Your LG TV Was Listening All Along

For years, anyone who suggested that a smart TV might quietly be watching and listening was politely, and sometimes not so politely, told to take the tinfoil hat off. In September 2026 that argument collapsed under packet captures, firmware dumps and a very patient camera crew.

The investigation is called “216,000,000 Spy TVs: The LG Smart TV Problem”. It runs 135 minutes, it was published on 6 September 2026, and it was produced by Gamers Nexus (editor in chief Steve Burke) together with Level1Techs (Wendell Wilson) and two independent security researchers, MrBruh and uturn. They bought retail LG OLED sets, including the high end G5 and a 65 inch G3, put them behind Wireshark, pulled the webOS firmware apart, and watched what a modern television does when nobody is looking.

What they found is not a bug. It is the product working as designed.

What the television actually does

A television today is a computer with a microphone, a network card, an advertising stack and a seat inside your home network. It is rarely switched off in the sense your parents understood. Pressing the power button puts it into standby, a state that keeps the network alive, keeps background processes running and, according to the researchers, keeps microphone access alive so that the set can answer instantly when you call it.

The headline finding is audio. The team demonstrated that an LG TV could capture ambient sound while sitting in standby, buffer it locally, and then upload it once the internet connection returned. In the on camera demonstration the Ethernet cable is pulled while the set sits idle, the room keeps talking, and the moment the cable goes back in the buffered audio leaves the house. Some of the captured material was stored as plain text transcripts. Nothing about that is encrypted at rest.

There is an important caveat, and honest reporting requires stating it. The strongest audio demonstrations were performed on a compromised device, using remote code execution flaws in webOS that the researchers reported to LG and that are still going through disclosure. That proves two things. First, the hardware is capable of covert recording. Second, webOS shipped with holes wide enough for a stranger to trigger it. It does not prove that an untouched LG set has been streaming your living room to Seoul by default. It also does not make anyone feel better about the microphone sitting in the corner of the room.

The second finding needs no caveat at all, because LG confirmed it.

The TVs scan the local network. They enumerate the devices around them: phones, smartwatches, printers, routers, thermostats, computers, including devices that were never paired to the television and whose owners had no idea a TV was even being tested in the building. Burke put it plainly: the set “crawled our entire network and found dozens of unrelated devices, including smartwatches and phones of our staff who didn't even know we were working on this.” The sets also collected IP addresses, geographic location hints, the names of nearby Wi Fi networks, their signal strength and their channel numbers.

Then there is ACR, Automatic Content Recognition, which LG brands as Live Plus. ACR fingerprints what is on screen and matches it against a database to identify the show, the movie or the advert. It runs across external inputs too, so plugging in a games console does not opt you out. A 2024 academic study presented at the ACM Internet Measurement Conference by researchers from University College London, UC Davis and Universidad Carlos III de Madrid measured how often each brand samples the screen. LG sampled every 10 milliseconds. Samsung, for comparison, every 500 milliseconds. A July 2026 analysis by the security firm Spur unpacked 6,038 apps across the two TV app stores and found 2,058 of them shipping residential proxy code, which routes strangers' web traffic through your home connection. More than 42 percent of the webOS apps it examined carried that code.

All of this feeds LG Ad Solutions, which sells audience reach to advertisers. The company's own marketing has claimed it can address 49 million televisions and 363 million “addressable secondary devices” in the United States alone. The secondary devices are things like the unpaired phones sitting on the sofa. A television that counts the phones in the room is not a television. It is a sensor.

LG’s answer, and what it leaves out

LG responded on 9 September 2026 with a statement it also gave to Tom's Hardware: “The claims made in the recently published video are not true.” The company says voice data is processed only when the remote's voice button is held, or when a wake word such as “Hi LG” is recognised after the user has enabled Far Field voice recognition. In standby, it says, the TV only listens for the wake word if that feature was turned on, and if no wake word is detected the audio is processed locally, deleted and not sent to LG. On ACR, LG says it works through audio fingerprinting in the TV's internal processor, not screenshots or recordings. And it confirmed the network scanning while calling it a “standard function commonly provided by smart TVs and smart home devices.”

