Samsung TV privacy: hacker says sets borrow your soundbar’s mic

It started with ads that felt a little too personal. log4j bought a Samsung TV in 2025, kept seeing oddly specific ads on it, and decided to find out why. The firmware was encrypted, so instead of taking the set apart, the researcher used previously unknown flaws (so-called zero days) to get a root shell, which means full administrator control over the TV’s Tizen operating system.

From October 21 onward, log4j posted findings as a running thread on X and called the result a privacy horror. The researcher has promised a longer report, roughly 44 sections, which had not appeared when we checked.

There was an odd side plot, too. The researcher says OpenAI banned their account for cyber abuse after they used its tools during the project. log4j disputes that, saying the tools were only used for local reverse engineering, and blames an automated classifier. OpenAI’s reasons have not been made public.

The list is long. According to log4j, the TV’s software includes:

• Detailed usage telemetry, built from logs of network traffic.
• Screenshots and computer-vision processing of what is on screen.
• A neural network that differs by region and follows behavior inside apps such as YouTube, including skipped ads and video progress.
• A cross-device advertising ID, which lets ad companies link your TV to your other gadgets.
• Audio categorization, with counters for events such as a dog barking or a baby crying.

The researcher also has a theory about why many Samsung TVs feel sluggish: all of that processing runs on the set itself. That is an educated guess, not a measured finding.

Some of this has an innocent explanation. Samsung openly sells Pet Care and Family Care features on its 2025 Vision AI TVs, which listen for barking or crying and send an alert through the SmartThings app. What Samsung does not spell out in its marketing is that tallies of those events appear to be sent back to its own cloud servers, logged under an event the researcher identified as SOUNDSENSOR_ON.

This is the detail that spread fastest. log4j says that if a Samsung TV has no microphone of its own, it searches for a connected device that does, such as a soundbar or Bluetooth speaker, and uses that to capture audio.

Here is the catch. The researcher’s own notes say the counters do not prove an alert was ever shown, and that the full chain of events has not been traced. A Hugging Face engineer who goes by ngxson tested the microphone behavior with a Flipper Zero, a small hacking gadget, and saw a rooted Tizen TV switch on its mic for five seconds before going quiet. Hours later, nothing more had happened. ngxson also stressed that their TV was already rooted with several settings turned off, so a stock TV could behave differently.

So the honest answer is that nobody has yet shown a normal Samsung TV recording conversations in your living room. What has been shown is code that appears capable of a lot more listening and watching than most owners would expect.

This is not the first time Samsung’s opt-out settings have been questioned. A Northeastern University study titled Watching the Watchers tested TVs from ten brands, covering the software behind about 95 percent of US smart TVs. Each scenario ran 30 times with tracking on and 30 times after opting out.

Even with tracking switched off, the Samsung set went on sending data that looked like automatic content recognition (ACR), the feature that fingerprints what is on your screen and matches it against a library of shows and ads. That matters because Samsung’s Tizen runs more US TVs than any rival, with 34 percent of the market, according to the study, and the authors say 82 percent of US households have a smart TV that can track this way.

The opt-out fully worked on only four of the systems tested: LG’s webOS, Google TV on Sony, VIDAA and Amazon’s Fire TV software. Samsung is not alone in facing questions, either. LG TVs have previously been accused of mapping home networks and capturing mic audio in standby.

For most people, the risk is less about someone listening to your dinner and more about a detailed advertising profile built from your viewing, your skipping and your household’s sounds, then tied to your phone and laptop through an ad ID. That profile can be shared with or sold to ad partners.

If that bothers you, here is what to do now:

1. Open your TV’s privacy or terms settings and turn off viewing information services, interest-based ads and any voice features you don’t use.
2. Check which devices are paired over Bluetooth and remove any you don’t need, especially soundbars and speakers with microphones you never talk to.
3. Turn off Pet Care, Family Care or similar listening features in SmartThings if you don’t rely on them.
4. For certainty, take the TV offline. ACR needs an internet connection, so a set with no Wi-Fi or Ethernet has nowhere to send screen fingerprints. Plug in a streaming stick instead.

If you go the stick route, the study offers a hint. Amazon’s Fire TV software was one of only two platforms where the opt-out fully worked, and Roku’s did not track the third-party channels tested once users opted out, only its own free streaming service. A Fire TV Stick 4K Plus costs $39.99 and a Roku Streaming Stick 4K is $79.99. The study tested TVs running that software, not the sticks themselves, so treat it as a good sign rather than a guarantee.