LG Published the Number That Proves the Surveillance. 363 Million Devices. They Own 216 Million of the TVs.

The Number LG Published Is a Confession

LG Electronics says it has sold approximately 216 million smart TVs globally. Its advertising division, LG Ad Solutions, claims it can reach 363 million “secondary addressable devices” in the United States alone. That gap — 147 million devices LG does not own but says it can reach through addressable advertising — is not a rounding error or aggressive extrapolation. It is a precise description of a surveillance architecture. The TV maps your home network, identifies the phones, tablets, and laptops sharing your Wi-Fi, and feeds that inventory to an advertising platform that sells targeting against those devices. LG published this number as a selling point. It should be read as an admission.

I have spent several years thinking about the economics of consumer hardware and how surveillance capitalism migrates from the browser into physical objects. The LG story, surfaced this week by Gamers Nexus in a 135-minute investigation conducted with Level1Techs and independent security researchers, is not a revelation about a secret program. It is a revelation about how far the normalization has traveled. Every technical finding in the video — local network scanning, Automated Content Recognition, microphone capture during standby, offline buffering of audio until internet connectivity is restored — was either described in LG’s terms of service, operated through a business unit LG publicly promotes, or both. The scandal is that it was hidden in plain sight and nobody cared enough to read the Wireshark captures until now.

What the Investigation Found

Gamers Nexus tested retail LG OLED models including the G5. Using Wireshark packet captures, the researchers documented the TV actively scanning the local area network for devices that have nothing to do with television: phones, smartwatches, secondary computers. Beyond the device inventory, the TV collected the names and signal strengths of nearby Wi-Fi networks, including networks the TV was not connected to. That geolocation signal — signal strength triangulation from neighboring SSIDs — is standard practice in mobile advertising because it provides location context without requiring GPS. LG’s TV is doing what every Android phone does; it just happens to live in your living room and run continuously.

ACR is less new but worth understanding precisely. Automated Content Recognition works by sampling the pixels on-screen at intervals, generating a digital fingerprint, and matching that fingerprint against a database of known video content. It operates regardless of input source: cable, streaming app, HDMI from a gaming console, or a Blu-ray player. ACR does not care that you did not use LG’s streaming service. It sees everything that passes through the panel and logs what you watched, when, and for how long. This data pipeline feeds directly into LG Ad Solutions. The 363 million addressable devices number is built on top of ACR plus local network scanning plus the profile LG accumulates about the TV’s registered owner.

The microphone finding is the one generating the most outrage, and it deserves some precision. The researchers found the TV capturing microphone audio with the screen appearing to be in standby mode. The captured audio was transcribed and stored locally. When the researchers disconnected the TV from Ethernet during testing, the set continued accumulating voice data locally and uploaded the stored files once network access was restored. This offline buffering is the detail that matters most technically: it means blocking network access temporarily is not a reliable mitigation, because the device maintains its own queue and flushes it when connectivity returns.

Some commenters in the Hacker News thread correctly noted that portions of the Gamers Nexus video involve a rooted TV, and that researchers manually initiated some recordings to demonstrate capability. That is a legitimate methodological point worth keeping in mind. What is not disputed: the network scanning happens on unmodified hardware out of the box. The ACR pipeline is confirmed and documented. The voice transcription infrastructure exists in webOS. The researchers also documented remote code execution vulnerabilities in webOS currently in responsible disclosure. The combination of a confirmed data collection architecture plus RCE-class vulnerabilities in the same OS is the actual threat model, and it does not require attributing maximum malice to LG’s engineering choices.

The Business Structure Explains the Technical Choices

LG Ad Solutions is not a small internal team. It is a standalone advertising technology company built on the back of LG’s TV install base, and it operates like every other connected television advertising platform: CTV (connected television) ad spend in the US alone exceeded $30 billion in 2025 and is projected to cross $40 billion in 2026 by most industry forecasts. LG competes directly with Samsung’s Ads Platform, Vizio’s Inscape (now owned by Walmart), Roku’s OneView, and Amazon’s Fire TV advertising stack. All of them run ACR. All of them sell targeting. The difference in what LG was caught doing this week is one of degree, not kind.

