Smart TV privacy: switch off ad tracking and keep it updated

What can a smart TV share about you?

France's data protection authority, the CNIL, lists what a connected TV can collect: the programmes you watch, on ordinary channels as well as on demand; other connected devices on your home network; who uses the TV, especially where there are profiles; details you enter when signing up to a service; and your browsing history. The manufacturer or its partners may use this for targeted advertising.

Germany's Federal Office for Information Security (BSI) adds that voice commands spoken into the remote may be sent to a cloud server for processing, and that HbbTV, a kind of modern teletext from broadcasters, runs largely over the internet. For Google TV, Google lists among other things watch activity, approximate location, user and device IDs, diagnostics and, on TV devices, advertising data.

An everyday example

Fictional example: Aoife, an Irish student in Vienna, moves into a shared flat that comes with a smart TV in the living room. The home screen recommends dramas nobody in the flat watches, and a previous tenant is still signed in to a streaming app.

Aoife and her flatmates agree on a short reset. The former tenant is asked to remove the TV from his streaming account. Aoife resets the TV to factory settings and sets it up again, declining anything she doesn't understand. She deletes the advertising ID, turns on automatic updates and switches off voice control, because everyone uses the buttons anyway. Each flatmate then gets a separate profile in the streaming apps instead of sharing one log-in.

Where do I switch off ad tracking and location?

Every manufacturer arranges these options differently. Google TV runs on TVs from several brands and on streaming devices; the labels below come from Google's UK English help page.

Deleting the advertising ID is more thorough: a reset just gives you a new identifier. For location, Google notes that it or third parties may still receive your general location through your IP address. On TVs with another operating system, look for sections such as 'Privacy', 'Terms' or 'General' and review each consent for advertising, viewing data and recommendations one by one. Labels depend on the model and software version.

Tip: Agreed to everything in a hurry during setup? Go back to the privacy settings and change your choices there. The CNIL notes that where your viewing data is reused for targeted advertising, you must be told the purpose and be able to accept or refuse.

How do I make sure the TV gets updates?

The BSI advises installing security updates promptly, because they often close security holes, and using automatic updates if you are unlikely to install them by hand. The CNIL recommends regularly checking for system and software updates on your TV, and checking before you buy that the TV's software is updated regularly.

Look in the settings for the section on software updates and switch on automatic updates if your TV offers them; menu names vary by brand and model. If your TV no longer gets updates, the BSI suggests you consider disconnecting it from the internet and your home network, or uninstalling vulnerable apps. Before buying a new TV, ask how long the manufacturer will support it with updates.

HbbTV, microphone and camera: what can go?

The BSI's rule of thumb is simple: switch off or remove services, functions and apps you don't need, because they can contain vulnerabilities even if you never open them. Go through these points:

• HbbTV: if you don't use the broadcasters' interactive extras, switch HbbTV off in your TV's settings.
• Voice control and microphone: switch them off if you use the buttons on the remote anyway.
• Camera: the CNIL suggests deactivating a built-in camera or physically covering it.
• Remote access: only enable features that let other devices control the TV if you use them.

Keep access protection such as a PIN switched on; the BSI advises leaving security features active. The CNIL advises never connecting your TV to a public Wi-Fi network. At home, network access runs through your router: Check your home Wi-Fi explains what to look at.

How do I tidy up apps and streaming accounts?

The more apps are installed, the more potential weak points the TV has. The BSI recommends using only trusted app sources, checking permissions before installing and keeping only what you really need. The CNIL adds: uninstall apps you no longer use and never save bank details in TV apps.

1. Delete apps you haven't opened for months.
2. In each streaming service you use, check the account settings for a device list or a 'sign out of all devices' option, and remove old TVs, hotel rooms and devices you've given away.
3. Set up separate profiles for flatmates or children instead of sharing yours.
4. Don't enter important passwords in the TV's web browser; the BSI advises against it because smart TVs often lack an up-to-date browser.

Which devices are signed in? explains how to read such a list. If a service is raising its price at the same time, see Streaming subscription price rise.

What are my rights, and who can help?

In the EU, the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, applies. You can contact a manufacturer or streaming service directly, for example to ask what data it holds about you; the contact details are in its privacy policy. Italy's data protection authority, the Garante, explains that the company must reply without undue delay and within one month at the latest, extendable by two months for complex requests. If a provider does not respond, the GDPR gives you the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live.

This overview is not legal advice. If you are in a dispute about a specific case, seek individual advice.

Selling or recycling the TV: what needs to go first?

Before a TV leaves your home, the BSI says all private data should be removed. It warns that a factory reset may not delete everything, so check afterwards whether accounts, apps or Wi-Fi details are still visible and delete them by hand where possible. If that isn't possible, contact the manufacturer.

1. Remove the TV from all streaming accounts, ideally via the device list in the account itself.
2. Sign out of the manufacturer account and the Google account on the TV.
3. Reset the TV to factory settings.
4. Switch it on once more and check that no personal data is still visible.