Loading story…
Samsung reached a settlement with the Texas Attorney General to resolve allegations that its smart TVs collected and processed Automated Content Recognition (ACR) viewing data without Texans’ express, informed consent. Texas alleged Samsung’s ACR-based Viewing Information Services (VIS) captured viewing behavior (including claims it could capture on-screen content) and used it for targeted advertising, and a court initially found “good cause to believe” consumers were automatically enrolled via dark patterns that made privacy disclosures difficult to review.
Under the agreement, Samsung will revise privacy disclosures and implement clear, conspicuous disclosure and consent screens so consumers can make an informed choice about data collection and use; Samsung said it does not concede wrongdoing and maintains its prior notices complied with state regulations, while emphasizing it does not “spy” on customers. Texas’s broader litigation against other smart TV manufacturers—Sony, LG, Hisense, and TCL—remains ongoing.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
During the litigation, Texas briefly secured a temporary restraining order citing likely violations tied to Samsung's smart TV data collection and enrollment practices. The order was later vacated.
As part of the settlement, Samsung agreed to promptly update its smart TVs with clearer, more conspicuous privacy disclosures and consent screens so Texas consumers can make informed choices about ACR data collection and use. Related lawsuits against Sony, LG, Hisense, and TCL remained ongoing.
Samsung reached a settlement with the State of Texas requiring it to stop collecting or processing ACR viewing data from Texas consumers without express consent. Samsung said it did not agree that its prior practices violated regulations but agreed to enhance disclosures and consent mechanisms.
In December 2025, Texas filed lawsuits alleging that Samsung and other major smart TV manufacturers collected and processed consumers' Automated Content Recognition viewing data without fully informing users or obtaining valid consent. The state also alleged the companies used dark patterns and violated the Texas Deceptive Trade Practices Act.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Texas Attorney General has filed lawsuits against five leading smart TV manufacturers—Samsung, LG, Sony, Hisense, and TCL—alleging that their devices unlawfully collect and transmit users' personal data without consent. The lawsuits claim that these companies use Automated Content Recognition (ACR) technology to capture screenshots of what users are watching every 500 milliseconds, monitor viewing activity in real time, and send this information back to company servers. The data is then allegedly sold for targeted advertising purposes, raising significant privacy concerns, especially regarding sensitive information such as passwords and banking details that could be exposed. Texas is seeking damages under the Texas Deceptive Trade Practices Act, including up to $10,000 per violation and higher penalties for violations affecting seniors. The state also wants restraining orders to halt the collection, sharing, and selling of ACR data while the lawsuits proceed. Additional concerns have been raised about the potential for Chinese companies Hisense and TCL to be compelled to share U.S. consumer data with the Chinese government under China's National Security Law. The lawsuits emphasize that the collection of ACR data for advertising does not meet a consumer-necessity standard and constitutes an invasive breach of privacy.
Jun 29, 2026
A range of legal and technical measures are being taken to counter the use and abuse of surveillance and data collection technologies by both government agencies and private corporations. In the United States, privacy advocates and hackers are developing counter-surveillance tools to disrupt automated license plate readers (ALPRs) operated by companies like Flock, which supply footage to law enforcement agencies including ICE. These efforts include adversarial license plate overlays that confuse AI recognition systems and open source mapping of ALPR networks. Additionally, a significant security lapse was discovered in Flock's infrastructure, exposing live camera feeds and logs due to misconfigured, publicly accessible admin interfaces. Legal action is also underway, with organizations like the EFF and ACLU suing municipalities over alleged abuses of surveillance technology. In Texas, a court has issued a temporary restraining order against Samsung, prohibiting the company from collecting smart TV viewing data from consumers without proper consent. The court found Samsung's Automated Content Recognition (ACR) practices deceptive, highlighting concerns about undisclosed data collection and potential access by foreign entities such as the Chinese government. The ruling underscores growing legal scrutiny of pervasive data collection by technology vendors and the opaque enrollment processes that mislead consumers about the extent and use of their personal information. These developments reflect increasing resistance—both technical and legal—to the expansion of surveillance and data harvesting technologies in the US.
Jun 29, 2026
Florida Attorney General James Uthmeier has initiated legal action against Roku, a leading smart TV company, alleging that the firm collected and sold sensitive personal data belonging to children without proper notice or parental consent. The lawsuit, filed in Collier County Circuit Court, accuses Roku of violating Florida's Deceptive and Unfair Trade Practices Act and the state's Digital Bill of Rights. According to the complaint, Roku gathered a range of sensitive information, including children's online activity, viewing histories, location data, and voice recordings. The data was allegedly sold to third-party data brokers such as Kochava, which is itself under federal scrutiny for its handling of geolocation data, as well as to advertisers. The Attorney General's office claims that Roku failed to implement industry-standard user profiles or age verification mechanisms, despite knowing that a significant portion of its users are children. The complaint highlights that Roku's technology is present in about half of American households, reaching approximately 145 million people as of 2024, amplifying the potential scale of the alleged privacy violations. The state asserts that Roku continued to process and sell children's data even when users signaled their status as children by subscribing to kids-oriented programming and features. Furthermore, the lawsuit alleges that Roku misled consumers about the effectiveness of its privacy controls and opt-out tools, giving users a false sense of security regarding their data privacy. The Attorney General's Office of Parental Rights is seeking civil penalties, injunctive relief, and the implementation of stronger disclosure and parental-control mechanisms. The complaint also notes that four of the five most searched programs on Roku in 2024 were children's entertainment, yet the company did not take adequate steps to determine if users whose data was being sold were minors. The legal action underscores growing regulatory scrutiny over the handling of children's data by technology companies. Roku has not yet publicly responded to the allegations. The case brings attention to the broader issue of data privacy for minors in the digital age, especially as connected devices become more prevalent in households. The involvement of data brokers like Kochava, already facing federal action, adds another layer of complexity to the case. The outcome of this lawsuit could set important precedents for how companies collect, process, and monetize children's data in the future. The case also highlights the challenges regulators face in enforcing privacy protections in rapidly evolving technology ecosystems. If successful, the lawsuit may prompt other states to pursue similar actions against technology firms. The proceedings will be closely watched by privacy advocates, industry stakeholders, and policymakers concerned with children's online safety.
Jul 12, 2026