The economic logic is straightforward and worth tracing to its conclusion. LG sells a G5 OLED at a margin that, absent advertising revenue, would be thinner. LG Ad Solutions takes some portion of the advertising revenue generated by that TV over its useful life — call it seven to ten years — and that revenue stream subsidizes the hardware price. Vizio made this explicit before Walmart acquired it: Vizio’s SmartCast advertising business generated more gross margin than the hardware business. The TV is the distribution mechanism for a data-collection-and-advertising product. This is not a cynical observation; it is the stated financial structure of the industry.

From that structure follow the technical decisions. Why does the TV map secondary devices on the local network? Because your phone’s app usage, browsing history, and location data are worth more when correlated with your television viewing. A TV viewer who watches Formula 1 and whose phone shows regular visits to automotive dealership websites is a highly targeted advertising segment. The network scan is the correlation key. Why does the TV maintain offline audio buffering? Because losing data during a network outage represents lost inventory. The system is designed for data durability, not for user control.

Why “Just Disconnect It” Is an Incomplete Recommendation

Gamers Nexus ended their investigation with a recommendation to disconnect LG TVs from the internet and use external streaming devices. That is the correct immediate mitigation for the surveillance advertising problem. It is incomplete as a security posture for three reasons.

First, the offline buffering finding means temporary disconnection does not clear the queue. If a user disconnects after weeks of usage, uploads the accumulated buffer, and then disconnects again, they have already transferred whatever the TV stored. Permanent, never-connected-to-begin-with isolation is the only reliable state. Any TV that has ever been connected and then disconnected has already sent data.

Second, the webOS RCE vulnerabilities currently in responsible disclosure change the threat surface. A TV operating in VLAN isolation with no internet access is protected from remote exploitation over the internet. A TV on a flat home network that has LAN access to other devices is a potential pivot point once a vulnerability is disclosed and weaponized. The typical home network gives smart TV devices full local network access. The television can see your NAS, your work laptop on the same Wi-Fi, your home automation hub. If an attacker can reach the TV — via its internet connection, or via physical access, or eventually via adjacent-network techniques — they have a foothold into your network from a device that most users would never think to monitor.

Third, and this is the point that the HN thread circles around without quite landing on: the class of attack that uses neighboring devices to exfiltrate data when the primary internet connection is blocked is not science fiction. Amazon Sidewalk creates a mesh network from Alexa devices. ATSC 3.0, the next-generation broadcast standard now being deployed across US television markets, includes a return channel. Thread, the mesh networking protocol developed by Google, Apple, Amazon, and others, was designed exactly for low-power always-on connectivity in home devices. A television manufacturer motivated to collect data from disconnected TVs has several plausible mechanisms that do not require the user’s Wi-Fi password. None of these have been demonstrated in production LG firmware. But the economic motivation is strong, and the infrastructure is being built by other parties for other reasons.

The Consent Architecture Is the Structural Problem

I want to be precise about where I think the actual failure is, because a lot of commentary in this space collapses into “surveillance capitalism bad” without identifying the specific mechanism that enables it.

The problem is not that LG collects data. The problem is the consent architecture: a bundle of permissions presented during a setup flow that no reasonable person reads, with no meaningful distinction between permissions that are necessary for the product to function and permissions that extract value for LG’s advertising business. “Accept these terms to proceed” is not consent to each individual data collection practice. It is a coercive choice between using the product you paid for and refusing a contract whose implications you cannot evaluate in the thirty seconds allocated to the setup wizard.

GDPR in theory prohibits bundled consent for advertising purposes. The operative word is “in theory.” LG sells products in the European Union. The GDPR enforcement tracker at enforcementtracker.com shows over 3,000 cases since GDPR took effect in 2018. LG does not appear prominently in that database as of the time I am writing this. The Cyber Resilience Act, which includes security requirements for connected devices sold in the EU, will begin applying to manufacturers starting in 2027. The California Consumer Privacy Act gives residents opt-out rights for data sales. Illinois’ Biometric Information Privacy Act may apply to voice pattern collection. These legal frameworks exist and provide leverage. They are also slow, under-resourced, and facing well-funded opposition from the companies they are designed to regulate.

