Smart TV spying: Roku lost $356M on TVs and made $9.5B on you

Short answer: Yes, your smart TV is watching you, and the money proves it is the whole point. From Q2 2021 to Q2 2026 Roku lost $356 million selling hardware and made $9.51 billion in gross profit from the "platform" (ads, data and subscriptions) that runs on it. Vizio's last public filings show the same thing: in 2023 its TVs lost money and its ad platform made 102% of its gross profit. The TV is the bait. You are the product. And this month, AI coding agents finally gave regular people a way to take the TV back.

TL;DR: We pulled every Roku 10-K and 10-Q since 2019 from SEC EDGAR and split gross profit by segment: devices lost money in 19 of the last 21 quarters while the platform earned $9.51 billion. A Northeastern University study of 12 TVs and 5,943 test runs found Vizio kept sending traffic to its content-recognition endpoint in 100% of runs after users opted out, and Samsung did it in 41 of 60 antenna runs. Meanwhile one AI-written debloat repo, cleanyourtv, hit 32,184 GitHub stars in seven days, and the only thing slowing the jailbreak wave down is the AI labs themselves.

Key numbers

What	Number	Source, checked Oct 25 2026
Roku platform gross profit, Q2 2021 to Q2 2026 (21 quarters)	$9.51B on $17.52B revenue	Roku 10-K/10-Q, SEC EDGAR, our pull
Roku device gross profit, same 21 quarters	-$356M, negative in 19 of 21 quarters	Roku 10-K/10-Q, SEC EDGAR, our pull
Roku platform share of gross profit, last 12 months to Q2 2026	102% ($2.43B platform, -$55M devices)	SEC EDGAR, our math
Vizio ad platform share of gross profit, 2019 vs 2023	24% to 102% (TVs: -$8.6M)	Vizio 2023 10-K
Fox's price for Roku, per share	$96 cash + 0.9693 Fox shares; 81.5% of Roku votes for, Oct 14 2026	Roku 8-K filings
Vizio opted-out runs still sending ACR traffic	100%	Northeastern, Watching the Watchers
Samsung opted-out antenna runs with ACR-like traffic	41 of 60	Northeastern, Watching the Watchers
log4j's Samsung root shell post	1.41M views, 20,774 likes	X, @log4j
cleanyourtv GitHub stars, 7 days old	32,184 (3,753 forks)	GitHub API, our pull

The TV is a loss leader. The math is in Roku's own filings

Roku reports two businesses. "Devices" is the hardware: streaming sticks, players, and Roku-branded TVs. "Platform" is everything that happens after you plug it in: home screen ads, ad-supported channels, data-driven ad sales and a cut of subscriptions you sign up for through the box.

We pulled the segment numbers straight out of the inline XBRL in every Roku 10-K and 10-Q on SEC EDGAR, back to Q2 2018. Through 2020 the hardware still made a little money, a few million dollars a quarter. Then in Q2 2021 it flipped negative and basically never came back.

Over the 21 quarters from Q2 2021 to Q2 2026, Roku's devices brought in $2.71 billion of revenue and lost $356 million at the gross profit line. In the same stretch the platform made $9.51 billion in gross profit. Only two of those 21 quarters showed a hardware profit: Q1 2023 ($3.6 million) and the latest, Q2 2026 ($26.9 million).

Read that as a business plan, because it is one. Roku sells you the screen below cost and makes it back by renting your living room to advertisers. In the last 12 months the platform made $2.43 billion of gross profit while devices lost $55 million, so the platform is 102% of the company's gross profit. The hardware is a cost center with a remote.

Vizio ran the same play, then Walmart bought it

Vizio was the cleanest version of this before it went private. Its 10-K filings split revenue into product (the TVs and soundbars) and service (Platform+, its ad and data business). In 2019, the ad platform was 24% of Vizio's gross profit. By 2023, TVs made -$8.6 million on $1.08 billion of revenue and the platform made $364.9 million, or 102% of gross profit.

Walmart now owns Vizio, Vizio accounts are becoming Walmart accounts, and by March 2026 new Vizio TVs needed a Walmart account to use the smart features, per Ars Technica. That is not a TV company buying a TV company. That is the biggest retailer in America buying a camera pointed at millions of couches and tying it to your shopping account. Our read: the TV is now a checkout lane.

Follow the money: Fox just paid up for your viewing data

Here is the receipt that settles the "who is the customer" debate. On June 14 2026 Roku agreed to be bought by Fox for $96 in cash plus 0.9693 Fox Class A shares per Roku share, a deal AP put at $22 billion. Roku stockholders approved it on October 14: 241.0 million votes for, 0.5 million against, 81.5% of all shares outstanding.

