Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
The privacy lawsuits that we’ve seen explode over the last year are not just for small and medium sized businesses. While Samsung has had to deal with the Texas Attorney General we are also seeing large enterprises having to deal with privacy litigation. Danielle Tillery, Michael Walsh, and David Rosenberg sued Samsung Electronics America on October 6 in the U.S. District Court for the Northern District of California. The case is No. 3:26-cv-11448. The complaint is 88 pages. The sentence they want a jury to remember is one Samsung put in its own Viewing Information Services notice: Samsung “neither collects any video footage nor any content displayed on the Device.” The plaintiffs say that sentence is false.
Three buyers, three model numbers, one setup path
Tillery lives in San Francisco. She bought a UN55NU7100FXZA from Best Buy around 2019 and set it up herself. The household watches Netflix, HBO Max, Amazon Prime Video, Tubi, and Philo. Walsh lives in Whittier. He bought a UN55TU700DF from Best Buy around 2020 or 2021 and set it up himself. The apps on his pleading are Netflix, HBO Max, and Disney+. Rosenberg lives in Danville, in Contra Costa County. He bought a UN75H6350AF from Best Buy in September 2014 for $2,499.99 less a $500 discount. Best Buy delivered it on September 19, 2014. A Geek Squad technician installed and configured it. Rosenberg is a senior citizen under California Civil Code section 1761(f). He says the set runs about five hours on a weekday evening and ten or more on a weekend day: ESPN, ABC, NBC, Fox, YouTube TV, Hulu, Apple TV, and Netflix.
All three say they still own the sets, the sets are still on the network, and the capture is still running. That is the fact they use for an injunction. Damages, they argue, do not stop the next fingerprint.
Each says the same thing about consent. No one showed them a disclosure that described interception of viewing activity and got a knowing yes. Rosenberg’s version is sharper because he did not click through setup at all. A technician did. If the only “I agree” in the house was pressed by Geek Squad, Samsung’s consent story has a person in it who was not the viewer.
The defendant is Samsung Electronics America, Inc., a New York corporation with its principal place of business at 700 Sylvan Avenue, Englewood Cliffs, New Jersey. The plaintiffs say the label on the back of the set names that entity as the distributor, and that it handles U.S. marketing, sale, and post-sale software. They put Samsung Ads in Mountain View, on the Samsung Research America campus, and they note that Yahoo’s SoundPrint technology, folded into Samsung’s SyncPlus platform starting in 2012, came out of IntoNow, a Palo Alto company Yahoo bought in 2011. Venue in San Francisco is pleaded on Tillery’s and Rosenberg’s counties, on those Northern California ad-tech addresses, and on the claim that the capture happened on sets in the district.
What they say the pipeline does
Automatic content recognition is not a new idea, and the complaint does not treat it as one. A set samples the screen or the audio, turns the sample into a signature, and checks the signature against a library of known programs and ads. The plaintiffs say Samsung has had some version of this since at least 2013. The early years were vendor-assisted: a November 2012 deal with Yahoo for Broadcast Interactivity on SyncPlus, and an investment by Samsung’s venture arm in Enswers in 2014. After that, they say, Samsung built its own system and tied it to Samsung Ads.
The modern label in the menu is Viewing Information Services. The complaint calls that name a cover. Samsung’s own ACR FAQ, as quoted in the filing, says that when the feature is on, the set can generate signatures of what is on the screen and may capture viewing history, the Personalized Service ID, and the IP address, and that the description applies to Samsung Smart TVs generally. The PSID is described as resettable. The plaintiffs say almost nobody finds the reset, the identifier stays tied to the household’s viewing history, and third-party apps on Tizen receive a derivative called the Tizen Identifier for Advertising.
Samsung Ads, they say, markets this to buyers as glass-level recognition: linear television, streaming, a set-top box, a game. The complaint’s list of what rides with the fingerprint includes the program, the ad, the app, the timing and duration, and the fact of a connected device. From that log they say Samsung and its partners infer politics, religion, health, sexual orientation, whether children are in the house, and rough demographics. Those inferences are allegations. They are also the reason a screen log is not “just what channel was on.”
