Lack of privacy: If you thought you were safe from the watchful eye of advertising giants like Facebook and Google due to your VPN, anti-tracking browser add-ons, and other privacy measures, think again. Two separate research teams have recently released studies that suggest there's a lot more data tracking going on in the average individual's home than most realize.
The studies examined smart TVs of various types and checked for advertising cookies and trackers. While the first study focuses on tracking in smart TVs, the second study is much broader and encompasses consumer Internet of Things (IoT) devices as a whole.
The first study, conducted by researchers from Princeton University and the University of Chicago, found that -- out of 2,000 channels across both Amazon Fire TV and Roku platforms -- tracking was "pervasive."
Specifically, trackers were present in 69 percent of Roku channels, and 89 percent of Fire TV channels. Some of the information transmitted to advertisers included content viewing data (such as a video's title), device IDs or serial numbers, WiFi MAC addresses, and SSIDs. In many cases, researchers claim, this data was transferred over an unencrypted connection.
Some of the most widely-used trackers came from companies like Facebook, Amazon, and Google. Google's doubleclick.net was found across 975 (out of 1,000) Roku channels, and amazon-adsystem.com was found in 687.
Out of the top 1,000 Fire TV channels, the ones that contacted the most trackers included WNEP (contacting 64 trackers), ABC7 News San Francisco (61 trackers), and Midnight Pulp (32 trackers).
What about the second study's findings? Unfortunately for privacy-minded folks, the situation isn't any better in the IoT sector. Various devices -- but mostly smart TVs -- sent information (often without encryption) to the same trackers mentioned before, as well as a few others from companies like Microsoft.
"Several non-first-party destinations (in particular Amazon, Google, and Akamai) receive information from many of our IoT devices, thus allowing them to potentially profile consumers," the second study reads. "For example, these companies not only can learn the types of devices in a household, but also how/when they are used, simply by analyzing the network traffic from IoT devices to their cloud services."
"For example, these companies not only can learn the types of devices in a household, but also how/when they are used, simply by analyzing the network traffic from IoT devices to their cloud services."
In some controlled experiments, researchers even found that select camera-equipped devices would trigger without an obvious stimulus. For example, a camera might start recording even when its connected motion sensor didn't detect movement.
Researchers note that while such events are both unexpected and potentially suspicious, they cannot prove that they are intentional or related to data collection -- it's possible that the team simply failed to fully eliminate external stimuli, such as background noise or movement from other IoT devices.
The studies seem to agree that the lack of user-facing methods for opting-out of data collection or tracking is concerning, at the very least. On smart TVs in particular, users have few reliable anti-tracking tools or controls to take advantage of; whereas such options are prevalent on desktop and mobile devices.
Sometimes, it's not even enough to avoid using specific services. As Ars Technica points out, the second study's smart TVs contacted Netflix even when no such devices were configured with a Netflix account.
We'll have to wait and see whether or not these studies lead to any concrete changes in the IoT and smart TV tracking or advertising industries, but they're a step in the right direction.
If you feel like digging deep into the science and methodology behind these studies (perhaps to find flaws or conclusions that we may have missed), feel free to do so. The first study can be found here, and the second can be found here.
