LG Smart TVs Logging Audio Off: Small Business Privacy

If your waiting room or conference table has a shiny new display, LG smart TVs privacy is not a living-room story anymore. Independent testers this week showed retail LG OLED sets scanning the local network for phones and watches, and capturing microphone audio while the screen looked powered down.

That matters in Bradenton and Sarasota because small business owners treat the TV like furniture. It sits on the guest Wi-Fi, plays a loop of reviews, and nobody thinks about the microphone. The new research says the set can keep working after you “turn it off,” store voice locally if you cut the internet, and upload later. That is a privacy and network problem sitting in the same room as client conversations.

What happened

Researchers at Gamers Nexus, working with Level1Techs and outside security testers, put retail LG OLED models — including the current G5 line — on a bench and watched the traffic. Packet captures showed the TVs sweeping the local network for devices that have nothing to do with watching a show: phones, watches, printers, and other gear on the same Wi-Fi.

They also recorded neighboring Wi-Fi names and signal strength, plus location-related data. LG’s advertising arm, LG Ad Solutions, markets access to hundreds of millions of “secondary” devices in the United States by watching what else shares a network with the TV. LG says it has sold on the order of 216 million smart TVs worldwide. The advertising story and the lab results line up in an uncomfortable way: the TV is a sensor, not just a screen.

Automated Content Recognition (ACR) fingerprints on-screen audio and video so the vendor can log what is playing, even from an HDMI stick. That is old news. The new testing goes further. Testers captured clean microphone audio while the display was dark in standby. When they unplugged the network, the TV kept saving voice input locally and sent the stored files once the connection came back.

Voice prompts also showed up in system logs as plain text. In one demonstration, speech after a voice-assistant command — including a fake Social Security number spoken as a test — was stored. Researchers separately reported remote-code-execution bugs in webOS that are still in responsible disclosure, which is a polite way of saying “do not assume the TV is a dumb appliance.” LG had not issued a public response when the first write-ups landed.

The Hacker News thread on the NotebookCheck report climbed past 500 points within hours.

How it affects your business

A dental office in Sarasota with an LG panel in the consult room is not “watching Netflix.” Staff talk about treatment plans two feet from the set. A law firm in Bradenton uses the same wall for Zoom and settlement numbers. A gym, salon, or realtor loops ads while front-desk phones sit on the same guest network. If the TV maps those phones and watches, your guest Wi-Fi just became a device inventory for a vendor you never signed a business-associate agreement with.

Three practical risks show up in a small office:

1. Conversations you thought were off-camera. Standby is not “off.” If the microphone can hear a hallway or a closed-door meeting, you now have a recording surface you did not budget for. Healthcare, legal, finance, and any shop that handles children’s or employee data should treat that as a policy issue, not a gadget quirk.

2. A map of your other devices. Names, internal addresses, and nearby network names help an attacker who later compromises the TV — or anyone who receives the advertising data trail. Guest phones and staff watches were visible in the lab even when the owners did not know a test was running.

3. Data that waits for the internet. Unplugging the TV for “privacy” is not enough if the set caches audio and ships it later.

This is also a segmentation problem. Many local offices put the TV, the front-desk PC, the camera NVR, and the owner’s laptop on one flat network because the consumer router made that easy. A TV that scans the LAN is then scanning everything you care about.

CISA’s guidance on connected devices is blunt: know what is on the network, change default settings, and isolate gadgets that do not need to talk to business systems. A conference-room display is exactly that class of device.

What to do

You do not need to throw the TV in the dumpster. You do need to treat it like a computer with a microphone.

Pull it off the business LAN. Put every smart display on a guest or IoT VLAN that cannot reach file servers, cameras, or staff laptops. If your current router cannot do that, that is a network project, not a TV project. Our cybersecurity starting point for Sarasota shops begins with the same idea: identity and network layout beat shiny boxes.

Prefer “really off” over standby. Use the physical power switch or a cheap switched outlet strip for rooms where people talk about clients. Standby is convenient. It is also when the testers captured audio.

Turn off ACR, voice, and live-plus advertising options. In LG menus that usually lives under settings for general, support, or “general → additional settings / live plus / privacy.” Names move around by firmware year. Walk the menus once, screenshot what you changed, and do it again after a firmware update. Updates love to re-enable “features.”

Use an external streamer you control — or no apps on the TV. The researchers’ blunt advice was to disconnect the LG set from the internet and feed it from a separate Apple TV, Fire TV, or similar box that you can lock down. For a lobby loop, a cheap player with no mic is often enough.

Cover or disable the mic if the model allows it. Some sets do not offer a true hardware mute. If you cannot kill the mic, do not put that panel in a room used for private consults.

Write a one-page rule. “No smart TV on the staff network. No voice assistant in rooms used for client conversations. Power strip off when the room is used for private meetings.” That is enough policy for a 10-person office.

If you want a second pair of eyes on the guest Wi-Fi, VLAN layout, or which displays should stay offline, get in touch. We will walk the room, not sell you a new panel.

---

Source: Hacker News discussion of NotebookCheck’s report on Gamers Nexus testing. Original investigation: Gamers Nexus video.