The sharing chapter is where the pleading gets commercial. In December 2023 Samsung Ads announced that Experian identity data, built on about 128 million households and 750 million hashed emails, would be matched to Samsung data inside Samsung’s demand-side platform. The complaint says curated audiences have moved through partners that industry reporting has named as Acxiom, Adobe, Experian, LiveRamp, Merkle, and Oracle. It points at Nielsen Digital Ad Ratings on Samsung inventory, at Samsung’s own privacy notice listing subsidiaries and business partners, and at the Texas petition’s allegation that viewing data went to demand-side platforms, measurement firms, data brokers, and cross-device graphers. LiveRamp is pleaded as headquartered in San Francisco, Adobe in San Jose, Google in Mountain View, Experian’s North American marketing arm in Costa Mesa, The Trade Desk in Ventura. Plaintiffs reserve the right to add endpoints in discovery. They also say Samsung has been picky about licensing raw ACR, keeping it as a proprietary input for Samsung Ads rather than selling the raw file the way some rivals have.
A 2024 measurement paper by Gianluca Anselmi and coauthors is attached as a picture of the architecture, not as a Samsung-specific packet capture. The plaintiffs say the pattern in that research matches what they allege: fingerprints generated on the device, sent to vendor-controlled domains, including when the set is only an HDMI display, and a drop in that traffic when the privacy menu is actually switched off.
The sentence they say is false
Marketing, in this complaint, is not puffery about picture quality. It is the Viewing Information Services notice. Samsung told buyers the feature improved recommendations. It also told them it did not collect video footage or content displayed on the device. The plaintiffs say the system works by capturing that content, fingerprinting it, and shipping the fingerprint for a match. They add that an older SmartTV privacy supplement disclosed, in fine print, that SyncPlus could send “video or audio snippets” of the program to third-party providers along with an IP address and device identifiers. If that supplement existed, they argue, the later flat denial was not a drafting slip.
Setup is pleaded as a dark pattern. Several notices, including Smart Hub, Viewing Information Services, and Interest-Based Advertisements, sit on one screen with a single prominent control: “I Agree to all.” A Samsung Care video on YouTube tells the buyer to review and agree to all the Smart Hub terms and select OK. After setup, turning the capture off means finding at least two settings in different menus, Viewing Information Services and Interest-Based Advertisements, a path the plaintiffs put at about fifteen clicks. There is no light on the bezel to show the feature is sampling. Easy on, buried off, no indicator. That is the consent record they say a jury should refuse to treat as informed.
They also say the disclosure, when it happens, often happens to whoever is holding the remote during setup, not to every person who later sits on the couch. A television in a living room is a household device. Guests and children do not click through Smart Hub. The complaint uses that to argue the purchaser’s click cannot cover the rest of the house, and that Samsung still builds a household profile from all of them.
Texas already made them say the words
The federal case is not the first government file on this feature. In December 2025 the State of Texas sued Samsung under the Deceptive Trade Practices Act over the same viewing-data practices. The state’s line, echoed in a companion filing against another manufacturer, was that the set was watching back and that the consent path was misleading. In February 2026 Samsung resolved the Texas case by accepting a court-ordered permanent injunction. Going forward, in Texas, it has to disclose clearly and conspicuously that Viewing Information Services uses automatic content recognition to identify and analyze content on the device, and it has to get affirmative express consent before collecting viewing data.
That order does two things for the California plaintiffs. It is a public description, in a judgment, of what the menu item actually is. And it is a picture of the disclosure Samsung was willing to make when an attorney general had the pen. The class action asks a federal judge in San Francisco for a version of the same rule for California buyers, plus damages for the years before it. Samsung’s likely motion will try to split the periods: vendor era, in-house era, post-Texas era. Rosenberg’s 2014 set is pleaded to cover all of them.
The older government marker is Vizio. In 2017 the Federal Trade Commission and the New Jersey Attorney General settled United States v. VIZIO, Inc., No. 2:17-cv-00758 (D.N.J.), for $2.2 million over ACR on about 11 million sets without informed consent. The FTC said Vizio built viewing-behavior databases and shared them for advertising. By 2021, reporting the complaint cites had Vizio making more profit from ACR-derived data than from the televisions. The plaintiffs say Samsung read that file and built the program anyway. Samsung will say Vizio’s facts are not its facts. The comparison is still the one both sides will brief, because it is the last time a federal agency put a dollar figure on this exact product category.
Fourteen counts, and the ones that will be briefed first
The menu of claims is long because the lawyers want more than one statute to survive a motion to dismiss. Intrusion upon seclusion and public disclosure of private facts. The California constitutional privacy right. CIPA sections 631, 632, and 638.50 through 638.51, with statutory damages pleaded at $5,000 a violation under Penal Code section 637.2. The Comprehensive Computer Data Access and Fraud Act, Penal Code section 502. The federal Wiretap Act. The Video Privacy Protection Act. Negligence. The Unfair Competition Law. The Consumers Legal Remedies Act. Unjust enrichment. A public injunction for California buyers who are not in the class.
