I Took Every LG TV in My House Off the Network

Every LG TV in my house is a dumb TV now. Two C4 OLEDs and a C5, and the C5 alone was north of $2,000. Their MAC addresses are blocked at my router, their Ethernet is unplugged, and the only thing they are allowed to do is show me the picture coming in over HDMI. I paid for smart TVs. LG made it clear this month that the smart part mostly works for someone else.

If you missed it, Gamers Nexus and Level1Techs published an investigation on September 7 into what LG’s webOS televisions actually send home. They put the TVs on a monitored network, captured the traffic, and dug through what the sets were storing. The model most coverage cites is the 2025 G5 OLED, which is LG’s flagship and not some bargain-bin panel with a sketchy app store. Stephen Burke called the results “an egregious invasion of privacy,” per The Register.

The findings split into two piles, and the split matters for being fair and for being angry at the right thing.

The pile LG gets to deny

The headline grabber was audio. The researchers showed plaintext transcripts built from audio the TV picked up, including while the screen was in standby, and showed the TV could keep capturing with the network cable pulled and then upload once it was plugged back in. That is a nightmare scenario and it is what every headline ran with.

It also required a compromised TV. Malwarebytes’ write-up is explicit that the recording demos came from a set where the researchers had exploited remote-code-execution vulnerabilities they reported to LG, and LG leaned on exactly that point. Its statement to The Register was that “the claims made in the recently published video are not true,” and that voice data is processed only when you hold the mic button on the remote or say “Hi LG” after turning on far-field voice.

I believe LG that a stock TV is not streaming my living room to Seoul. I also do not find that comforting. “Our TV only becomes a hot mic in standby if someone gets code execution on it” is a statement about how bad the outcome is when the security fails, and the same investigation reported RCE bugs. There is a microphone in the box, it has a path to storage and a path to the network, and the firmware is the only thing between those three.

The pile LG called a feature

The part that bothers me more is everything LG did not deny, because it is how the TV behaves when nothing is wrong with it.

Per the investigation and The Register’s summary, the TVs swept the local network and catalogued devices they were never paired with: phones, watches, routers, thermostats, air purifiers, PCs, and server baseboard management controllers (the out-of-band management chips on server motherboards, which have no business being visible to a television). They also recorded the names, signal strengths, and channel numbers of nearby Wi-Fi networks, including networks belonging to the neighbors.

Then there is ACR, automatic content recognition, which is the TV fingerprinting whatever is on screen so it can be matched against a database of shows and ads. LG says its version listens to the audio through the TV’s own audio processor instead of taking screenshots. It runs on live TV and on HDMI inputs, which means your console, your Apple TV, your Blu-ray player, all of it. One test in the follow-up reportedly caught the set sending data to Alphonso, LG’s ad-tech arm, roughly 20 times a minute, bundled with location data.

LG’s September 12 statement explains all of this as three unrelated features. Device discovery is there “to work with other gear on the home network,” so the TV can find your soundbar and your console. Scanning nearby Wi-Fi helps “estimate the TV’s approximate location.” ACR is off until you accept the Viewing Information agreement.

Take those one at a time. HDMI-CEC already lets a TV talk to the boxes plugged into it, over the cable, without enumerating my thermostat. A TV does not need to know where it is to the level of which neighbors are in range; it needs a country and maybe a time zone, both of which I gave it during setup. And as far as I can tell from LG’s own statement, device discovery and Wi-Fi location have no off switch at all. ACR gets a consent screen. The network census just happens.

Consent, as LG defines it

LG’s core defense is that none of the ad-facing features run without the owner agreeing to them. Walk through a fresh webOS setup sometime and look at what that agreement looks like: a stack of legal documents behind a “select all” checkbox on a screen you are clicking through with a remote because you want to watch something. That is consent the way a EULA is reading.

LG also did not arrive at “affirmative express consent” on its own. Texas sued over ACR, and the case ended in May 2026 with an agreed final judgment that requires LG to get affirmative express consent before collecting viewing data and to disclose ACR more clearly. The settlement includes no admission of wrongdoing. A company that thought its consent flow was fine would not have needed a court order to describe it.

