User:Louis/Smart TV ACR study and hackathon report
The two documents below are the sources for Louis Rossmann's video on smart TV automatic content recognition (ACR) tracking.
Watching the Watchers
[edit | edit source]Ilgar Mammadov, Het Rutul Joshi, Daniel J. Dubois, David Choffnes (2026). Watching the Watchers: Privacy Analysis of U.S. Smart TV Automatic Content Recognition. Northeastern University. Original.
What Smart TVs Send
[edit | edit source]Kevin O'Reilly (October 29, 2026). What Smart TVs Send: Findings from an ACR Hackathon. FULU. Original.
Hackathon teams:
- LG: Atharva Keskar
- Vizio: Jackson Hyder, Ajin Frank, Atharva Keskar, Abhay Korti
- Hisense: Will Sergeant, Kyei Sin Nandar Tun, Gaurang Karpe
ACR endpoint blocklist
[edit | edit source]The Northeastern authors released a blocklist of the ACR servers they identified, as the file Blocklist.txt in their GitHub repository (direct download: raw file).[1] The paper advises turning ACR off in the TV's settings on webOS (LG), Fire OS (Amazon), Google TV (Sony) and VIDAA OS, where the opt-out worked in the authors' tests, and using the blocklist on the other systems, where it did not.[2] The authors ran a prototype of the blocklist in their lab and found that blocking these servers did not break TV functions or streaming quality in the scenarios they tested.[2]
The list covers these TVs:[2]
| Operating system | ACR company | Rule to block |
|---|---|---|
| Tizen (Samsung) | Samsung | *.samsungcloud.tv, *.samsungacr.com
|
| webOS (LG) | Alphonso | *.alphonso.tv
|
| Roku OS (Roku, TCL) | Roku | scribe.logs.roku.com
|
| Google TV (Sony) | Samba TV | *.samba.tv, plus the IP address 216.183.117.80 at the router
|
| Fire OS (Amazon) | Amazon | gateway-ink.amazon.com
|
| SmartCast (Vizio) | Inscape | *.tvinteractive.tv
|
| VIDAA OS (Supersonic) | Nexxen/Unruly | *.acr.unruly.co
|
| Xumo OS (Westinghouse) | none observed | none |
How to use the blocklist
[edit | edit source]The blocklist works on a DNS filter that the TV uses for its lookups, such as Pi-hole or AdGuard Home on the home network, or on a router or firewall.[1]
- Pi-hole: add the raw file URL above as a blocklist (adlist), then update gravity. Pi-hole reads the exact
0.0.0.0host lines in the file.[1] The file lists the wildcard rules only as comments, and Alphonso and Unruly rotate through numbered servers, so also add these regex blacklist entries to catch every server under each domain:[1][3]
(\.|^)samsungcloud\.tv$ (\.|^)samsungacr\.com$ (\.|^)alphonso\.tv$ (\.|^)samba\.tv$ (\.|^)tvinteractive\.tv$ (\.|^)acr\.unruly\.co$
- AdGuard Home: add the raw file URL as a custom DNS blocklist. AdGuard Home also accepts wildcard rules; add these as custom filtering rules, where
||example.org^blocks a domain and all of its subdomains:[1][4]
||samsungcloud.tv^ ||samsungacr.com^ ||alphonso.tv^ ||samba.tv^ ||tvinteractive.tv^ ||acr.unruly.co^
- A hosts file: copy the
0.0.0.0lines from the file. A hosts file cannot hold wildcards, so it only blocks the exact servers listed.[1] - A router or firewall: block the domains above, and block the Samba TV address
216.183.117.80there, because Samba TV contacts it directly without a DNS lookup.[1]
Limits of the blocklist
[edit | edit source]- Sony's Google TV sets use DNS over HTTPS, so blocking the Samba TV domains on a DNS filter may not work on them.[1]
- Vizio's ACR traffic goes to
kinesis.us-west-2.amazonaws.com, a shared Amazon Web Services server. The recommended list leaves it out because blocking it may break unrelated services, and blocks Vizio's Inscape control servers instead.[2][1] In the FULU hackathon, a Vizio TV's ACR stream switched partway through a session to a new server that the TV never looked up by name; the report says a blocklist that filters by domain name would not catch it.[5] - Neither the TV settings nor the blocklist stops the Amagi channel, which sends the names of programs watched on free streaming (FAST) channels in plain DNS lookups. Blocking
*.amagi.tvstops those channels from playing, so the list leaves it off.[2][1] - ACR companies change their server names over time, so the wildcard and domain rules last longer than the exact host lines.[1]
- Disconnecting the TV from the internet, and using an external streaming device that does not perform ACR, avoids ACR entirely.[2]
