LG Calls Gamers Nexus Report 'Untrue,' Data Harvesting Deepens

LG officially dismissed Gamers Nexus's investigation findings as untrue, according to a statement received via third parties. The company denied the claims made in the video report, yet it provided no evidence to counter the findings. This initial response set a contentious tone for the ongoing discussion about smart TV data privacy and security.

LG subtly altered its privacy statement regarding ambient conversation collection by removing the word 'store' from its original phrasing. The initial statement affirmed that LG does not "collect, record, or store ambient conversations," but the revised version now states it "does not collect, record, or transmit ambient conversations." This quiet omission of the term 'store' occurred after the Gamers Nexus report was published, raising questions about the scope of data handling.

LG disputes voice recording allegations, claiming their far-field voice recognition feature requires manual activation by the user before the TV begins listening for a specific wake word like "Hi, LG." However, Gamers Nexus cited remote code execution vulnerabilities in its report, challenging the security of this feature and suggesting potential bypasses to the manual activation requirement.

Despite ongoing user interface complaints, LG commits to rejecting dark patterns, claiming it ensures users can choose their preferred privacy and consent options directly through their TV settings. However, Gamers Nexus documented several instances of deceptive practices, including pre-selected 'select all' checkboxes, hidden 'do not sell' options, and misleading cookie toggles. These examples suggest users often receive advertising IDs without explicit consent, contradicting LG's stated commitment to transparency.

LG explicitly mentioned Gamers Nexus in their response, stating that the claims made in the recently published video are "not true." Paradoxically, LG's statement later confirmed the very functionalities described in the report, creating confusion about the scope and nature of their denial.

Gamers Nexus, however, argues that industry prevalence does not validate the invasive nature of the collection. LG's argument also failed to address the specific security vulnerabilities raised in the report, shifting focus from the core issues.

LG's statement specifies that if a user does not consent to the applicable optional agreement, ACR data is not used for advertising purposes. However, this does not rule out other potential uses for the data. Gamers Nexus notes that LG has quietly dropped the term 'double opt-in' from its policies, moving towards broader language regarding user consent. The contract's terms also allow for data usage for inquiries beyond legal warrants and subpoenas, suggesting a wider scope of potential data sharing.

Gamers Nexus notes that years-old exploits remain applicable to current LG TVs. The response entirely omitted any mention of the security research reported to them, leaving critical questions unanswered about the protection of user data.

LG claims "proactive and continuous" security for its platform, asserting that data security is a top priority and that it continuously monitors its platform and partners with independent security experts to identify vulnerabilities and deliver timely updates. However, Gamers Nexus points out past vulnerabilities like residential proxy issues in webOS, which contradict these claims. BitDefender previously identified root access vulnerabilities on LG TVs, and multiple CVEs (2022-6317 to 2022-6320) revealed bypasses and remote access flaws, indicating a history of security shortcomings.

LG claims commitment to transparency and rejecting deceptive practices, stating that users can choose their own preferred privacy and consent options directly through their TV settings. However, Gamers Nexus argues this commitment is undermined by instances like the forced installation of monitor apps and McAfee adware via Windows Update. These practices severely question LG's credibility regarding user consent following recent investigative reports.

Researcher U-Turn discovered that this data includes city, state, street, zip code, and latitude/longitude. The TVs perform Wi-Fi scans to approximate location and link it with audio fingerprinting. Telemetry is sent 20 times per minute while audio is detected on HDMI, demonstrating an aggressive level of tracking.

Gamers Nexus notes that while LG collects BSSID and Wi-Fi data from consumer devices, which can pinpoint physical locations, LG's own headquarters obscure their BSSIDs from public visibility. This practice highlights a double standard, where LG collects sensitive location-linked information from its users but keeps its own BSSIDs private. This suggests that LG may be aware of the sensitive nature of the information it collects from everyone else.

The investigative scope may extend to acts not currently illegal but potentially criminalized by future laws. This means consumer consent covers broad monitoring of device activity, encompassing a wide range of behaviors that users might not anticipate.

Vincent Agosta explains that LG distinguishes between judicial warrants and general inquiries or investigations. Once data is voluntarily shared with a company, it is no longer considered private, meaning consumers lose significant privacy safeguards.

The presence of multiple, coexisting legal documents, often in different forms, makes it unclear which terms control a device, creating significant consumer confusion. The legal notice directs users to the TV itself for the most up-to-date agreement, further complicating the process. These terms are also subject to change through unilateral updates, which Agosta describes as a "death by a thousand cuts" for consumers trying to understand their rights and obligations.

Vincent Agosta believes that addressing data privacy issues primarily requires policy-making through legislative acts, rather than relying on the flawed 'check-the-box' contract model. He suggests that economic pressure may drive companies toward stricter compliance standards, making it more sensible for them to comply with the most restrictive regulations in many situations. Direct legislative action and constituent engagement are essential, as the option to 'not buy a smart TV' is becoming an increasingly narrow choice for consumers.