Here is the contradiction most people never resolve: LG says a residential proxy network "is not an intended use for LG smart TVs," and it will suspend any app that runs one. Yet more than 42 percent of the apps on its own store were doing exactly that — quietly, indefinitely, for years.
Both statements can't be true. Either LG reportedly didn't know that more than 42 percent of the LG apps Spur scanned were renting out customers' internet connections, or it didn't look, though this is speculation. Neither is comforting.
Start with the scene, because the absurdity is the whole story. On your wall, a fish tank drifts. Or a clock ticks. Or a Pac-Man clone glows in the dark.
Under the calm surface, that app is a residential proxy — software routing a stranger's internet traffic out through your living room, using your home IP address as cover.
Someone in your household reportedly tapped "Agree" once, with the remote, probably during setup. That consent never expires. The app keeps monetizing your connection for as long as it stays installed, whether or not anyone remembers the prompt.
This is not a fringe problem with a few sketchy downloads. The security firm Spur scanned 6,038 apps across LG webOS and Samsung Tizen and found 2,058 of them selling your IP address.
On LG, that's 42.5 percent. On Samsung, 26.9 percent. Across both platforms, 34.1 percent — one in three TV apps.
And the researchers didn't trust the store descriptions. They downloaded the actual app packages, unpacked them, and fingerprinted confirmed SDK artifacts inside. Every app in that count had a proxy engine sitting in its files.
Why TVs? Because a television is the perfect proxy host and nobody thinks to check.
As Spur's Trevor Sutter put it, a TV has "no battery drain to notice, no cellular bill to spike, no app switcher full of suspicious background activity." It stays plugged in, signed in, and online for years while you treat it as furniture.
A television has no battery drain to notice, no cellular bill to spike, no app switcher full of suspicious background activity. It stays plugged in for years.
The economics explain why this is architecture, not accident. According to futurenow.click, a 65-inch 4K TV that sells for $500 costs manufacturers roughly $420 to $450 to build, ship, and market — leaving maybe $50 to $80 of gross margin before returns and retailer cuts.
You cannot run a business on that. So they built a different one: sell the hardware near cost, then reportedly sell what the hardware sees at 60 percent margins.
Look at Vizio's public filings for the shape of it. Per futurenow.click, in Q3 2024, its data-and-ads platform revenue grew 26 percent to $197 million, while TV hardware revenue fell 8 percent to $247 million. The device is shrinking. The surveillance is growing.
Which brings us to the second business your TV runs against you. The proxy racket rents your connection. Automatic Content Recognition photographs what you watch.
According to the Texas Attorney General's December 2025 lawsuit against Samsung, as reported by futurenow.click, the TV reportedly captures your screen every 500 milliseconds — twice a second — and sends that image off for content matching.
Not just Netflix. Everything. Your laptop over HDMI, your Zoom call, your banking app mirrored via AirPlay, your PlayStation. The complaint describes monitoring "anything that appears on the screen." ACR runs at the chipset level, on by default, indifferent to which input you're using.
Texas sued five manufacturers — Samsung, Sony, LG, Hisense, and TCL. Samsung has reportedly already settled, per futurenow.click.
So your living-room panel is running a two-sided extraction operation: renting your IP to strangers on one side, fingerprinting your frames on the other. That is what "smart" bought you.
Now the turn. LG's announced crackdown got framed as "welcome news," and it is easy to see why — a senior vice president said the offending apps will be suspended if developers don't strip the proxy code.
But look closely at what the ban actually protects, and what it leaves standing.
Start with your home network, because this is where the danger stops being abstract. A proxy app runs inside your LAN. If the provider allows requests to private addresses, or its filtering breaks, that TV becomes a foothold to your router admin panel, your NAS, your printers, your cameras.
This already happened. In January 2026, KrebsOnSecurity reportedly documented Kimwolf, a botnet that abused residential proxy networks to tunnel back into the local networks behind proxy endpoints — reaching devices on the same LAN and spreading from there.
Here is the load-bearing detail. The Bright Data SDK — the network behind most of these apps — ships with an explicit private-range blocklist: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 169.254.0.0/16, 192.168.0.0/16, and 255.255.255.255.
That looks reassuring. It is actually the confession. The blocklist exists because the TV is technically capable of reaching those addresses; the only thing stopping it is a text file in the proxy company's code.
As Spur puts it, "the boundary is not technical; it is enforced by the proxy company's policy code." The wall between a stranger and your baby monitor is a vendor's policy decision, and you have no way to verify it from your couch. In other samples from Massive and Honeygain, researchers found no comparable blocklist at all.
Then there's consent, which was theater from the start. On the Tizen Pac-Man app, Bright Data is pitched as the premium option — Spur calls it "a clean little monetization fork: watch ads or become part of the proxy network."
Decline and you get ads. Accept and your TV becomes proxy inventory, forever. And whoever taps that button counts — "including minors," as Spur notes. A one-time prompt navigated with a remote is not meaningful consent; it's a legal fig leaf.
Even ACR reportedly resists being turned off. Per futurenow.click, firmware updates on Samsung, LG, and Vizio TVs silently re-enable ACR after you've disabled it. You win the setting, then lose it again on the next patch, without notice.
That's the theater. A "crackdown" on proxies leaves the frame-capture business fully intact, leaves the network boundary as someone else's policy file, and leaves consent as a button a child can press.
And the timing insults the intelligence. LG acted less than a month after Spur went public — not before. The company was reportedly culling proxy apps in the same news cycle it got caught pushing McAfee promotions through its monitor drivers via Windows Update, no approval prompt, per Gamers Nexus.
The display itself has become monetization hardware. That's the throughline.
Here's the part that names the choice for what it was: Amazon already bans this. Its Device and System Abuse Policy prohibits apps that facilitate proxy services for third parties. Roku reportedly bars Bright SDK, and apps using it vanished after Roku was contacted.
LG and Samsung had the same information and drew no equivalent line — until researchers forced the issue. This was not an oversight they couldn't have prevented. It was a business model two competitors had already rejected.
So what do you actually do? There is only one honest defense posture, and every source that studied this converges on it.
Treat the panel as a dumb display. Put a device you control — a media box, a streaming stick you trust, a small PC — in front of it, and let that handle everything.
If you want the TV online, run its telemetry and ad domains through a Pi-hole so it can update but can't phone home freely. Disable ACR where you can, then re-check the setting after every firmware update, because it will try to come back.
The uncomfortable core is this: the vendor is not your protection. LG's ban is damage control, not reform. The revenue architecture — proxy rentals, frame capture, near-cost hardware sold to harvest you at 60 percent margins — is untouched.
Your TV is unaudited computer hardware sitting on your home network, running a two-sided business against you. The only move that actually works is to stop trusting it to behave, and put something between it and your life.