Read that statement carefully, because it is doing a lot of quiet work. It denies the audio claims. It confirms the network scanning. It reframes the scanning as normal. It does not address the standby buffer, the plain text transcripts, the possible second microphone that a settings toggle may not control, or the remote code execution vulnerabilities. Gamers Nexus answered with its own video, pointedly titled “LG Says We're Fake News”, and took the statement apart clause by clause.

You do not have to pick a side to notice the asymmetry. A company with nothing to hide does not release a denial that narrow.

We said this in 2020

This is where our own archive gets uncomfortable. Back in 2020 we published a guide titled Where is the camera on my LG smart TV? on smartphonesoutions.eu, written for readers who wanted to know whether the black rectangle in their living room could see them and how to cover the lens if it could. We explained why manufacturers put cameras in televisions, we walked through gesture control and video calling, we showed how to find the lens with a piece of cardboard, and we answered the questions our inbox was full of: can the TV spy on me, can a hacker reach the camera remotely, do manufacturers actually protect you.

The response was predictable. Sceptics laughed. It was conspiracy material, the reasoning went, the kind of thing people say about microwaves and 5G. A camera needs to be aimed at something and covered with tape, and anyway who would bother.

Six years later the industry has answered that question, and the answer is: they would, and they do, and they do not need the camera at all. The microphone is enough. The lesson of 2026 is not that the 2020 worry was right about cameras. It is that the worry was too small. We were arguing about the eye when we should have been arguing about the ear, the network card and the ad server behind both.

It was never only LG

If you are tempted to file this under “one bad manufacturer”, the last decade says otherwise.

Robot vacuums. In December 2022, MIT Technology Review (Eileen Guo) revealed that development versions of the iRobot Roomba J7 had sent camera footage to the data labelling firm Scale AI, where underpaid contract workers in Venezuela took screenshots, including one of a woman on the toilet, and shared them in private Facebook and Discord groups. iRobot said the images were shared in violation of a non disclosure agreement. The vacuum did not leak because it was hacked. It worked exactly as it was built.

Ecovacs. At DEF CON 32 in August 2024, researchers Dennis Giese and Braelynn Luedtke demonstrated flaws in Ecovacs Deebot and lawn mower robots: weak Bluetooth authentication, missing mutual TLS and a four digit PIN. In mid 2024 real attackers used those weaknesses to seize control of vacuums in multiple cities, driving them through homes, watching through their cameras and shouting through their speakers. The creepiest smart home appliance turned out to be the one that cleans your floor.

Vizio. In February 2017 the FTC and the New Jersey Attorney General fined Vizio 2.2 million dollars for pushing ACR firmware to 11 million televisions without meaningful consent, sampling the screen every second and selling viewing profiles tied to household IP addresses. A consolidated consumer class action settled for 17 million dollars the following year.

LG itself, before all of this. In 2013 the UK researcher known as DoctorBeet (Mark Malecki) found that LG smart TVs were transmitting viewing habits, channel changes and even the unencrypted file names of USB drives to LG servers, and doing it even when the “collection of watching info” setting was switched to Off. LG patched it and moved on, and the same company is now explaining, thirteen years later, that its scanning is just a standard smart TV function.

And the regulators. In December 2025 the Texas Attorney General Ken Paxton sued Samsung, LG, Sony, Hisense and TCL over ACR data collection without affirmative consent. Samsung settled in February 2026, LG on 11 May 2026, agreeing to clearer consent screens and simpler opt outs. Gamers Nexus found that on the TV they tested the “Do Not Sell My Personal Information” toggle was off, and stayed off, until the set had already been on the internet. That is a settlement that produced a button nobody is directed to press.