The most honest framing I can offer is this: the consent architecture is not broken by accident. It was designed to extract maximum data collection while maintaining legal deniability. The terms of service describe the behaviors; the interface makes them impossible to evaluate. This is a deliberate engineering choice made by legal and product teams whose incentives point in the same direction.

What the RCE Disclosure Will Look Like

The webOS remote code execution vulnerabilities mentioned in the Gamers Nexus investigation are currently in responsible disclosure. I do not have details on the specific vulnerabilities, their scope, or the timeline. Based on the pattern of every previous smart TV vulnerability disclosure, here is what will happen:

LG will release a firmware update. The update will be pushed automatically to TVs with internet access. TVs that have been disconnected from the internet as a privacy mitigation — which Gamers Nexus just recommended — will not receive the patch. Users who follow the correct privacy advice will be running unpatched firmware indefinitely. This is the practical consequence of a device that is simultaneously a surveillance tool and a security-critical system: the mitigations for one problem worsen the other.

The Vizio precedent is relevant here. In 2017, the FTC and New Jersey Attorney General reached a settlement with Vizio over ACR data collection that predated user consent frameworks. Vizio paid $2.2 million and agreed to obtain consent and implement a privacy program. Vizio’s ACR business continued. Its successor, Inscape, was acquired by Walmart in 2021 for $250 million. The fine was the cost of doing business; the data collection was the business.

The Practical Recommendations That Actually Hold

For engineers and technically sophisticated users who already own LG TVs and want a defensible posture:

The minimum viable mitigation is network isolation: put the TV on a separate VLAN or Wi-Fi segment with no internet access and no routing to the rest of your LAN. This prevents the ACR data, the device scan results, and the audio uploads from reaching LG’s servers. It does not retroactively delete data already uploaded. It does not address the offline buffering for anything stored before you isolated the device. It does not protect against a future vulnerability that might exfiltrate data through a mesh protocol or broadcast return channel. But it is the best available option for an already-purchased device.

If you are buying a new television: the external streaming device model (Apple TV 4K, or a Raspberry Pi running Kodi on a trusted network segment) attached to a TV that is permanently disconnected is the closest to a clean state you can achieve with current market options. The OpenLGTV project (openlgtv.github.io) provides firmware research and tooling for users who want to root their TV and remove the surveillance infrastructure, at the cost of warranty and at the risk of instability.

For anyone buying a TV in 2026: there are no large-format OLED panels sold without “smart” functionality. The panel manufacturers and the advertising platforms are vertically integrated enough that the choice is between LG’s surveillance and Samsung’s, with Sony, TCL, and others operating similar or adjacent models. The projector category remains relatively clean, though its economics are changing as manufacturers add smart software to higher-margin units.

For enterprises and high-security environments: conference room TVs and displays should be treated as untrusted IoT devices by default. Permanent network isolation, physical camera and microphone disabling, and procurement policies that explicitly exclude smart TV functionality where possible are reasonable starting points. The webOS RCE disclosure, when it lands, will likely include proof-of-concept code within weeks of publication. A conference room television with LAN access to internal systems is a meaningful attack surface.

The Right Comparison Is Not George Orwell

Every HN thread about smart TV surveillance eventually produces an Orwell reference. I understand the instinct, but I think it misdirects attention. 1984 is a story about a government using surveillance as a mechanism of political control. The LG story is something different: a consumer electronics company building surveillance infrastructure as an advertising revenue model, with that infrastructure then available as an attractive target for nation-state intelligence services, criminal actors, and whoever acquires the company’s data assets in a future transaction.

The better comparison is lead paint. Lead paint was not added to household products out of malice. It was added because it made paint more durable, dried faster, and was cheap. The externalities — developmental neurotoxicity in children — were not the point. They were the side effect of a business decision made by people who were not thinking about the side effects. The surveillance architecture in smart TVs is the lead paint of consumer electronics: a set of technical decisions made to serve an advertising business model, with the security and privacy externalities distributed across 216 million households.

We banned lead paint. It took decades, the accumulation of overwhelming scientific evidence, regulatory action in multiple jurisdictions, and sustained advocacy. The economic interests opposing the ban were well-funded and argued for years that the evidence was uncertain, that alternatives were more expensive, that liability should fall on users rather than manufacturers. The pattern will be familiar.

