What's our LG Smart TV up to?

Sam Lazarus · October 2026

The setup

We used a Raspberry Pi to host the TV’s Wi-Fi network. The Pi passed the TV’s traffic to the internet over Ethernet, recording every packet. To the TV, it was an ordinary Wi-Fi network.

The Pi ran hostapd (access point), dnsmasq (DHCP and DNS, logging every lookup), nftables (NAT) and tcpdump (capture). We analysed the captures with Wireshark and tshark; the commands are in the appendix.

What we can and can’t see

Most of the TV’s traffic is encrypted with TLS, so we can’t read most messages. What we can see is still revealing:

• Every hostname the TV looks up (DNS), which usually names the company and often the purpose.
• Every server it connects to, and the name it asks for during the TLS handshake (SNI).
• When, how often, and how much. A connection every minute that triples during a film says a lot, even unread.
• Anything unencrypted, in full.

The TV and how we tested

The TV is an LG 55QNED82ASA, a 55-inch 2025 webOS model: a mainstream set from one of the two biggest TV brands, on its default settings.

We changed one thing at a time and recorded each state:

What we found

1. It’s busy from the first second

Within 90 seconds of a cold boot, before anyone touched the remote, the TV contacted about thirty servers:

It also surveys the local network. On joining, then hourly (at 12 minutes past, in our capture), it asked our DNS server for the name of every address on the subnet, all 253, in about 13 seconds. It then broadcast queries aimed at specific smart-home brands:

• TP-Link Kasa plugs (UDP 9999): lightly obfuscated JSON that decodes to {"system":{"get_sysinfo":{}},"emeter":{"get_realtime":{}}}, asking every Kasa plug what it is and how much power it’s drawing right now. It sent that 519 times in an afternoon.
• LIFX bulbs (UDP 56700): LIFX’s LAN “GetVersion” request.
• Belkin WeMo switches, DIAL casting receivers and UPnP devices (SSDP), plus Apple/Google-style services over mDNS.

The TV advertises itself as an AirPlay receiver, a HomeKit accessory and a Google Cast device. Separately, Netflix’s components bypassed our network’s DNS server and queried Google’s 8.8.8.8 directly.

2. Watching what you watch

A 2024 peer-reviewed study (Anselmi et al., IMC 2024) identified tkacrX.alphonso.tv, “where X is a number that changes periodically”, as the ACR domain LG TVs use in the US (UK sets use eu-acrX). Alphonso, which registered the domain, has been majority-owned by LG since 2021 and now operates as LG Ad Solutions.

Our TV opened a short encrypted connection to tkacr394.alphonso.tv every minute it was on, starting about 20 seconds after it came online from a cold boot. On the home screen the check-ins settled into a steady 1,862 bytes a minute. Then we played a film from a laptop.

Over 30 minutes of HDMI playback the TV sent 193 kB to the ACR server, three times the roughly 64 kB its idle rate predicts.

The 2024 study measured a bigger jump on an LG TV in the UK, roughly 19 times the idle rate. Region, model year or settings could explain the difference. The pattern holds: the TV reports on what you watch, whatever the source.

Home-screen ad traffic went the other way: <cc>.ad.lgsmartad.com got 7 connections in the 22 idle minutes and none during the film.

3. One switch turns it off

Next we changed four settings one at a time, photographing each and noting the time. With the ACR heartbeat ticking every minute, it was easy to see which change mattered:

Live Plus is LG’s name for its ACR feature. Turning it off stopped the traffic immediately, without a restart: the TV answered a couple of keep-alives, closed the connections and never went back. To confirm, we replayed the same film from the same point for 30 minutes:

Turning Limit Ad Tracking on did not stop the TV contacting LG’s ad server. It may change what’s sent, but we can’t see inside the encryption to tell.

4. Shopping prompts, in plain text

Not everything is encrypted. At boot the TV fetches home-screen posters and two configuration files from LG’s content servers over plain HTTP. One, lgshopping_overlay_video_service.json, calls itself a “Video ACR Overlay”: a list of TV episodes, each paired with a moment in the episode and a shopping image or link:

{"overlayType":"Video ACR Overlay", "period":"600",
 "svcCountry":[{"country":"US","overlaySvcYn":"Y"}],
 "contentList":[{"tmsId":"EP0236528803…",
   "shoptimeDeeplink":"…MagicClick…",
   "noticeBarInfo":[{"timeStamp":441,
     "imageUrl":"https://commerce.nbcuni.com/…"}]}, …]}

It reads like a schedule: when ACR recognises this moment of this episode, show this shopping prompt. A second file, a “Food Delivery Overlay”, holds dinnertime banners such as “Dinner ideas? Explore delivery right from your LG TV.” Both are marked US-only with logging switched off, so they’re probably not active on our TV, and we never saw an overlay on screen.

