LG TVs Counted 38 Devices in One House and Logged What People Said Out Loud

Your LG television counted 38 devices in the house that have nothing to do with television. Phones, smartwatches, a printer, the thermostat. The set was not hacked to do it. This is the TV doing its job.

Researchers bought a brand new LG G5 OLED at a Best Buy, plugged it into the network and watched the traffic with Wireshark. What came out was an inventory of the building.

The set swept the local network and came back with at least 38 other devices. Per device it picked up the display name, the MAC address, the internal IP address and the signal strength. A 3D printer. An ESP32 development board. An air purifier. It found the internal servers, and a Samsung phone with a staff member’s username still attached, belonging to someone who had no idea any of this was being tested. A colleague’s Galaxy S23. A Note 9. An Alienware used for backup editing. And on one of the editing machines the television worked out that TeamViewer was running.

Smartwatches, Pixels, iPhones, internet gateways, network switches. And the thermostats. LG sells air conditioners.

Steve Burke of Gamers Nexus ran the investigation with Level1Techs and three independent security researchers. His summary of the sweep: the television “found dozens of unrelated devices, including smartwatches and phones of our staff who didn’t even know we were working on this.”

A television company wants that list for a reason, and the reason is on LG’s own sales material. LG Ad Solutions, the advertising arm of LG, tells advertisers it reaches 49 million LG televisions in the United States. In the same country it offers another 363 million “addressable secondary devices”. That is seven other devices per television, and none of them were bought from LG. The gap might be what the network sweep is for.

In LG’s own words, from more than one executive on a recorded industry panel: “We know who’s in the LG household. We know which devices are there. We know what you’re exposed to on TV and we know how to extend that reach into mobile.” And the line that keeps coming back: “We own the glass. We own the TV because, you know, we own the glass.”

Burke paid 2,400 dollars for that glass. And none of what you just read needed an exploit. “This is the TV’s native functionality,” he said. “This didn’t require vulnerabilities.”

Keeping the thing off the internet and using it as a monitor was tested too. On an older G3 they connected a laptop over HDMI, accepted no agreements, and captured an hour of traffic. The television reached out to eight endpoints belonging to LG’s advertising and customer data platforms. It sent 38 DNS lookups to LG domains, moved 8.9 megabytes, and kept scanning for nearby devices. Over a month that works out at roughly 6.4 gigabytes, before agreeing to anything.

A second set, with the built-in channel feature switched on, connected out 847 times to 60 endpoints, 618 of those to the advertising system. The content recognition traffic alone runs to around 4 gigabytes a month.

The set also logs the names and signal strengths of the neighbours’ WiFi networks, with their channel numbers. A television has no GPS. It does not need one. A list of the access points in range, with their MAC addresses, is a cheap way to work out where a house is. Wendell Wilson noticed this on a set that had only ever run over a cable.

The channel feature leaks to your neighbourhood rather than to LG. When the television plays a channel it sends a DNS request with the channel name written into it. CNN US while CNN is on screen. NBCN during NBC News Now. Fox Digital WTTG for the regional Fox station. DNS requests are not encrypted by default. Researcher Mr. Bruh put it like this: “There’s no privacy when watching IP TV via LG channels, as the DNS requests made can be reversed to determine what channel you are watching at any given time.”

Your provider knows what you are watching. So does the person who runs the router.

The microphone is where the wording gets careful, and LG’s answer is careful too. Speech the television hears gets turned into text and written into a debug log on the set, in plain readable form. The listening window does not close when the command ends. It stays open for another 10 to 15 seconds of silence, and longer if the talking continues.

In one recording, a staff member was setting up the set and used a voice command. Two colleagues stood on the far side of the television talking about work, with no idea it was on. The set kept picking them up for minutes, and the researchers say that is the same kind of data they pulled out of the plain text file.

Distance was tested by walking away. Speech picked up cleanly at 40 feet and still worked at 60 to 70 feet, around one corner and sometimes two. The log also holds entries reading voice is not recognized, which is the set building a profile of who is talking to it.

Those logs sit on a RAM disk. Restarting the television does not clear them. Only pulling the power does. And when a user tells the set to delete the collected data, it phones LG and asks the servers to clear it. Locally it does not seem to do much.

LG rejects the way this has been reported. Their statement on this investigation: “The claims made in the recently published video are not true. LG TVs process voice data only when the voice button on the remote control is pressed and held, or when a wake word such as ‘Hi LG’ is recognized after the user has activated the Far-Field voice recognition feature.” In standby, LG says the audio it uses to catch that wake word stays on the set, gets deleted straight away, and never reaches LG servers. On the device list, the company says televisions “can identify compatible devices on the same network to enable features such as device connectivity, content sharing or smart home functionality”, and calls that a standard function.

Set that next to LG’s own on-screen text for the same feature. It warns that “excessive ambient noise around the TV may affect hands-free voice control performance.” A setting that supposedly hears nothing but a wake word ships with a warning about the room around it.

One mistake in the code says more than the statements do. It is the kind a company makes when it wants to look private without being private.

The television sends LG a device ID that is meant to be anonymous. LG takes a random value generated at boot, combines it with the machine’s MAC address, and encrypts it. Encryption is reversible. Hashing is not, and hashing is what this job calls for. Mr. Bruh decompiled the firmware and worked out what follows. Hand someone the model secret key and they can reverse the device ID and recover the MAC address. In his words: “the advertisers would have a persistent identifier that is not random and no longer changes on reboot.”

