If you own an LG smart TV, do three things tonight: turn off LivePlus (the Automated Content Recognition setting), turn on Limit Ad Tracking, and disable Voice Recognition under AI Service. Then do the thing that actually works — put the TV on an isolated network segment or cut its internet entirely and stream through an external box. The reason is a Gamers Nexus investigation, run with Level1Techs and independent security researchers and published as a 135-minute video, which found retail LG OLED sets including the G5 sweeping the local network to map phones and smartwatches, collecting the names and signal strengths of neighbouring Wi-Fi networks along with location data, running ACR to fingerprint whatever is on screen across every input, and capturing clean microphone audio while the screen was — or appeared to be — powered down in standby. When disconnected from Ethernet the set kept storing voice input locally and uploaded it once reconnected. The data feeds LG Ad Solutions, which advertises reach to 363 million secondary addressable devices in the US alone. LG had not commented at the time of writing.
What the investigation actually found
Four distinct behaviours, each of which would be a story on its own. Network reconnaissance: packet captures showed the TV actively scanning the LAN for unrelated hardware — phones, watches, other devices — rather than only talking to the services it needs. Environmental mapping: the set gathered the SSIDs and signal strengths of nearby Wi-Fi networks, which together with location data is enough to place a household precisely and to infer neighbours. ACR: Automated Content Recognition samples on-screen audio and video into fingerprints and logs what you watch, including from HDMI inputs — a console, a laptop, a set-top box — not only the TV's own apps. Standby microphone capture: in bench tests the TV captured clean audio with the panel dark; voice prompts were logged in plain text; and with Ethernet unplugged the audio was stored locally and uploaded when the connection returned.
The last point is the one that changes the advice. Disconnecting the TV does not stop capture; it defers upload. The researchers' own recommendation was to keep LG sets off the internet permanently and use an external streaming device.
The 15-minute settings lockdown
Menu paths move between webOS versions, and LG has moved the ACR toggle three times. Use the Settings search if a path below does not match your firmware.
1. Turn off LivePlus (ACR)
webOS 23 and 24 (2024 through 2026 models): Settings → All Settings → General → System → Additional Settings → LivePlus → Off. webOS 22: General → Quick Start+. Pre-release webOS 25 builds nest it under a new Personalized Experience submenu. This is the setting that stops fingerprinting of HDMI inputs as well as apps.
2. Turn on Limit Ad Tracking
All Settings → General → Open Advertisements → Limit Ad Tracking on, and select Do Not Sell / Share where your region shows it.
3. Disable voice recognition
Settings → All Settings → General → AI Service → Voice Recognition, unchecked, unless you rely on the voice concierge. If the remote has a microphone button, this is the setting behind it.
4. Review every user agreement
Settings → All Settings → Support → About This TV → User Agreements. LG bundles consents, and webOS 24 added two new optional consents in April 2026 that default to opted-in. Decline everything that is not required for the TV to function; the set will tell you which ones are.
5. Check after every firmware update
Settings have been observed to move and, in some reports, to reset. Put a calendar reminder on the first of the month: search Settings for "LivePlus" and "Advertisements" and confirm.
Why the menu is not enough
Every setting above is a promise from the same software that was found capturing audio in standby. A toggle can be renamed, moved or reset by an update; the investigation's core finding is that the device's behaviour and its stated behaviour diverged. So treat the settings as a first layer and the network as the real control.
Option A — isolate the TV on its own segment
If your router supports VLANs or a guest network with client isolation, put the TV there alone. Client isolation stops it seeing your phones, laptops and watches, which removes the network-mapping behaviour outright. If you want the TV to reach the internet for its own apps but nothing else in your home, that is enough. Plan the ranges with the subnet calculator: a /26 for IoT is plenty.
Option B — block its WAN access and use an external streamer
The researchers' recommendation and ours for anything you cannot isolate. In the router, assign the TV a fixed IP and add a rule denying it outbound internet. Then plug in an Apple TV, a Chromecast, a Fire stick or a small PC over HDMI and use the TV as a panel. You lose LG's apps and keep everything else, and a device with no route out cannot upload what it recorded.
Option C — never connect it
If the TV has never been on your Wi-Fi it has never phoned home. New sets prompt hard for a connection during setup; skip it. The cost is losing firmware updates, which is a trade many people will take.
Samsung, Sony, Roku and the rest
The investigation was LG-specific and we are not extending its findings to other brands without evidence. What is documented across the industry is ACR: Samsung, Sony, Vizio and Roku all ship it under different names and all default it on. The network-isolation advice above applies to any smart TV regardless of brand, and it is the only measure that does not depend on trusting the vendor's menu.
How to verify the TV is actually isolated
Settings and router rules are claims. Verify them from a phone or laptop on your main network, then from the TV's segment, in about ten minutes.
# From a laptop on the main network: can you see the TV?
ping -c 3 192.168.20.15 # the TV's fixed IP on the IoT segment
# You WANT this to fail if you chose full isolation, or succeed only via
# the reverse proxy / cast port you deliberately allowed.
# From the IoT segment (a phone joined to it): can the TV's neighbours see your devices?
# Install a network scanner app, scan the segment: it should list ONLY the TV and the router.
# If you run Pi-hole or AdGuard Home: filter the query log by the TV's IP.
# With WAN blocked you should see attempts and no answers; that log is your evidence the block holds.
Repeat the third check a day after any TV firmware update. If the query log for the TV's address suddenly shows successful lookups to advertising or analytics domains, a rule was bypassed or reset and it is time to look at the router, not the TV menu.
One practical note for households that cast from phones: casting needs the phone and the TV to discover each other, which full isolation prevents. The usual compromise is a firewall rule that allows only the discovery and cast ports from the trusted segment to the TV's address, with everything else denied and the TV's own outbound internet still blocked. If your router cannot express that, an external streaming box on the trusted segment with the TV as a dumb panel gives you casting back without giving the TV a route out.
For the alerting side — a message when an isolated device suddenly resolves an outside domain — the Zapier Expert Workflow Builder prompts produce a working Pi-hole-to-phone alert in one sitting.
Quick answers
Does turning off LivePlus stop the microphone?
No. LivePlus is ACR — content fingerprinting. Voice Recognition under AI Service controls the microphone feature. Turn off both.
If I unplug the Ethernet, is the data gone?
The investigation found voice input was stored locally while offline and uploaded on reconnection. Disconnection defers, it does not delete.
Which LG models were tested?
Retail LG OLED models including the G5. The report suggests the behaviour reflects the webOS platform rather than a single model.
What did LG say?
Nothing at the time of writing.
If you manage screens for a small office or a shop, the same five settings and the same isolation apply, with one addition: write down which segment each display lives on and who owns the router rule, because the person who set it up will not be the person who notices when a firmware update quietly re-enables a consent. A one-line entry in the same document that holds your Wi-Fi passwords is enough.
Do the five settings now, then spend twenty minutes in your router putting the TV somewhere it cannot see your phones. If you run a small business with screens in the office, the same isolation applies and your privacy notice should say what those screens collect; our privacy policy generator guide covers the wording and the generator itself is free. For the router and monitoring automation — Uptime Kuma alerts when an isolated device suddenly reaches the internet — the n8n and Make.com Automation Architect prompts are where we started. Every product mentioned is available at wowhow.cloud — pay once, ship forever.
Originally published at wowhow.cloud
Top comments (0)