LG Smart TVs Caught Logging Audio and Scanning Local Networks in Standby

On September 7, 2026, independent security researchers from Gamers Nexus and Level1Techs published comprehensive network packet captures demonstrating that LG smart televisions actively record microphone audio and map local area networks while the screen is powered down in standby mode. This discovery fundamentally challenges the consumer expectation that a dark screen equates to an inactive device, exposing a persistent data collection mechanism that operates entirely in the background without clear visual indicators. The findings have sparked immediate backlash among privacy advocates, as the televisions appear to harvest sensitive household telemetry regardless of whether the user is actively engaging with the display.[1][2]

The sweeping 135-minute investigation revealed that the televisions, specifically retail models like the LG G5 OLED, do not fully sleep when turned off by the user. Instead, the built-in microphones continue to capture ambient audio, saving voice prompts locally in plain text. Hardware analysts utilized network monitoring tools to observe the exact behavior of the webOS operating system during these standby periods, confirming that the hardware remains highly active. The lack of a physical microphone disconnect switch means that users have no hardware-level guarantee that the device has stopped listening to its surroundings.[1][3]

If the television is disconnected from Ethernet or Wi-Fi, the data collection does not simply stop. The sets are programmed to buffer the audio files on their local storage drives and automatically upload the encrypted data to LG's servers the moment internet connectivity is restored, effectively bridging the gap between the 2 network states. This offline buffering capability indicates that the data harvesting is a core function of the operating system rather than a passive feature that only operates when a live connection to the manufacturer's servers is available.[1][2]

Beyond audio capture, the researchers used Wireshark to monitor the webOS operating system's broader network traffic. They found that the televisions continuously sweep the local area network to identify unrelated hardware, logging the internal IP addresses of smartphones, smartwatches, printers, and other connected home devices that happen to share the same router. This aggressive internal scanning treats the television not just as a display, but as a network discovery node that catalogs every piece of electronics operating within the household's private local area network.[1][3]

The sets also catalog the names and signal strengths of neighboring Wi-Fi networks. Combined with geolocation data, this scanning allows the manufacturer to build a precise, continuously updated map of the television's physical environment and the secondary devices operating within it. By measuring the signal degradation of nearby routers, the telemetry can theoretically pinpoint the television's exact location within a building, creating a spatial footprint that extends well beyond the living room walls and into the homes of immediate neighbors.[2][3]

The scope of this data collection is vast. LG claims to have sold approximately 216 million to 220 million smart televisions globally over the past 10 years. Meanwhile, its targeted advertising arm, LG Ad Solutions, states it has access to 363 million secondary addressable devices in the United States alone. This massive discrepancy is achieved precisely by tracking other hardware on the same network and routing that telemetry to 3rd-party advertisers, effectively turning a single television purchase into a household-wide surveillance node for the company's advertising partners.[1][2]

While LG markets these features under the umbrella of Automatic Content Recognition to improve viewing recommendations and serve targeted ads, the reality of the data sweep extends far beyond on-screen content. LG previously told reporters that its televisions "do not collect, record, or store ambient conversations," a claim that the new packet captures directly contradict. The disparity between the manufacturer's public privacy assurances and the documented behavior of the webOS software has prompted calls for regulatory investigations into deceptive data practices in the consumer electronics sector.[3][4]

The investigation also uncovered remote code execution vulnerabilities within the webOS platform. While these flaws are currently moving through the responsible disclosure process and there is currently 0 public evidence of active exploitation, security analysts warn that a compromised television could serve as a dangerous foothold for attackers. Because the television already maps the internal network and identifies vulnerable secondary devices, an attacker who gains control of the display could theoretically pivot to compromise smartphones, personal computers, or smart home security systems operating on the same Wi-Fi network.[2][3]

Because the data collection bypasses standard privacy toggles in the settings menu, researchers concluded that software opt-outs are entirely insufficient for users seeking genuine privacy. Disabling voice assistants or declining user agreements does not halt the underlying network sweeps or the standby microphone buffering. Their primary recommendation is to physically disconnect the television from the internet—removing the Ethernet cable and deleting saved Wi-Fi credentials from the system entirely—and rely on 1 external streaming device via HDMI instead to regain control over network traffic.[1][2][3]