Fox did not pay that for a stick that loses money. It paid for the platform: the home screen, the ad inventory and the viewing data from tens of millions of TVs. The fairness math in the deal filings runs on projected cash flows and $2.43 billion of projected cash, not on hardware margins. A broadcaster buying the box that tells it what you watch is the most honest thing that has happened in TV in a decade.

Who wins: Fox, Roku shareholders, the ad buyers who get household-level targeting. Who loses: the person who paid $300 for a TV and became inventory.

Opting out does not mean they stop watching

ACR (automatic content recognition) is the tech underneath all of this: the TV fingerprints whatever is on screen, from apps, antenna or even your HDMI game console, and phones home to match it. That match is what Platform+ and Roku's ad business sell.

A Northeastern University team tested 12 TVs from 10 brands covering about 95% of the US smart TV market, across 5,943 automated runs, with ACR on and off. Opting out fully worked on four systems: LG webOS, Sony Google TV, VIDAA and Fire TV. Then it gets ugly.

Vizio kept sending traffic to its Amazon Kinesis ACR endpoint in 100% of opted-out runs, with no drop at all. Samsung, which runs 34% of US smart TVs per the study, sent ACR-like traffic in 41 of 60 opted-out antenna runs, 18 of 30 HDMI runs and all 30 runs on its own streaming service. Roku OS on a TCL set leaked in 9 of 90 antenna runs.

And on VIDAA, the researchers say detection results were readable on the server unencrypted: more than 57 million detections tagged to more than 1 million TVs, sampled in about three hours. The toggle in your settings menu is, in too many cases, decoration.

Then a hacker rooted his Samsung, and 1.4 million people watched

On October 21 the security researcher @log4j posted that his 2025 Samsung TV kept serving "weirdly targeted ads", that the firmware was AES-encrypted, so he went the zero-day route: "root shell on new samsung TVs! discovered PRIVACY HORROR." The post has 1.41 million views, 20,774 likes and 7,294 bookmarks.

"always on hot mic functionality btw. PLUS: automatic content recognition, geo positioning, network mapping, a targeted ads service, 4 distinct drm services, user profile building and so much more juicy telemetry! just you, God, a $3000 TV and samsung + their 400 partners!" (@log4j, Oct 21 2026)

Those are his findings, not ours, and the write-up is still coming. Hacker News commenters pushed back that some listening features (dog barks, baby crying) are advertised SmartThings features. Fair enough on the feature list. But "it is in the manual" is not consent when the opt-out does not work, and the Northeastern data says Samsung's often does not. He says he plans an open-source, zero-telemetry custom OS you can flash, with a firmware backup first. He also tagged @GamersNexus, who already went after LG's TVs on this. Steve, the Samsung sequel writes itself.

The thread hit 494 points and 205 comments on Hacker News, and 2026 is already the biggest year for "smart tv" on HN since at least 2015: 2,557 points on matching stories, past 2022's 2,164.

AI made jailbreaking a TV a weekend job

This is the part the TV makers did not price in. Rooting a TV used to mean UART cables, a soldering iron and a forum account. In October 2026 it means pasting a prompt into a coding agent.

TechCrunch's Sarah Perez tallied the wave on October 19. Gathin T. (@gathint) used Claude Code to strip 25 Xiaomi packages off his parents' TV and write a new launcher, then published the prompt. Mihir Gupta replaced a 192 MB stock launcher with an 83 MB custom one. Muzzammil Yasin Sabuwala (@DevMuzzammil) built dumbtv with DeepSeek V4.1 Flash, Claude Opus 5.5 and Claude Sonnet 5.5.

We pulled the repos. Gathin's cleanyourtv went from zero to 32,184 stars and 3,753 forks in seven days, roughly 4,100 stars a day. free-my-tv, an ad-free home screen for Google TV, LG and Samsung, has 4,330 stars in five days. dumbtv has 1,493. Five TV-debloat repos created between October 11 and 21 hold 38,134 stars between them. That is not a niche. That is a consumer revolt with a git history, and lowkey the best AI use case of the year.

The AI labs are the new bouncers, and they are guarding the wrong door

Here is the twist. The biggest friction in this wave is not Samsung's encryption. It is the AI labs.

TechCrunch reports that some users' simple "hack my TV" prompts to Claude got no response until they rewrote them. A post on r/LocalLLaMA titled "OpenAI and Anthropic blocked the reverse engineering of smart TVs spying on us" pulled 295 upvotes. Under log4j's Hacker News thread, the top comment debated whether OpenAI had banned him over it, and user technion wrote that "Claude is absurdly sensitive to anything that touches cyber, and threatens bans." Nobody has published proof of a ban tied to the TV work yet. The fact that a pro researcher has to wonder is the story.