CIPA is the count plaintiffs’ firms have been using against pixels, chat tools, and session replay. Here the “interception” is a television the defendant manufactured. Samsung will say it is a party to the communication, or that there is no communication in transit, only a picture on a panel. The plaintiffs say the content often comes from Netflix, a broadcast tower, or an HDMI stick, so Samsung is a stranger to that transmission, and that any party exception fails if the purpose was the privacy tort itself. That is the fight in Count VIII. It is also why they plead HDMI and antenna, not only Samsung’s own apps.
The VPPA count is the stretch. Samsung has to be a video tape service provider engaged in rental, sale, or delivery of audiovisual material. The plaintiffs say the home screen, the content rails, and the preinstalled video services are enough, and that setup made each of them a subscriber. Courts have gone both ways on whether a device maker that also runs a storefront is a VPPA defendant. The identifiers they pair with program titles are the IP address, MAC address, advertising ID, household ID, and Samsung account ID, plus the Experian match. If a judge thinks an ordinary person at the receiving end could name the household, the count lives. If the judge thinks a fingerprint plus an ad ID is not “personally identifiable information,” it dies early.
The CLRA count has a paper trail. Walsh, Rosenberg, and Tillery sent a section 1782 notice by certified mail. It was delivered July 21, 2026. Samsung’s counsel acknowledged it on August 14, denied any misrepresentation, and offered no correction. Thirty days passed. That is why the complaint asks for CLRA damages, not only an injunction. Rosenberg also asks for the senior-citizen add-on under section 1780(b) and trebling under section 3345, on the theory that buried menus hit older buyers harder.
Economic injury is pleaded three ways. They would not have bought the set, or would have paid less, had the notice matched the pipeline. Their viewing data had a market value someone else captured. And, in a paragraph written for standing, they say the sampling draws on the order of a kilowatt-hour a year of metered electricity per set, so they are paying for the capture. The electricity theory is small money. It is there because TransUnion wants a concrete injury, and a power bill is concrete.
They also plead that Section 230 does not apply. They are not suing Samsung as the publisher of a third-party show. They are suing it for designing and operating the capture. That is the right distinction, and Samsung is unlikely to win a 230 motion on these facts. The harder motions are consent, the party exception, and whether a television maker is a video tape service provider.
What the class looks like, and what the injunction asks
Jurisdiction is the Class Action Fairness Act, with a federal-question hook from the VPPA and the Wiretap Act. They allege more than 73 million Samsung Smart TVs in use in the United States and about a third of the installed smart-TV base. Nationwide classes and California subclasses are both sketched. The public-injunction count is separate on purpose. Under the UCL, the CLRA, and the state constitution, they want an order that stops ACR on California sets unless consent is clear, conspicuous, affirmative, and separate. They argue that relief runs to the next buyer, not only to Tillery, Walsh, and Rosenberg, and that a class settlement with an arbitration clause cannot waive it.
The injunction terms in the prayer are the Texas terms rewritten for a private case: stop the capture without standalone consent, ban pre-checked defaults and the “recommendations” label as a substitute for a description, and give a simple off switch. Restitution, disgorgement, statutory damages, and a jury are all demanded.
Samsung’s answer is not in the file yet. The defenses that are already visible from the way the complaint is built are consent, disclosure in the privacy supplement, the party exception, a narrower reading of the VPPA, and a split between Samsung Electronics America and the Korean parent. The Texas injunction cuts against a blanket “nobody could have misunderstood Viewing Information Services” defense, at least for the period after February 2026. It does not, by itself, prove deception in 2014.
Why this filing is the CIPA docket moving into the living room
California plaintiffs’ firms have spent three years filing wiretap cases against websites. Session replay, chat pixels, Meta’s pixel on a checkout page. The statute is the same Penal Code section. The device is different. A smart television is in the house, on for hours, shared, and capable of seeing an HDMI source the manufacturer does not operate. If this complaint survives, the next filings will not stop at Samsung. The Texas docket already named other set makers. Vizio’s 2017 order is the template both the FTC and these lawyers are pointing at.
For a company that ships a screen with a microphone, a camera, or a recognition loop, the operational lesson is already in the February injunction, whether or not Tillery is certified. Say automatic content recognition. Say it samples the screen. Say the log is used for ads. Get an affirmative yes. Do not hide the control fifteen clicks down and call the feature a recommendation engine. The sentence in Samsung’s own notice, that it collects neither video footage nor content on the device, is the sentence this case will be tried on if it gets that far.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.