The money explains the rest. LG took a controlling stake in Alphonso in early 2021 for about $80 million, and Alphonso became LG Ad Solutions. LG Ad Solutions sells advertisers access to 49 million webOS TVs in the US and 216 million worldwide, and its marketing has talked about 363 million “addressable secondary devices” in the US. Some coverage has connected that last number directly to the device sweeps the researchers found. Nobody has proven that link, and LG says ACR data and ambient audio are handled separately from ad targeting. I would still like LG to explain where 363 million secondary devices come from if not from knowing what else is on people’s networks.

The viewing data also does not stay inside television. In September 2023 LG Ad Solutions announced a product called LoopIQ, built with Affinity Solutions, a company whose pitch is access to spending data from what the announcement describes as more than 140 million debit and credit cards. LoopIQ pairs that spending data with LG’s ACR. The stated purpose is to target ads by what people buy, then measure whether the ads moved their spending afterward. LG’s own global CMO called it a “unique capability to effectively link purchase data with ad targeting and measurement.”

Read that with the TV in mind. ACR knows what played on your screen and when. Affinity knows what a card spent and where. LoopIQ exists to close the gap between those two records, and the industry calls it a closed loop because the ad, the household, and the receipt all land in the same report. The trade press wrote it up as exactly that in 2023, with no hack, no leaked firmware, and no investigation. It was a press release.

Nothing in the setup wizard prepares you for that. The agreement is called Viewing Information, and a reasonable person reads it as LG counting who watched which show so the recommendations improve. Matching your screen against card transactions is a different product with a different buyer, and it is three years old, which tells you how long it has been possible to read this and how few people did. The defenders will say the card data is aggregated and permissioned, and both words do a lot of work. Aggregated data gets thin fast when the matching key is one household with one TV.

This is the business now. The panel is sold at a thin margin and the data is the recurring revenue. LG is not uniquely evil here (Samsung, Vizio, and Roku all run ACR), but LG is the one that just got caught sweeping home networks, answered with a denial of the one claim that required an exploit, and left the network census standing.

What going offline actually looks like

I skipped the settings route. It exists, and if you want to stay connected it is where you start, so here are the paths on current webOS:

• Settings → All settings → General → System → Additional Settings, turn off Live Plus. This is LG’s name for ACR.
• Settings → All settings → Support → Privacy & Terms → User Agreements, uncheck everything optional: Viewing Information, Voice Information, Interest-Based Advertisement, and the marketing agreement. The TV restarts.
• Support → Privacy & Terms → Advertising, turn on Limit Ad Tracking and reset the ad ID.
• Support → Privacy & Terms → Delete My Personal Information, clear the viewing and voice data LG already has.

None of that touches device discovery or the Wi-Fi scanning, which is why I did not bother. A setting only matters if you believe the firmware honors it, and the firmware belongs to the company that just told me its network sweeps are a convenience feature. I blocked all three MAC addresses at the router and unplugged the Ethernet, and now the question of what the menus really do is somebody else’s problem.

Streaming comes from Apple TVs now, one per set. They are excellent. The interface is fast, nothing on the home screen is trying to sell me a free ad-supported channel, and the remote is a remote instead of a billboard with a Netflix button. Moving to them does not make the tracking question disappear. It moves it to a box I picked on purpose, from a company whose entire marketing position is that it does not resell what I watch, and that is a trade I will take.

Nothing broke. The TVs did not sulk, HDMI-CEC still works, the picture is the picture. What it cost was money. I spent four figures per panel, three times, on sets whose whole premise is that the apps are built in, and then I spent again on outboard boxes to do the job the TVs were sold as doing. That is the actual damage here. I paid a premium for a feature, the feature turned out to have a second customer, and buying my way out of it was a separate line item.

There is a real cost on the security side too. An offline TV gets no firmware updates, and firmware updates are how LG would patch those RCE bugs. I have decided that a TV with unpatched bugs and no network path is a better position than a TV with patched bugs that maps my house on a schedule. If you cannot give up the built-in apps, put the TV on its own VLAN or guest network with no route to the rest of your devices, and block LG’s ad and ACR domains at the DNS level with Pi-hole or NextDNS. That limits what it can see, even if it does not stop it from trying.

The next panel I buy will probably be a Samsung or a Sony, and I have not done the homework yet, I am not currently in the market for a TV so I have not spent the time. Samsung runs ACR too. Sony ships Google TV, and Google is not exactly a data minimalist. The homework is not really “which brand respects me,” because the answer to that is probably none of them. It is which one does the least of it, on which model years, and how much of it survives having the network cable pulled. Whatever I land on is going behind an Apple TV anyway.