Manufacturers make recurring revenue by invading the privacy of "dumb" users with their "smart" TVs.
It's probably only a matter of time before TV manufacturers establish their own ad networks.
Why? Because they can. They have the ability to fully control *their* "smart TV" (that you paid for) and show you ads that they control --- independent of any programming.
https://arstechnica.com/gadgets/2024/12/tcl-tvs-will-use-fil...
This is why I purchase Vizio instead of other brands. I don't need my television loaded with a ton of apps I'll never use.
This avoided connecting it to wifi, but I still got what I wanted out of it.
They are not all the same --- even within the same manufacturer.
A lot of newer firmwares will launch into setup every time you power up if access is not configured. The TV configuration data is most likely being saved/retrieved from their cloud. This serves as their connectivity test.
Without wifi setup, my new Hisense 4k "budget" model does this *unless* you run it in "store" mode.
Dealing with setup on every power up is possible --- but obviously highly annoying over time --- and this is by design.
The manufacturers desperately want the data collection $. It's the only way some of them make money.
(It kind of implies you need to continue and update, but you can just go to HDMI and it doesn't bother you anymore.)
https://www.tcl.com/us/en/roku-tv/eula
“If you do not agree to this EULA, you do not have the right to use the Television or the Software. If you are within the allowable time period for returns under the applicable return policy, you may return the Television to your seller for a refund, subject to the terms of such return policy. You should perform a factory reset before you return it to erase data that may be stored on the Television.”
That being said, this is the first time I've ever seen an EULA be this brazen and predatory. Claiming that I'm not allowed to use the entire device because I don't agree to some post-sale contract? In writing? Are you sure you want to do that TCL?!?!?
It may depend on your jurisdiction but here in the USA, I'm pretty sure it's legal because they offer a full refund if you chose not to accept.
There are alternative ways to coerce users into playing along. For example, simply store/retrieve TV configuration in the cloud. Without connectivity configured, the TV starts over from scratch in device setup on every power up.
And connectivity obviously opens the possibility for other uses.
They offer you the opportunity to get a refund from the retailer, subject to that retailer's return policies, which may mean "open box" restocking fees, time limitations or similar.
That is not the same thing.
I'm cool with it provided I can use it as a very high quality HDMI display. Then I just got a nicely discounted product.
My worry is if they demand connectivity in order to work as a display. Or worse come with some kind of LTE transceiver to phone home then we're in trouble.
Most will work --- but not always *conveniently*.
On power up, a lot them will launch into setup if connectivity is not configured. Some may actually store/retrieve the TV configuration in their cloud.
So the main concern with keeping it in dumb mode I would think is that they could still snoop in on your streams through the plain old HDMI port.
But if the HDMI is encrypted.....
With their antipiracy standard ....
God that would be amazing.
Also, I'm kind of surprised there isn't a raspberry pi open source project that does what those 20$ Roku fobs do.
Finally ... It kind of shows that hardware hacking is going downhill that there isn't a replacement os for the major brands of smart TVs. It's possible they've locked that down, but also the price points are so low you'd think they don't have the money to keep them out.
So they snoop. There's no value to be had in it if they can't report back to the mother ship. Without a line of communication, the "personalized" ads premise fails.
The more correct term would be Digital Signage displays, eg. [1] - they often run on high voltages though so it's better to be sure when screwing around with them
GDPR is simply ignored by any bigger US company, it took 5 years for NOYB to facebook get fined which was less than 0.3% of their income, basically a small tax, not a huge fine.
Also GDPR is full of inconsistency (face biometric data is special data, but a photo of your face from what anybody can get the biometric data is not) and loopholes (required by law, legitimate interest).
They did something, but I wouldn't call that "a long way".
I work for a very large US company and can assure you that GDPR is something we pay a lot of attention to. This isn't the opinion of my employer, but my personal experience is that the big players take it seriously and meet and exceed all their obligations because it's too risky not to, and they have the necessary local legal teams to understand the law as best as is possible.
I think it's the small/medium companies who are where most of the issues are. Small companies write a non-legalese privacy policy because they think that's better for their users, but in fact have written something legally meaningless that gives their users no protections. Some small companies just don't know their obligations because they think they won't apply as they're not in the EU.
Then there are the companies who are big enough to know better, but small enough to know they can get away with it because all the scrutiny goes to big tech. I was asked by a medium sized advertising network to implement a keylogger on our website at my previous company so that the network could enforce their revenue sharing by detecting all user data input into our site and match it against their records. I laughed them out of the room, but they made it very clear this was how everyone did it.
To be fair, unless a company has a business presence in the EU there is nobody to sue for GDPR violations. The EU cannot enforce its laws on an entity which isn't under its jurisdiction at all.
The only way the EU could enforce the GDPR on a fully foreign website is to block it.
But it is still true, that nothing happened after the Schrems II judgment, and many-many companies continued to transfer personal data to providers affected by FISA.
GDPR is closely adhered to by big American companies. They may be the only ones to whom the EU is applying regulatory pressure on this. Chinese and Indian companies, on the other hand, as well as any non-enterprise American company, including start-ups, on the other hand, can and do safely ignore it. (Or follow it in broad strokes.)
From my experience working at multiple companies, and having interacted with others, the GDPR is not ignored by American companies. websites based out of the US block EU users to avoid fines, or these US based companies which don't block EU users have gone out of their way to comply with the GDPR as interpreted by their respective legal department.
That's not how tax works. You get taxed on your net, not your gross. 0.3% of gross is massive.
For now at least this really isn't an issue. If and when these companies ever start requiring a network connection it's a different story.
Unfortunately it is NOT a firewall.
Any device can easily do its own DNS like DoH (dns over https), nnot involve pihole in name lookups, and send package directly to the destination ip address.