What I Expect to Happen

These predictions are falsifiable. I am making them as of September 2026 and will be wrong about some of them.

The webOS RCE vulnerability disclosure will occur within ninety days and will show a pre-authentication or low-authentication attack path against the LAN-facing service that handles remote control or device-pairing protocols. LG will ship a patch within thirty days of public disclosure. Security researchers will demonstrate exploitation within two weeks of the patch being released. The patch will reach fewer than forty percent of affected devices within twelve months, because the devices have no forced update mechanism for disconnected or infrequently used TVs.

At least one European data protection authority will open a formal investigation into LG’s consent practices for the network scanning and offline audio buffering behaviors within six months. The investigation will not conclude within two years. No fine will be issued within three years.

LG Ad Solutions will update its public-facing documentation within ninety days to use language describing “cross-device addressability” and “network proximity signals” that is technically accurate but designed to be unreadable by consumers. The underlying data collection will not change.

Samsung, Vizio/Walmart, and Roku will receive similar investigative attention within eighteen months. The findings will be structurally similar. The industry response will be coordinated through trade associations arguing for self-regulation and voluntary data minimization commitments.

The CTV advertising market will continue growing. The data collection will continue. The 363 million number will increase.

The one outcome I am genuinely uncertain about: whether the webOS RCE vulnerability, once public, will be used in a high-profile breach that involves a recognizable corporate target or public figure. That event, if it occurs, would change the political calculus faster than any regulatory investigation. Smart TV security has been a documented problem for over a decade; the 2023 LG webOS vulnerabilities (CVE-2023-6317 through CVE-2023-6320) were exploited in the wild before patches reached most devices. The breach scenario is not hypothetical. It is a matter of timing.

A Note on the Gamers Nexus Methodology

Several commenters in the Hacker News thread raised legitimate methodological questions about the investigation video, and I think they deserve direct engagement rather than dismissal. The criticism is essentially this: portions of the Gamers Nexus video that show voice transcription and audio logging were conducted on a TV the researchers had rooted, using tools they installed. This means those specific demonstrations show what a compromised LG TV can do, not necessarily what LG ships by default.

This is a fair technical distinction. It matters for the precise claim “LG TVs transcribe everything you say and upload it without your knowledge.” That specific claim, in its strongest form, appears to require firmware modification to demonstrate on current shipping hardware.

What does not require firmware modification and is not disputed: the LAN scanning, the SSID enumeration, the ACR pipeline, and the existence of a microphone-accessible subsystem that runs while the display is in standby mode. The microphone is there. The voice processing infrastructure is there. Whether it is activated by default without user consent for voice features is a question the responsible disclosure process will clarify.

I am applying the same standard I would apply to any security research: the documented, unmodified-hardware findings are the ones I am treating as confirmed. The rooted-TV findings establish what is possible and what the attack surface looks like. Both categories are concerning. The first category establishes that LG is running a surveillance advertising business through your television. The second establishes that if LG wanted to do more, or if a third party exploited the device, the infrastructure to do more exists and is accessible.

The distinction matters for legal liability, not for the practical question of whether you should trust an LG TV on your home network. On the practical question, the answer is no.

The Broader Pattern: ACR Is Industry Standard

I want to be precise about one more thing before concluding, because the framing of this story as specifically an LG story is slightly misleading. LG is being discussed because Gamers Nexus published a detailed investigation this week. The ACR data collection, the local network behavior, and the advertising technology infrastructure are not unique to LG.

Samsung’s ACR system, originally marketed as “Automatic Content Recognition” and later rebranded under various privacy-softened names, operates on the same technical principles. Samsung’s advertising platform competes directly with LG Ad Solutions. Vizio built an entire standalone company, Inscape, around ACR data before Walmart acquired it. Roku’s advertising business is built on ACR and viewing data from devices that run on many manufacturers’ televisions. Amazon’s Fire TV stack runs on television panels from multiple OEMs and collects the same categories of data.

The 2024 research paper at arxiv.org/pdf/2409.06203 documented ACR behavior in both LG and Samsung televisions through systematic network traffic analysis. The findings were consistent with what Gamers Nexus documented this week: both manufacturers collect content fingerprinting data and transmit it to advertising infrastructure. Neither manufacturer makes this operationally easy for users to audit or disable.

