What did researchers find LG smart TVs doing with the screen off?

Gamers Nexus, with Level1Techs and independent researchers, found retail LG OLED G5 TVs capturing clean microphone audio in standby mode. When disconnected from the network, the TV stored the audio locally and uploaded it once connectivity was restored.

Does Pi-hole block LG TV telemetry?

Not fully. Level1Techs documented that LG webOS firmware falls back to hardcoded IP addresses, so DNS-based blocking (Pi-hole) can block domains but not those direct endpoints. The documented recommendation is to keep the TV offline and use it as a dumb display.

LG Smart TV Audio Logging: Screen Off, Mic On

Q: How many devices does LG's ad division track through smart TVs?

LG claims about 216 million smart TV sales globally, while LG Ad Solutions claims access to 363 million secondary addressable devices in the US alone — discovered by scanning the local network and neighboring Wi-Fi networks.

It already happened. A 135-minute investigation from Gamers Nexus, working with Level1Techs and independent researchers, put retail LG OLED G5 sets on a bench with Wireshark and found the TV capturing clean microphone audio in standby — buffering it locally when the Ethernet was pulled, and uploading it the moment the network came back. The thread hit 936 points and 440+ comments on Hacker News in under a day. The standard "just unplug it" advice is now a documented failure mode, not a defense.

The 363-million-device multiplier

Here's the number that reframes the whole story. LG claims roughly 216 million smart TV sales globally. Its ad division, LG Ad Solutions, claims access to 363 million secondary addressable devices in the US alone — phones, smartwatches, anything discovered by scanning the local network and neighboring Wi-Fi names. That's a 1.7x device-graph multiplier per TV. The screen isn't the product; it's the anchor node for a home-network-wide identity graph. The set also harvests neighboring Wi-Fi SSIDs and RSSI, which means coarse location without GPS. Nothing here was authorized by the people on the couch.

Why blocking fails — seven channels, read-only hosts

Wendell's companion write-up on Level1Techs catalogs seven independent phone-home channels in webOS 10.2.1: OS updates, telemetry, ACR, ads (beaconing to info.lgsmartad.com roughly every 60 seconds), ThinQ IoT, an LLM/AI platform process reaching ngfts.lge.com, and crash uploads. The technical receipts matter: /etc/hosts sits on a read-only overlay, the kernel ships without netfilter modules so iptables is a no-op, and the firmware falls back to hardcoded IPs. That last one defeats Pi-hole-style DNS blocking outright — you can block the domain, not the address. The researchers' own recommendation, after rooting and dissecting the thing: disconnect it and use the panel as a dumb display. Notably, the team also found RCE vulnerabilities in webOS now in responsible disclosure, so the mic is the least of it.

Verdict: don't wait for LG's comment or a GDPR class action. The unplug-and-add-an-Apple-TV playbook went from paranoia to the vendor-neutral consensus overnight. Treat every "smart" TV in the house as an open microphone with a network stack attached, because that's what the packet captures show.

The 363-million-device multiplier

Why blocking fails — seven channels, read-only hosts

Related