Blocklist file
[edit | edit source]The text of Blocklist.txt as published by Ilgar Mammadov, Het Rutul Joshi, Daniel J. Dubois and David Choffnes on September 13, 2026, reproduced unmodified under the CC BY-NC-ND 4.0 license. Use the raw file for the current version.[1]
# ============================================================================= # PrivACR ACR Blocklist # Smart-TV Automatic Content Recognition (ACR) endpoints # ============================================================================= # # Source: "Watching the Watchers: Privacy Analysis of U.S. Smart TV # Automatic Content Recognition" # # Covers the second-party ACR endpoints validated across the eight dominant # U.S. smart-TV operating systems (~95% market). Blocking these domains # suppresses ACR viewing-history collection at the network layer, including # on platforms where the on-device opt-out is ineffective (e.g. Samsung # Tizen, Vizio SmartCast). # # HOW TO USE # Pi-hole / AdGuard Home : add this file as a custom blocklist (URL or # local import). Wildcards work in AdGuard Home; # for Pi-hole use the regex/exact entries. # /etc/hosts : use the 0.0.0.0 lines below (exact hosts only; # hosts files do not support wildcards). # Router / firewall : block the second-level domains listed. # # IMPORTANT CAVEATS # * Blocking ACR domains may disable "enhanced viewing" / content-based # recommendation features, but does NOT affect normal streaming/playback. # * The Amagi cleartext-DNS viewing-history leak (see bottom section) is # delivered over the SAME hostnames used for First-Party (FAST) channel # delivery. Blocking it BREAKS free streaming. It is listed separately # and is OFF by the recommendation; an OS-side fix is required. # * ACR operators rotate endpoints. Second-level-domain / wildcard rules # are more durable than the point-in-time exact hostnames. # # Confidence tiers: # [VALIDATED] endpoint confirmed by the paper's four-indicator methodology # [SUSPECTED] strong supporting evidence, no payload-level confirmation # ============================================================================= # ----------------------------------------------------------------------------- # SAMSUNG - Tizen OS (Samsung-operated ACR) [VALIDATED] # Video-based ACR. On-device opt-out FAILS in >60% of in-scope scenarios, # so network-layer blocking is the only reliable suppression. # ----------------------------------------------------------------------------- 0.0.0.0 acr-us-prd.samsungcloud.tv 0.0.0.0 log-ingestion.samsungacr.com 0.0.0.0 log-config.samsungacr.com # ----------------------------------------------------------------------------- # LG - webOS (Alphonso ACR) [VALIDATED] # Audio-based ACR. On-device opt-out is fully effective, but blocking adds # defense-in-depth. Alphonso rotates through numbered tkacrNNN hosts, so a # wildcard is strongly preferred over the exact list below. # Wildcard: *.alphonso.tv # ----------------------------------------------------------------------------- 0.0.0.0 tkacr324.alphonso.tv 0.0.0.0 tkacr474.alphonso.tv 0.0.0.0 tkacr534.alphonso.tv 0.0.0.0 tkacr535.alphonso.tv 0.0.0.0 tkacr573.alphonso.tv 0.0.0.0 tkacr574.alphonso.tv 0.0.0.0 tkacr620.alphonso.tv 0.0.0.0 tkacr621.alphonso.tv 0.0.0.0 tkacr622.alphonso.tv 0.0.0.0 tkacr623.alphonso.tv 0.0.0.0 tkacr625.alphonso.tv 0.0.0.0 tkacr626.alphonso.tv 0.0.0.0 tkacr627.alphonso.tv 0.0.0.0 tkacr629.alphonso.tv 0.0.0.0 tkacr633.alphonso.tv 0.0.0.0 tkacr637.alphonso.tv 0.0.0.0 tkacr640.alphonso.tv 0.0.0.0 tkacr641.alphonso.tv 0.0.0.0 tkacr645.alphonso.tv 0.0.0.0 tkacr646.alphonso.tv 0.0.0.0 tkacr647.alphonso.tv 0.0.0.0 tkacr648.alphonso.tv 0.0.0.0 tkacr673.alphonso.tv 0.0.0.0 tkacr718.alphonso.tv 0.0.0.0 tkacr719.alphonso.tv 0.0.0.0 tkacr725.alphonso.tv 0.0.0.0 tkacr727.alphonso.tv 0.0.0.0 tkacr728.alphonso.tv 0.0.0.0 tkacr730.alphonso.tv 0.0.0.0 tkacr733.alphonso.tv 0.0.0.0 tkacr734.alphonso.tv 0.0.0.0 tkacr742.alphonso.tv 0.0.0.0 tkacr749.alphonso.tv 0.0.0.0 tkacr750.alphonso.tv 0.0.0.0 tkacr751.alphonso.tv 0.0.0.0 tkacr752.alphonso.tv 0.0.0.0 tkacr753.alphonso.tv 0.0.0.0 tkacr755.alphonso.tv 0.0.0.0 tkacr756.alphonso.tv 0.0.0.0 tkacr758.alphonso.tv 0.0.0.0 tkacr759.alphonso.tv 0.0.0.0 bl-server.alphonso.tv 