The key is not much of a secret either. It sits on the set at

1

/mnt/lg/cmn_data/log

and it is the same key across a model. Jailbreak one television and the advertising data for that model can be tied back to the hardware address it came from. They built an anonymiser you can undo.

LG locks down one more thing. To read what the set is sending you have to load your own certificate onto it, and on the home models LG blocks that. On the commercial versions it works. The living room set is the one they will not let you audit.

Opting out has its own surprise. As the setting flips, the set sends one final snapshot of most of the collected data to the advertising system. The researcher calls that “pretty dirty of them.” That request carries your MAC address, and afterwards the set still tells LG in plain text that it is online at each start.

Reading only the first layer of the agreements took 2,705 presses of the remote. Close to 50,000 words, three to four hours, on a screen you drive with arrow keys.

The “do not sell my personal information” switch sits off by default, which means selling is on. The researchers found it that way before the set had ever seen the internet. Installing one app throws up six agreements with “select all” already highlighted, while two are required. Voice data travels to Korea among other places and is kept for six months. And the terms make you consent for other people, in LG’s phrasing, that you “have obtained consent from all other members of my household whose information may be collected.”

In December 2025 the attorney general of Texas sued five television makers over content recognition without consent. LG settled on 11 May 2026 and promised to stop collecting viewing data without informed consent, to show a pop-up explaining what gets collected, and to give people a clear way out. Four months later the researchers opened a new box and found the selling switch still on.

LG is the one that got taken apart, not the only one doing it. Samsung settled with Texas before LG did, and Sony, Hisense and TCL are still fighting it. The same app store scan found proxy software in more than a quarter of Samsung’s apps too.

Two dates belong on the record. The first investigation into LG displays came out on 16 July 2026. Twelve days later, on 28 July, LG announced new terms of use built around a rewritten arbitration agreement, and those took effect on 28 August. The limit on class actions was already in there. It got tighter.

Your television can also be put to work for other people. In June 2026 research firm Spur went through LG’s app store. Of 2,851 apps, 1,213 let their developers turn a customer’s television into a residential proxy, routing other people’s traffic out through the home connection. Often the app publisher was the proxy company itself. LG says it is working with developers to remove the option and will suspend apps that keep it.

Mr. Bruh found something in the same area. An app with standard partner trust can list and control the UPnP devices on your network through an ordinary interface. The calls read like list devices, list services and request action. A game installed on the television by a child in the house can reach for the files on your network storage.

The attacks come last, because the surveillance came first and needed no attack at all.

The remote code execution that worked ran through the browser built into the television, which uses an old version of Chromium. A web page presents itself as a mobile device asking to pair. A prompt appears. Somebody presses yes, because the interface is fiddly or the prompt keeps coming back. That is all it takes. A second exploit that takes the set over with no interaction is still going through disclosure.

Once inside, the microphone switch turns out to mean less than it says. It kills the built-in microphone. It does not touch the audio coming in over HDMI, a USB webcam, a Bluetooth device or the microphone in the remote. During testing one researcher recorded a conversation through an ordinary webcam while that switch was off. Settings turned off in the menu can be turned back on from a shell.

A conference call played through the television was captured from the speaker output, because the set can read what it plays. In a separate test the microphone kept recording with the network cable pulled out, and that audio came off once the connection was back. The set holds 16 gigabytes of flash, and a USB stick turns that into weeks.

These sets are not only in living rooms. The same models hang in hospitals, in dentist rooms, in hotel rooms, boardrooms and Airbnbs pointed at the bed. A robotic surgeon who takes patient calls from home asked the researchers where that audio goes, and who is accountable for it.

Behind all of it is a business. The advertising arm’s president of global ad sales is Serge Matta, who settled SEC charges in 2019 and accepted a ten-year bar on serving as an officer or director of a public company. He is one of the people who says LG owns the glass.

The numbers behind this are not subtle. Take Vizio, bought by Walmart in 2024. In 2023 it made 1.1 billion dollars from hardware at a gross margin of minus 0.8 percent, and 598 million from its advertising platform at 61 percent. Selling you the television is the part where they lose money.

The voice data does not stay inside LG either. The partner named in the agreements for handling it is Nuance Communications, which Microsoft agreed to buy for 19.7 billion dollars in 2021 and took over in 2022.

Ripping that software out yourself runs into section 1201 of the DMCA. The Copyright Office grants an exemption for jailbreaking smart televisions and one for good faith security research, and both run out after three years.

What to do with the set you already own:

• → Turn off content recognition, live channel data, personalised ads and voice recognition in the settings
• → Find “do not sell my personal information” and switch it, because the default is the wrong way round
• → Put the television on its own network, away from your phones, laptops and storage
• → Switch off UPnP on the router
• → Use a separate streaming box and keep the television itself off the network
• → Watch your own traffic and see what it sends before you decide any of this is fine

That last one is the answer that holds. The people who took this apart say there is no way to be sure the flow has stopped unless you look yourself. Their advice: keep the set off the network.

The investigation cost around 70,000 dollars and over 500 hours on one brand, and the others only come if the funding does.

You can run that capture on your own network tonight and read what your television is saying about the rest of your house. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Gamers Nexus, 216,000,000 Spy TVs | Texas Attorney General, agreement with LG | LG Ad Solutions fact sheet