The first paper looked at Roku and Amazon Fire TV. These platforms let you subscribe to “channels”, which are basically apps. As you can guess, they are loaded with trackers. Doubleclick alone is on 97.5% of Roku channels. tv-watches-you.princeton.edu/tv-tracking-ac…
There are some channels with over 50 trackers. Also, the majority of trackers were able to grab a unique ID such as MAC address. A few channels leaked email addresses to trackers and many leaked video titles—often unencrypted, so your viewing history is exposed on the network.
The most technically challenging part of the paper was building a bot to automatically install thousands of channels, launch each channel, navigate to a video, watch it until encountering an ad, and collect data on everything that happens behind the scenes.
Here’s a doozy: Roku has a “Limit Ad Tracking” option. Turning it on increased the number of tracking servers contacted 🙃 It did prevent Roku’s AD ID from being leaked, but a whole bunch of other unique IDs are available. Even Pi-hole wasn’t that effective at limiting tracking.
They analyzed 81 IoT devices including five smart TVs. Their method was quite different from ours: they did controlled experiments. This is powerful: for example, they can test if devices phone home when someone starts talking or moving. Good news: none of the TVs did. Bad news:
Some of their findings are what you’d intuitively expect: devices made by Chinese companies tend to talk to Chinese servers. Others findings are more surprising: Nearly all TVs they tested contacted Netflix, even though they never configured any TV with a Netflix account (?!?!)
It’s a really neat tool that I’ve tweeted before. Over 4,300 people have installed it and the team has just released their first set of findings using data on 45,000 devices, including nearly a thousand TVs from 19 vendors. arxiv.org/pdf/1909.09848…
(By the way, what I love love love about the three papers released near-simultaneously is that we now have three different ways to interrogate Smart TVs and IoT devices. It bodes well for future efforts to uncover tracking and surveillance in our homes.)
IoT inspector’s findings on TV tracking are consistent with the other 2 papers. In their sample, they find about half the TVs talked to tracking services (the authors tell me they think this is an undercount because many of the TVs were turned on only briefly during the study).
One creepy finding in this study is that some TVs connect to Automatic Content Recognition services. ACR involves sending a “fingerprint” of your screen contents to a server, say once a second, for a Shazam-like algorithm to figure out what you’re watching to serve you ads.
OK, so our TVs are watching us. Is that so bad? Well, TVs are going down the same road that turned the web & smartphone apps into a cesspit of surveillance. I worry that things like TVs ads emitting ultrasonic beacons for analytics will become more common. arstechnica.com/information-te…
It’s unfortunate that TV platforms are turning to targeted ads as the main way to make money. To maximize revenue, they will likely turn to data mining and algorithmic personalization/persuasion to keep people glued to the screen as long as possible.
Unlike web tracking, our ability to control tracking on TVs is also limited, because TVs are closed platforms and there is no analog of browser extensions. And, in a familiar story, the law and regulations are easily worked around. washingtonpost.com/technology/201…
I'm sorry to leave this thread without a satisfying conclusion. It's not obvious what's the most effective way to push back against privacy intrusions in our homes. I think more awareness is a necessary first step, and I see the recent papers as progress. I hope more will follow.
There are steps we can take. Stay away from vendors whose business model is targeted ads. Every device is a potential tracker; do your research before buying. Install tools that give you control, such as Pi-hole, even if imperfect. Install a monitoring tool on your home network.
These individual steps are not enough: we need collective action. Researchers must keep doing our part; we look forward to teaming up with journalists, civil society organizations, and the public, so that we can choose our future, not sleepwalk into it one channel at a time.