Now the irony. In April, the security firm Calif published "Codex Hacked a Samsung TV": OpenAI's Codex took a browser foothold on a Samsung set and escalated to root on its own, and Calif thanked "OpenAI for partnering with us on this project." So TV hacking is a great launch-blog demo when a partner does it, and a policy flag when you do it to the TV you own. Make it make sense.

We get why the labs are jumpy: the same prompt that roots your TV can root someone else's. But the "safety" line is being drawn in a place that protects a $9.5 billion ad business from its own customers, while the open-weights models in dumbtv's stack just do the job. Our bet: every refusal like this pushes another wave of power users to local and Chinese open models, the same shift we tracked in Kimi K3.1's price war. You own the TV. You should be allowed to ask a machine how it works.

Where this goes next

Three predictions, labelled as ours. One: the TV makers answer with locked bootloaders and "security" firmware that kills the exploits, the same way Nvidia is likely to treat the RTX 3090 unlock. Two: someone sells a "dumb mode" TV at a premium, because privacy is about to become a paid tier. Three: the first regulator to make ACR opt-in by default, not opt-out, takes a real bite out of Platform+ style revenue, which is exactly why the industry will spend on lobbying before it spends on fixing the toggle.

The deeper read: hardware subsidized by surveillance only works while hacking it is hard. AI just made it easy. That is the whole business model with a crack down the middle, and no cap, the crack is 32,000 stars wide.

What this means for you

• Check your TV's ACR setting tonight. On Samsung it hides under privacy as "Viewing Information Services", on Vizio as "Viewing Data", on LG as "Live Plus", on Roku as "Use info from TV inputs". Turn it off, then assume it may not fully work.
• Best fix: never connect the TV to Wi-Fi and use an external box over HDMI. The Northeastern study shows HDMI content still gets fingerprinted on some sets when the TV is online.
• On Android or Google TV, the open-source debloaters (cleanyourtv, dumbtv, free-my-tv) work over ADB without root and can be undone. Read the repo, back up first, and accept a small brick risk.
• If a hosted model refuses, rephrase around what you own and want to achieve, or run an open model locally.

If you want your AI agent to actually do the job you meant on the first try, whether it is debloating a TV or shipping an app, our $29 AI Builder Kit is five offline apps that keep your AI building what you meant, on any model including a local one. If it does not get your AI building what you meant, we keep working with you at no extra cost until it does.

More on the AI beat at the AI industry hub, the news desk and the LLM hub. Download the data below: data.csv has every Roku quarter by segment, plus vizio.csv, acr_optout.csv, debloat_repos.csv and hn_smart_tv.csv. Our question for you: should AI labs refuse to help you reverse engineer a device you own, or is "it is my TV" the end of the argument?

Sources

• Roku, Inc. 10-K and 10-Q filings Q2 2019 to Q2 2026, segment gross profit (inline XBRL), SEC EDGAR, our pull Oct 25 2026
• Roku 8-K, stockholder vote on the Fox merger, filed Oct 15 2026; merger terms from Roku's 8-K filed Jun 15 2026
• VIZIO Holding Corp. 10-K filings FY2021 to FY2023, product vs service, SEC EDGAR, our pull Oct 25 2026
• Northeastern University, Watching the Watchers: Analysis of U.S. Smart TV Automatic Content Recognition, 2026, checked Oct 25 2026
• @log4j, root shell on new Samsung TVs thread, Oct 21 2026, counts via fxtwitter Oct 25 2026
• Hacker News, Root shell on Samsung TV, 494 points, 205 comments, checked Oct 25 2026
• Sarah Perez, TechCrunch, People are using AI to make their smart TVs dumb again, Oct 19 2026
• Calif, Codex Hacked a Samsung TV, Apr 13 2026
• r/LocalLLaMA, OpenAI and Anthropic blocked the reverse engineering of smart TVs spying on us, checked Oct 25 2026
• Ars Technica, Newly purchased Vizio TVs now require Walmart accounts, Mar 2026
• AP via Hacker News, Fox buying Roku in deal worth $22B, Jun 15 2026
• GitHub API: cleanyourtv, free-my-tv, dumbtv, vetro, r2d2-tv, our pull Oct 25 2026
• HN Algolia search API, stories matching "smart tv" by year, our pull Oct 25 2026
• Our data: data.csv, vizio.csv, acr_optout.csv, debloat_repos.csv, hn_smart_tv.csv