LIVE · cybersecurity feed
Live wire
security

LG accused of 'egregious invasion of privacy' over TV data collection

LG is once again facing scrutiny over allegations that its smart TVs extensively collect user data, including audio, even when the display is in standby mode. These claims, made by researchers from the Gamers Nexus YouTube channel, follow earlier reports in July that LG monitors were installing adware without explicit user consent.

ZeroDay News ·

Source: The Register — Security

LG is once again facing scrutiny over allegations that its smart TVs extensively collect user data, including audio, even when the display is in standby mode. These claims, made by researchers from the Gamers Nexus YouTube channel, follow earlier reports in July that LG monitors were installing adware without explicit user consent.

The researchers claim that their analysis of network traffic and internal data from LG smart TVs revealed plaintext transcripts generated from captured audio. This audio capture allegedly continued even when the TV was disconnected from the internet, with data stored locally and transmitted once connectivity was restored.

Beyond audio, the Gamers Nexus team reported observing the TVs collecting IP addresses, location data, and details about nearby Wi-Fi networks, including names, signal strengths, and channel numbers. The TVs also reportedly enumerated other devices on the local network that were not paired with them, such as smartphones, smartwatches, routers, thermostats, air purifiers, server baseboard management controllers, and PCs. According to the researchers, Wireshark packet capture analysis showed a significant volume of private data being collected as native behavior of LG's equipment, which they described as an "egregious invasion of privacy." The team also indicated they are working with security researchers to responsibly disclose potential vulnerabilities, including a claimed remote code execution flaw.

LG has previously stated to other publications that its TVs do not "collect, record, or store ambient conversations" and that voice recognition is an optional feature that processes voice data only when activated by the user.

LG openly acknowledges that its hardware integrates technology from its advertising division, LG Ads Solutions. In 2022, the company announced that automatic content recognition (ACR) technology, initially limited to its US smart TVs, would be rolled out to sets in 27 countries. LG stated that the insights derived from this ACR data are anonymized and handled in compliance with privacy regulations, allowing advertising customers to measure campaign effectiveness and track app registrations or service sign-ups.

However, the researchers contend that LG's product descriptions and marketing materials do not clearly disclose the extent of data collection, particularly the alleged audio capture during standby. While LG's website mentions "Intelligent Voice Recognition" and "Clear Voice Pro," detailed privacy information is reportedly difficult to find, often requiring users to navigate through multiple links on a lengthy product page. The researchers claim that all collected data is sent to LG Ads Solutions, which markets its ability to offer "precision targeting at the device level, across households" and reach 363 million "addressable secondary devices" in addition to 49 million LG TVs in the US.

These latest allegations come less than two months after Gamers Nexus reported that connecting certain LG monitors to an online Windows 11 PC could trigger the installation of the LG Monitor App through Windows' device metadata system. This behavior reportedly occurred if a user selected "Recommended Settings" during Windows setup and was signed into the Microsoft Store. The LG Monitor App Installer was found to have limited utility and displayed pop-up promotions for McAfee. LG responded at the time, stating that "McAfee is not installed automatically and is never installed without the user's explicit consent."

ShareXLinkedInWhatsAppFacebook

More News

view all →
security

Canadian cybersecurity executive arrested in federal extortion case

A Canadian cybersecurity executive was arrested in Pennsylvania on Thursday, facing federal charges of conspiracy to commit extortion. Edward Dubrovsky, 54, a co-founder and former Chief Operating Officer of CYPFER, a firm specializing in ransomware negotiation, is charged with conspiring to threaten the confidentiality of information for extortion and conspiring to commit Hobbs Act extortion,…

breach

Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management

AI SPERA, the company behind the cyber threat intelligence platform Criminal IP, has announced AITEM (AI-Powered Threat Exposure Management), an expansion of its Attack Surface Management (ASM) offerings. AITEM aims to move beyond traditional asset discovery to provide a more comprehensive approach to understanding, prioritizing, and responding to security exposures. The platform is scheduled…

ai

AI Is Getting Really Good at Messing With Cybercriminals

Anti-cybercrime initiatives are increasingly deploying artificial intelligence to disrupt scammers by engaging them with lifelike bots, which the criminals mistake for genuine victims. This strategy aims to waste scammers' time and resources while gathering intelligence on their operations.

ransomware

FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe

The Federal Bureau of Investigation (FBI) has reportedly arrested Edward Dubrovsky, a co-founder of the ransomware negotiation firm Cypfer and currently associated with CyberSteward. The arrest is said to be part of the ongoing ShinyHunters investigation, specifically in connection with an incident involving FBI job applicant data.

ai

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…

security

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

A former core infrastructure engineer has been sentenced to prison for an attempted cyber extortion plot against an industrial firm. The engineer reportedly deleted administrative accounts and reset hundreds of user passwords, subsequently demanding a ransom of 20 Bitcoin to prevent further disruption to the company's servers.