A report by cybersecurity firm Includesecurity indicates that certain free applications on Samsung and LG Smart TVs are using a Bright Data SDK to route third-party internet traffic through users' home networks. These Smart TVs function as "residential proxies" for tasks like web data collection or AI system training, potentially raising security and bandwidth concerns. The study highlights the lack of clear user consent for such practices.
This discovery highlights a significant security vulnerability where consumer hardware is repurposed as enterprise infrastructure without transparent consent. For the streaming industry, this practice threatens to degrade device performance and network reliability, potentially increasing churn for ad-supported services if users blame platforms for lag. As AI developers look for residential IP addresses to bypass anti-bot defenses, the living room becomes a primary target for data harvesting. Watch for whether Samsung and LG follow Roku and Google in implementing platform-level restrictions on proxy-based monetization SDKs.
Samsung moved quickly after the Includesecurity report surfaced. In August 2026, Samsung announced it was banning all apps that share users' internet connections and removing existing apps containing residential proxy functionality, stating it had already restricted new app registrations incorporating proxy SDKs on its Smart TV platform. The company said it was implementing strict platform-wide developer policies explicitly banning residential proxy SDKs. LG followed with a similar ban, completing its app removal process on September 15, 2026, after two months of purging apps from its webOS store.
The scale of the problem extended well beyond the initial Includesecurity findings. Spur Intelligence scanned 6,038 apps across LG webOS and Samsung Tizen and found residential proxy SDKs in 2,058 of them, or 34.1 percent overall, with LG webOS showing a 42.5 percent contamination rate and Samsung Tizen at 26.9 percent. Bright Data, Bright Data Ltd, and Bright SDK accounted for 367 proxy-flagged apps in the dataset, while Honeygain UAB, a subsidiary of Oxylabs, appeared as publisher on another 16. The consent mechanism typically involved a single prompt during installation or first launch, often buried in terms of service that users rarely read.
The broader ecosystem response has been uneven. Amazon, Roku, and Google TV had already banned IPIDEA, another residential proxy provider, and restricted the new Bright Data network before Samsung and LG issued their own bans. The research also highlighted a critical security gap: while Bright Data's SDK ships with a blocklist covering private IP ranges including 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, other proxy providers' SDKs lacked comparable private-range filtering, potentially exposing home network devices such as routers, NAS systems, and cameras to external traffic.
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source