Plain HTTP also means anyone on the network path, such as a compromised router or a hostile Wi-Fi network, can read these files or change them before they reach the TV. So we tried it on our own TV.

5. So we changed what our TV was promoting

We put mitmproxy on the Pi and routed only the TV’s unencrypted web traffic (port 80) through it. HTTPS was untouched: no certificates, no decryption. A short script answered LG’s poster requests with our own images. Within 90 seconds of the TV requesting posters again, it had downloaded 36 of ours and shown every one:

Our posters are harmless jokes, but the TV showed them without warning, in slots LG reserves for paid promotion.

6. Off really is off

Here the TV deserves credit. With the default “Quick Start+” setting, “off” means suspended: the TV stays on Wi-Fi so it can wake in about five seconds. Yet after one last connection to LG, about two minutes after we switched it off, it went completely silent, with no DNS lookups, no connections and no discovery broadcasts, for 16 hours overnight (with Live Plus off). It twice dropped into the same silent standby by itself after about 14½ minutes untouched, and each time the ACR check-ins stopped with it.

What you can do

• On an LG TV, turn off Live Plus. It was the one setting that stopped ACR in our test. On our model it’s under Settings → All Settings → General → System → Additional Settings. Menus vary, so also check Support → Privacy & Terms, and turn off the “Viewing Information” agreement if there is one. Other brands have equivalents under their own names.
• Turn off Home Promotion and Content Recommendation too. They didn’t affect ACR, but they stop the unencrypted poster downloads we hijacked.
• Don’t assume the ad settings do what they say. Limit Ad Tracking didn’t stop the TV contacting LG’s ad server.
• Check again after updates. Firmware updates can reset or rename settings.
• Put the TV on a separate network. Ours looked up every address on its network and probed for smart-home devices. A guest or IoT network keeps your laptops and phones out of that sweep.
• Consider DNS-level blocking of *.alphonso.tv, for example with a Pi-hole or your router’s filtering. We haven’t tested whether this breaks anything.
• Ask whether it needs to be online at all. With an external streaming box, the TV itself can often stay offline. As our HDMI test shows, an online TV can still watch what the box plays.

Appendix: reproduce it yourself

A Raspberry Pi 4 (Raspberry Pi OS, Debian 13) with Ethernet to the router. The onboard Wi-Fi becomes the TV’s access point. In outline:

# Wi-Fi radio out of NetworkManager, give it a lab address
sudo nmcli device set wlan0 managed no
sudo ip addr add 192.168.50.1/24 dev wlan0

# hostapd.conf (2.4 GHz, WPA2)
interface=wlan0
driver=nl80211
ssid=<lab-ssid>
country_code=<CC>
hw_mode=g
channel=6
ieee80211n=1
wmm_enabled=1
wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=<passphrase>

# dnsmasq.conf: DHCP + DNS with every query logged
interface=wlan0
bind-interfaces
dhcp-range=192.168.50.10,192.168.50.99,12h
server=1.1.1.1
log-queries=extra
log-facility=/home/pi/tvlab/captures/dnsmasq.log

# NAT out of eth0
sudo sysctl -w net.ipv4.ip_forward=1
sudo nft add table ip tvlab
sudo nft 'add chain ip tvlab post { type nat hook postrouting priority 100; }'
sudo nft add rule ip tvlab post oifname eth0 masquerade

# capture everything the TV sends, one file per hour
sudo tcpdump -i wlan0 -n -s 0 -U -G 3600 -w 'tv_%Y-%m-%d_%H%M%S.pcap' -Z "$USER"

# who did it talk to? (TLS server names)
tshark -r all.pcap -Y 'tls.handshake.type==1' \
  -T fields -e tls.handshake.extensions_server_name | sort | uniq -c | sort -rn

Run everything in tmux so an SSH drop doesn’t stop the capture, and keep a timestamped log of what you do to the TV: it’s what turns a pile of packets into findings.

References

• Our follow-up post, “What’s our LG Smart TV up to? Part 2”, on what the TV sends to the ACR server once the encryption is opened up.
• G. Anselmi, Y. Vekaria, A. D’Souza, P. Callejo, A. M. Mandalari, Z. Shafiq. “Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs”, ACM Internet Measurement Conference (IMC) 2024.
• AdExchanger, “LG just ousted the CEO and executive chairman of its ad tech division Alphonso”, on LG’s 2021 controlling stake in Alphonso.

All testing was done on a device we own, on our own network. Device identifiers have been left out.