I am not raising this to dilute accountability for LG. I am raising it because the correct policy response targets the practice across the industry, not the manufacturer that got the most detailed public scrutiny this week. A regulatory requirement for meaningful, granular consent before ACR activation, with clear description of what data is collected and where it goes, applied uniformly across all manufacturers selling in a given jurisdiction, would change the economics. A fine levied against LG while Samsung’s identical practice continues unchanged would not.

The market is not self-correcting here. LG’s panel quality is genuinely excellent. The G5 OLED produces exceptional images. Consumers buy it because it is a good television by every measure they can evaluate at the point of purchase. The surveillance architecture is not visible, not explained, and not priced into the comparison. A consumer who knew that LG Ad Solutions was collecting a device inventory of their home network and selling targeted advertising against their family members’ phones might make a different purchasing decision. That consumer does not exist in meaningful numbers, because the information is not available in a form that supports the decision.

This is the market failure. It is not ignorance on the part of consumers that they do not read forty-page terms of service in a television setup wizard. It is an information architecture deliberately designed to prevent informed decision-making. Fixing it requires transparency requirements and consent mechanisms that are legible, specific, and separate — not a single “Accept” button that covers everything from firmware updates to cross-device advertising.

The 363 million addressable devices number will keep growing until someone makes it stop. So far, nobody in a position to make it stop has found sufficient motivation to do so. That is the status quo I expect to persist for the foreseeable future, with the occasional investigation, the occasional enforcement action that does not change the underlying economics, and 216 million televisions continuing to map the homes they live in.

The Infrastructure Accountability Gap

There is one structural observation worth making that rarely appears in discussions of smart TV surveillance, and it concerns what happens to the data after LG collects it. LG Ad Solutions operates as a data broker and advertising platform. Its data assets include viewing history, device inventory, location signals derived from SSID enumeration, and demographic inferences built from viewing patterns. This data does not sit in a single system. It flows to demand-side platforms, data management platforms, identity resolution services, and clean room environments where it is joined with data from other sources.

Once a data asset enters that ecosystem, provenance becomes difficult to trace. A device identifier derived from your television’s network scan of your household might appear in a programmatic advertising system operated by a company with no direct relationship to LG. That company’s terms of service may not mention LG. Your ability to exercise data rights — deletion, access, portability — against LG does not automatically propagate to every downstream data partner. The GDPR’s right to erasure applies to controllers and processors in the EU, but the definition of who qualifies and how downstream transfer recipients must respond is still being litigated in enforcement actions years after the regulation took effect.

This is the accountability gap in the current regulatory framework: the point of collection (your television) is identifiable and, in theory, regulable. The downstream ecosystem through which that data flows is opaque, fragmented across dozens of companies in multiple jurisdictions, and designed to be difficult to audit. When a data protection authority issues a compliance order to LG, it can require LG to delete the data in LG’s own systems and instruct downstream partners to do the same. Whether those partners actually delete the data, and whether they have already passed it to their own downstream partners, is practically unverifiable.

The 2015 Vizio ACR settlement established that Vizio would “work to delete historical data” and “request that” third parties delete data. The language “work to” and “request that” is not a deletion requirement. It is an aspiration. This is the standard enforcement has consistently accepted for data collected in the consumer electronics context. Until enforcement requires verifiable deletion with third-party auditing and penalties for non-compliance that scale with the size of the data asset rather than the size of the initial fine, the accountability gap will persist regardless of how many investigations Gamers Nexus conducts or how many DPA inquiries LG faces.

I raise this not to argue that investigation and enforcement are pointless. They are not. Sustained public attention, documented findings, and regulatory pressure do change corporate behavior over time — slowly, incompletely, and usually in the direction of adjusting the consent interface rather than the underlying data collection. But understanding what enforcement can realistically achieve helps calibrate expectations. The LG story this week is important and the investigation is valuable. It is also one data point in a pattern that will require structural changes to the advertising ecosystem, not just to LG’s privacy policy, before it resolves in a direction favorable to the people whose homes are being mapped.