve how that consent is obtained.

The UK Information Commissioner’s Office declined to comment on LG’s specific case without investigation, but stated that connected-TV makers should collect only information necessary for their products and services, build privacy protection into products, make protective settings the default, and allow people to withdraw consent as easily as they grant it. Those are policy principles, not a ruling on LG.

Network scans are normal, but purpose and sharing matter

×

LG says scanning for and connecting to nearby devices on the same network enables smart-TV functions and is common in smart TVs and smart-home products. A TV needs some local-network awareness to find compatible speakers, cast targets, phones, or other connected hardware.

But “standard” does not answer the privacy question. The distinction is between discovery data needed locally for a pairing flow and a record transmitted, combined with location or viewing data, and made available to an advertising business. The investigation alleged that local area network information, nearby Wi-Fi names, and device data could be collected for LG Ad Solutions. LG’s public response explains the function of scanning but, in the supplied material, does not describe data-sharing arrangements, retention, or whether network-derived data feeds advertising or user profiling.

Zweifel-Keegan said LG’s sensor and collection explanation is consistent with industry practice, while noting that it bypasses the advertising and profiling allegations that formed a large part of the investigation. Smart-TV tracking is not unusual; LG does not explain precisely what happens after collection.

“The fact that sophisticated users are still startled to learn that their living room hardware maps their local network and fingerprints their media intake shows that there is still work to do.”

There is also a security dimension separate from advertising. The investigation raised the prospect that extensive data collection and connected-device features could enlarge the consequences of software vulnerabilities. LG acknowledged that no connected product is completely immune to vulnerabilities and said ongoing monitoring, testing, and improvement are necessary through a product’s lifecycle. It did not identify a specific vulnerability, so there is no disclosed exploit, affected build list, or patch timetable to assess.

Owners can review optional ACR, voice-recognition, and interest-based-advertising settings; confirm what they accepted during setup; and read the controls for consent withdrawal. The unanswered question is whether those controls explain what happens to data after a person says no, rather than merely whether ads stop appearing.