GDPR was supposed to prevent exactly this

Here is the part European readers should find genuinely irritating. Under the GDPR, microphone audio, viewing fingerprints, network identifiers and device inventories are personal data. Processing them requires a lawful basis, usually consent, which must be freely given, specific, informed and unambiguous. Article 5 demands data minimisation and purpose limitation. Article 25 demands protection by design. Article 32 demands appropriate security. None of the behaviour described above is a good fit for any of that.

The failure is not ignorance of the law. It is the deliberate conversion of consent into a formality. Bundling agreements, boxes pre ticked for you, hiding the option four menus deep, greying out the “no” button, using a remote control as the interface for a wall of legal text: these are not accidents of design. They are dark patterns with a commercial purpose, and the German Bundeskartellamt said as much in 2020 after a sector inquiry into smart TVs, finding transparency failures, unconsented voice and biometric data collection, and no guarantee of security updates across device lifetimes.

The enforcement record is thin and slow. The Hamburg data protection authority pushed Google into a three month pause on human review of Assistant recordings in 2019, after VRT NWS revealed that contractors were listening to snippets, a story that surfaced because a whistleblower, not a regulator, spoke first. Ireland's Data Protection Commission opened inquiries into Apple's Siri grading after a Guardian investigation by Alex Hern. The FTC and the Department of Justice fined Amazon 25 million dollars in 2023 over Alexa's retention of children's voice recordings. Each time, the trigger was journalism, the remedy arrived months or years later, and the practice, slightly renamed, carried on.

A fined company treats a fine as a line item. The structural incentive underneath is simple: hardware margins on televisions have collapsed, and the data collected through ACR and device scanning is often what makes selling the panel at a thin margin worthwhile in the first place. A manufacturer whose revenue depends on that data has no incentive to make switching it off easy, and every incentive to make it look like a default.

What to do about it

This is not defeatist advice, it is just unglamorous.

Disable the tracking systems by their real names, not by a generic “privacy” menu. On LG that means turning off Live Plus, voice recognition including Far Field, and interest based advertising. Check the “Do Not Sell” and consent toggles, and check them again after your next firmware update.

Treat “off” and “standby” as different things. If the television sits in a room where you have private conversations, and especially if it doubles as a home office display, unplug it at the wall when it is not in use. It is the only intervention the demonstration could not route around.

Put smart devices on a separate network. A guest or IoT network contains exactly the kind of device enumeration this investigation flagged, because a television cannot inventory what it cannot see.

Update firmware, and mean it. The webOS remote code execution flaws are real, and a patch is the difference between a microphone with a lock and a microphone without one.

Trust the port, not the panel. The most robust setup is a good display with no internet connection and a cheap, replaceable streaming stick doing the dirty work. You keep the screen. You fire the computer inside it.

Cover the camera if you want, but understand that 2026 settled the argument in a different direction. The camera was never the interesting sensor. The microphone, the network interface and the advertising identifier were, and they were always on.

So should you be afraid of your television?

Not of the picture. The picture is innocent, and the panel is a small miracle that has never once lied to you about what is on it.

What deserves a second look is the company your television keeps, and that company keeps multiplying. Your fridge knows when you open it, how often and at what hour. Your vacuum knows the shape of your bedroom and whether the door was closed. Your speaker sits with one ear turned toward the room, waiting for a name it was taught to answer to. Your watch counts your steps, your pulse and the hours you sleep, and asks nothing out loud. Your car remembers where you went and how hard you braked, and it may have already told someone. None of these things is evil. Each of them is attentive. And a house full of attentive machines is a house full of something new, something most of us moved in one sale at a time without ever quite saying yes.

So should you be afraid? Not of the television. Be wary of the habit of not asking. The scandal was never that a screen can hear. It is that for years the question was waved away as paranoia, and then the answer came back measured in milliseconds. Cover the lens if it comforts you. Unplug the set when the conversation matters. Give the smart things their own network, the way you would give a noisy guest their own room. Read the settings you were nudged past, and keep asking the boring question, because the boring question keeps turning out to have been the right one.

The living room is not a room any more. It is a network with a sofa in it.