The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking

Abstract

In this paper, we present a large-scale measurement study of the smart TV advertising and tracking ecosystem. First, we illuminate the network behavior of smart TVs as used in the wild by analyzing network traffic collected from residential gateways. We find that smart TVs connect to well-known and platform-specific advertising and tracking services (ATSes). Second, we design and implement software tools that systematically explore and collect traffic from the top-1000 apps on two popular smart TV platforms, Roku and Amazon Fire TV. We discover that a subset of apps communicate with a large number of ATSes, and that some ATS organizations only appear on certain platforms, showing a possible segmentation of the smart TV ATS ecosystem across platforms. Third, we evaluate the (in)effectiveness of DNS-based blocklists in preventing smart TVs from accessing ATSes. We highlight that even smart TV-specific blocklists suffer from missed ads and incur functionality breakage. Finally, we examine our Roku and Fire TV datasets for exposure of personally identifiable information (PII) and find that hundreds of apps exfiltrate PII to third parties and platform domains. We also find evidence that some apps send the advertising ID alongside static PII values, effectively eliminating the user’s ability to opt out of ad personalization.

How Can and Would People Protect From Online Tracking?

“…We envision that user privacy will become significantly concerning on other platforms such as mobile websites and apps and IoT devices as recognised by previous research [50,78]. Some efforts have been recently made for app privacy by companies such as Apple and Google.…”

“…In addition to human dimensions, some of these studies cover a wide range of other topics including tracking activities [16,39,46,63,76], tracking on mobile and other smart devices [13,34,52,59,60,78], legal aspects [46,64], and cross-platform evaluations [50,59,82]. Various forms of analysis have been performed via different case-studies [31,53,77], mainly concerning the consent notice as the main route of the opt-out and for particular forms of PETs (e.g.…”

Blocking Without Breaking: Identification and Mitigation of Non-Essential IoT Traffic

“…For the case of video devices, some of the nonrequired destinations are advertisers while others are related to video recommendations for pre-installed apps, a topic we discuss in §7.2. Note that these destinations are not from background app activity, since it is disallowed for the Roku TV [4,11], and we disabled background app activity on the Fire TV [12]. Regarding the cameras and other simpler devices, it is unclear why they produce non-essential traffic without the internal details of the devices and their software.…”

“…In this analysis we use the blocklists considered by Varmarken et. al [4], who evaluated the effectiveness of DNS-based blocklists to prevent smart TVs from accessing advertising and tracking service domains. In particular, they consider the most relevant blocklists to smart TVs (actively managed), which are Pi-hole Default [15], the Firebog [16], Mother of all Ad-Blocking (MoaAB) [17], and StopAd [18].…”

“…are rapidly gaining presence in homes, offices, and public spaces [1]. While these devices often come with convenient services, they open the door to numerous privacy and security risks [2][3][4]. These devices often expose information to a large number of destinations [2,5], including third party advertising and tracking services.…”