The Household Bought the Surveillance System and Switched It On
Smart TVs capture what is on screen about twice a second, and POPIA already governs what their makers, buyers and advertisers can do with the data.
Sign up for my Substack daily AI newsletter here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
Most governance writing about surveillance aims upward at the state and outward at Big Tech. Yet the most heavily instrumented sensor in a South African living room was bought with household money, carried through the front door, and switched on by the owner. The modern smart television takes screenshots of what is on the screen roughly twice a second, matches them against vast content databases, and sells the resulting profile into advertising networks. Boards running consumer brands, broadcasters, streamers and advertising firms in South Africa are already buying from that pipe, usually without knowing it, and POPIA says more about this than most directors realise.
CONTEXT AND BACKGROUND
The technique is called automatic content recognition. A TV with ACR on captures a fingerprint of the glass about every 500 milliseconds, identifies the content whether it came from a broadcast, a streaming app, a games console or an HDMI input, and sends the inferred profile to a server for ad targeting. A University College London and UC Davis measurement found that GDPR subject-access requests returned a small fraction of what the TVs actually sent, routed on LG to Alphonso and on Samsung to the company's own ad domains.
Texas has moved. In December 2025 its attorney general sued the five largest TV makers, Sony, Samsung, LG, Hisense and TCL, under the state's deceptive-trade-practices act. In May 2026 LG settled, agreeing to require express, informed consent before collecting ACR data, to show a pop-up on the TV explaining the practice, and, in an unusual provision for a privacy case, to stop transferring viewing data to entities linked to the Chinese Communist Party. In October 2026 three Samsung TV owners filed a proposed class action in the US District Court for the Northern District of California, with 14 causes of action and a request for an injunction forcing separate, clear consent for ACR.
INSIGHT AND ANALYSIS
The content of the inference is where the governance problem sharpens. Documents in one of the Texas suits allege that Sony's ACR tracking used Samba TV as a third party and that the resulting profiles may include sensitive attributes such as religion and sexual orientation. These are not odd outputs; years of late-evening viewing of a particular news channel, prayer service or audience-targeted show will be enough for a modern classifier to form a confident guess. The TV did not need a camera; it only needed what was on the screen.
I have previously written about this when arguing that autonomous AI surveillance has outrun its governance rules, in a piece about satellites running vision-language models in orbit. The lesson repeats a few hundred kilometres closer to the floor: once a classifier is running on behavioural data, the inferences it draws are the category the law should care about.
The commercial pressure to keep ACR on is substantial. The buyer of that data is a brand or an agency, and the connected-TV ad market in the United States alone is forecast at tens of billions of dollars in 2026. The TV manufacturer is now, in substance, an ad-tech company that happens to sell panels. Industry answers that ACR also powers content discovery and free ad-supported streaming, and that households benefit; the question is whether that benefit is a fair exchange for the consent the TV took.
IMPLICATIONS
POPIA already catches most of this. Section 11 requires a lawful basis for processing personal information; a "one-click accept" at the end of a long setup, pursued because the alternative is a dim and under-featured TV, is a weak basis. Section 18 requires transparency at the point of collection, which the Texas action against LG suggests the industry has not met. Section 72 governs cross-border transfers, and ACR data does leave South Africa. The Information Regulator has yet to issue specific guidance on ambient data from connected devices, and that silence is the opportunity.
South African boards cannot wait for that guidance. Any firm that buys connected-TV advertising, imports connected devices, runs a streaming service, or operates a broadcaster should know whose ACR data sits in the audience segments it buys, what inferences they contain, and under what consent they were obtained. Those procurement questions belong on the risk register of any brand that spends on CTV.
CLOSING TAKEAWAY
The strange thing about the smart TV is that no one made the household buy it. It was marketed as a feature-rich upgrade, and the household paid extra, took it home, and ran it. The sensor switched on with the panel. South Africa's governance task is not to tear it out but to make sure the firms that profit from the data behind the glass can show, under the law the country already has, how they got consent and what they do with the inferences. The accountability for what the TV sees is a boardroom question.
Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence's impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan's work at https://www.aiforbusiness.net
Comments