A detailed technical investigation by YouTube channel Gamers Nexus, conducted in collaboration with Level1Techs and independent security researchers, has revealed that LG smart TVs are capable of quietly mapping every device on a home network — including phones belonging to people who never interact with the television. The findings, drawn from packet captures and firmware analysis, raise serious questions about what consumer electronics are doing behind closed screens, and whether the industry’s framing of these behaviors as routine “smart home functionality” is sufficient disclosure to the millions of households that own these devices.

Network Scanning: Every Device on Your LAN

The investigation centered on several LG TV models, including the LG OLED65G3PUA — a flagship G5 OLED television with a starting retail price of $2,500. Using Wireshark, a widely-used network protocol analyzer, researchers captured network traffic emanating from the TV and cross-referenced those findings with a firmware inspection.

What they found was extensive. According to Gamers Nexus editor-in-chief Steve Burke, the G5 television crawled the entire local area network (LAN) and catalogued dozens of unrelated devices. “The [G5] crawled our entire network and found dozens of unrelated devices, including smartwatches and phones of our staff who didn’t even know we were working on this,” Burke stated.

The packet captures showed that LG TVs are capable of identifying a user’s IP address, the geographic location associated with that address, the names and signal strengths of every Wi-Fi network in the vicinity, channel numbers of neighboring wireless networks in range, and the internal IP addresses of other devices on the network — even devices that have never been connected to or interacted with the TV in any way.

Burke was careful to note the significance of this detail: “This is the TV’s native functionality. This didn’t require vulnerabilities.”

LG’s Response: Standard Smart Home Behavior

When Ars Technica reached out for comment, LG Electronics provided a statement acknowledging the scanning capability while framing it as an intentional feature. “LG TVs can identify compatible devices on the same network to enable features such as device connectivity, content sharing or smart home functionality,” the company said.

LG further stated: “This is a standard function commonly provided by smart TVs and smart home devices.”

The company did not directly address whether the data collected during these scans is transmitted to LG’s servers, nor did it clarify the full scope of what is gathered or retained. Researchers noted that it remains unclear whether this functionality serves purposes beyond advertising — such as diagnostics — or precisely what information is ultimately sent back to LG.

The Advertising Connection

LG’s advertising division, LG Ad Solutions, has stated in recent marketing materials that it can reach 363 million “addressable secondary devices” in the United States. That figure — referencing devices beyond the TV itself — takes on new meaning in the context of the network scanning findings. If an LG TV is cataloguing every phone, laptop, printer, and smart-home device on a household network, that data could theoretically contribute to the detailed consumer profiles that underpin the connected television advertising industry.

Automated Content Recognition (ACR) technology, which samples what appears on or is heard through a TV and compares it to a reference database to identify viewing habits, is a known component of the smart TV advertising ecosystem. As Malwarebytes noted in its coverage of the investigation, network device information, combined with ACR data and advertising IDs, could support highly granular profiles of household behavior and device usage.

Audio Recording While Offline

Perhaps the most striking element of the Gamers Nexus investigation involved audio. Researchers demonstrated that an LG TV was capable of recording ambient sound through its microphone even when the television was not connected to the internet. According to Burke, the audio was stored locally in plaintext — a format that could allow the data to be transmitted to LG once the device reconnects to a network.

Level1Techs representative Wendell Wilson offered a pointed observation about this capacity: “It doesn’t cost a lot to store text forever.”

LG’s statement addressed this directly, asserting that standby mode audio monitoring occurs only if the user has previously enabled the Far-Field feature, and only to listen for a designated wake word. The company stated that audio not matching a wake word is processed locally on the device and promptly deleted without being transmitted to LG servers. LG further stated that its TVs do not “collect, record or transmit ambient conversations in your home, unless voice functionality has been intentionally activated by the user.”

The researchers’ demonstration, however, showed audio being stored while the TV was physically disconnected from the network — behavior that, whether by design or as a byproduct of the wake-word detection system, means audio data can persist on the device in a recoverable form.

Security Vulnerabilities: A Separate Layer of Risk

Beyond the designed behaviors of LG TVs, the investigation also surfaced security vulnerabilities that researchers are still in the process of disclosing responsibly to LG. Full technical details have not been made public while that process is ongoing. Malwarebytes noted that the researchers reported remote-code-execution vulnerabilities to LG — flaws that, if exploited, could give an attacker the ability to run arbitrary code on the television.

In that scenario, a compromised TV could become a surveillance device or a foothold for lateral movement across a home or business network. The audio capture capabilities and LAN scanning functions that exist as native features would, in the hands of an attacker, become tools for a far more invasive intrusion. Malwarebytes observed that “a compromised television could be more than a privacy issue. It might provide an attacker with a foothold on a home or business network, access to audio, or a route to probe other devices.”

The Problem Extends Beyond LG

Burke was deliberate in framing this investigation as a window into broader industry practices rather than a singular indictment of LG. He highlighted a specific infrastructure concern: some internet service providers operate dual SSIDs that broadcast an open neighborhood Wi-Fi hotspot from customer routers — a practice employed by Comcast’s Xfinity and AT&T, among others. Devices like smart TVs may auto-connect to these open networks when they detect them, particularly in dense residential environments like apartment buildings.

“So this is a concern broadly speaking and future looking for smart TVs regardless of the brand,” Burke said.

Burke also pointed out that using an LG smart TV as a “dumb monitor” — disconnected from its smart functions — does not necessarily prevent all of the tracking behaviors identified in the investigation.

What Owners Can Do

Security researchers and privacy analysts recommend treating smart TVs with the same level of scrutiny applied to any internet-connected computer. Practical steps include installing firmware updates promptly, reviewing and restricting privacy settings including ACR, viewing data collection, personalized advertising, and voice recognition features. Experts also recommend placing smart TVs on a separate guest or IoT network segment, which limits what a compromised device can access on the primary home network. Disabling UPnP on the router, unless specifically required, is also advised.

The core issue identified by the investigation is not solely a technical one. LG’s statement characterizes local network scanning as a standard feature of smart home devices. Whether consumers understand that a television purchased for entertainment is simultaneously functioning as a network reconnaissance tool — mapping their household devices, recording audio in standby, and potentially contributing to an advertising profile that reaches beyond the screen — is a question the investigation leaves pointedly open.

This article draws on reporting from Ars Technica and Malwarebytes.

Want to go deeper? Ask NEX, the Decrypted Matrix research assistant, about the documents behind this story. It indexes every article here the day it is published and cites its sources.