LG TVs Record Audio With Screen Off, Gamers Nexus Investigation Finds
In brief
- LG TVs scan home Wi-Fi networks and record audio with screens off, Gamers Nexus investigation reveals
- Researchers extracted usable microphone recordings from dark TVs and after disconnecting from internet
- LG signed privacy settlement with Texas regulators four months before investigation findings emerged
- LG Ad Solutions executives stated company 'owns the glass' and links TV habits to phones and devices
- Security researchers found remote-code-execution bugs in approximately 42% of apps on LG's webOS store
The Investigation
Gamers Nexus spent more than 500 hours and about $70,000 testing LG's behavior across multiple sets and configurations. The team found LG's sets scanning a home's entire Wi-Fi network using UPnP, a protocol that lets devices discover and communicate with each other. This mapping captures every phone, laptop, and smart device connected to the network—without user consent or awareness.
The microphone findings were more troubling. Researchers pulled clean microphone audio off a TV with a dark screen, then did it again after yanking the set offline entirely. They also muted the TV's main microphone through the settings menu, then pulled a usable recording off a second, hidden microphone that the mute switch doesn't affect.
In one test, they left a TV unplugged from ethernet, spoke near it, and watched it upload the stored audio the second it reconnected to the internet—capturing speech from approximately 60 feet away through a wall.
What LG Says It Does
Voice commands get converted to plain text and saved in on-device logs. The microphone stays live for 10 to 15 seconds after someone stops talking. This is ostensibly for voice-assistant functionality, but it doesn't explain the capture of ambient audio or the network scanning.
LG's Automatic Content Recognition, or ACR, software samples what's on a screen or coming through speakers, creates a digital fingerprint, and checks it against a reference database. Gamers Nexus found LG's version keeps working even when a TV is used purely as an HDMI monitor for a laptop. Switching inputs doesn't disable it.
Yet LG told reporters in July that its sets "do not collect, record, or store ambient conversations." This was four months after the company signed a privacy settlement with Texas regulators.
The Ad Business
The data runs through Alphonso Inc., an ACR partner LG took a controlling stake in back in 2021. Multiple LG Ad Solutions leaders are shown saying the company "owns the glass," and they mean it: the pitch to advertisers is tying a household's TV habits to the phones and other devices under the same roof.
LG Ad Solutions' president of global ad sales, Serge Matta, previously ran ad-measurement firm Comscore, which the SEC charged in 2019 with inflating revenue by roughly $50 million. Matta personally paid a $700,000 penalty, repaid Comscore $2.1 million, and accepted a 10-year ban from running a public company.
Security Gaps
Researchers also found remote-code-execution bugs, flaws that let an attacker run their own commands on a TV from across a network. LG has not fully patched these. One trick fools the TV's built-in browser into pairing with a fake mobile-device pop-up, handing over remote access without physical interaction.
Security firm Spur found residential-proxy code, software that quietly reroutes someone else's internet traffic through your device, in approximately 42% of apps on LG's webOS store. LG senior vice president John Taylor said the company is working with developers to strip it out or suspend the apps that carry it.
Terms and Timing
LG's television and account agreements run past 30,000 words combined, or roughly three to four hours to read at an average pace. Days after Gamers Nexus published its first LG report in July, LG added a forced-arbitration clause to those terms—limiting users' ability to sue the company in court.
The pattern is clear: LG collects, LG denies, LG patches the terms when caught.