0.0.0.0 prov-lg.alphonso.tv 0.0.0.0 clockskew.alphonso.tv # ----------------------------------------------------------------------------- # ROKU / TCL-Roku - Roku OS (Roku-operated ACR) [VALIDATED] # Single shared endpoint for both Roku- and TCL-branded Roku TVs. # Note: opt-out does NOT stop first-party (Roku Channels) ACR; blocking does. # ----------------------------------------------------------------------------- 0.0.0.0 scribe.logs.roku.com # ----------------------------------------------------------------------------- # SONY - Google TV (Samba TV ACR) [VALIDATED] # On Bravia N-series. Samba also uses a hardcoded IP (216.183.117.80) that # bypasses DNS-based blocking; block it at the firewall/router layer too. # Please note, that these domains provided are only for completeness and that # Sony uses DNS over HTTPS. Hence, blocking these might be ineffective. # Wildcard: *.samba.tv # ----------------------------------------------------------------------------- 0.0.0.0 api.cid.samba.tv 0.0.0.0 dpn.cid.samba.tv 0.0.0.0 events.cid.samba.tv 0.0.0.0 fling.cid.samba.tv 0.0.0.0 platform.cid.samba.tv 0.0.0.0 preferences.cid.samba.tv 0.0.0.0 cdn.tvp.samba.tv 0.0.0.0 manager.tvp.samba.tv 0.0.0.0 pixel.mtrcs.samba.tv # IP (firewall-layer only; not enforceable via hosts/DNS): # 216.183.117.80 # ----------------------------------------------------------------------------- # AMAZON FIRE TV - Fire OS (Amazon-operated ACR) [VALIDATED] # On-device opt-out is fully effective. Gateway host below. # ----------------------------------------------------------------------------- 0.0.0.0 gateway-ink.amazon.com # ----------------------------------------------------------------------------- # SUPERSONIC - VIDAA OS (Nexxen / Unruly ACR) [VALIDATED] # Audio-based ACR over UNENCRYPTED MQTT (vulnerable broker; see paper). # Rotates through numbered fp.us hosts. # Wildcard: *.acr.unruly.co # ----------------------------------------------------------------------------- 0.0.0.0 16.fp.us.acr.unruly.co 0.0.0.0 40.fp.us.acr.unruly.co 0.0.0.0 acr.unruly.co # ----------------------------------------------------------------------------- # VIZIO - SmartCast OS (Inscape ACR) [SUSPECTED] # Content-correlated traffic to a Kinesis endpoint continues in 100% of # opted-out scenarios. Payload not inspectable, so classified suspected. # WARNING: kinesis.us-west-2.amazonaws.com is shared AWS infrastructure. # Blocking the bare Kinesis host may break unrelated services; prefer the # Inscape control domains below and apply the Kinesis rule with care. # ----------------------------------------------------------------------------- 0.0.0.0 control2.tvinteractive.tv 0.0.0.0 control-zoo-default.tvinteractive.tv 0.0.0.0 users.tvinteractive.tv # Shared infra (block only if you understand the trade-off): # 0.0.0.0 kinesis.us-west-2.amazonaws.com # ============================================================================= # OPTIONAL / NOT RECOMMENDED BY DEFAULT # Amagi cleartext viewing-history channel (Xumo, SmartCast, Roku, Fire OS) # # Program titles leak in plaintext DNS/SNI on the FAST delivery path, # independent of ACR opt-out. These hostnames ALSO deliver the free # streaming content, so blocking them breaks First-Party / FAST streaming. # No safe client-side fix exists; included for completeness only. # # # 0.0.0.0 *.amagi.tv (wildcard; AdGuard Home only) # =============================================================================
References
[edit | edit source]- ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 1.11 Ilgar Mammadov, Het Rutul Joshi, Daniel J. Dubois, David Choffnes (2026-09-13). "Blocklist.txt". GitHub. Retrieved 2026-11-12.
{{cite web}}: CS1 maint: multiple names: authors list (link) - ↑ 2.0 2.1 2.2 2.3 2.4 2.5 Ilgar Mammadov, Het Rutul Joshi, Daniel J. Dubois, David Choffnes (2026). "Watching the Watchers: Privacy Analysis of U.S. Smart TV Automatic Content Recognition" (PDF). Northeastern University. Retrieved 2026-11-12.
{{cite web}}: CS1 maint: multiple names: authors list (link) - ↑ "Regex tutorial". Pi-hole. Retrieved 2026-11-12.
- ↑ "How to create your own DNS filters". AdGuard. Retrieved 2026-11-12.
- ↑ Kevin O'Reilly (2026-10-29). "What Smart TVs Send: Findings from an ACR Hackathon". FULU. Retrieved 2026-11-12.