Your smart TV may be crawling the web for AI

This is Lowpass by Janko Roettgers, a newsletter on the ever-evolving intersection of tech and entertainment, syndicated just for The Verge subscribers once a week.

These days, if you sign up for a new streaming service, you generally have two options: Either pay a massive premium for an ad-free experience, or endure frequent commercial breaks and all the sneaky tracking that comes with ad targeting.

Web data aggregator Bright Data has been pitching streaming service operators on an alternative approach for apps running on Samsung’s Tizen and LG’s webOS platform — one that comes without ads and sky-high fees. All publishers have to do to unlock a new revenue source is integrate the company’s Bright SDK into their TV apps and convince viewers to opt into Bright’s monetization network.

“We don’t do any kind of tracking,” explained Bright Data’s chief product officer, Ariel Shulman, during a webinar for streaming industry insiders two years ago. “We work silently in the background, and completely anonymously. Users don’t actually see or don’t feel anything.”

The catch? With Bright’s SDK, a viewer’s smart TV becomes part of a massive global proxy network that crawls and scrapes the web. Including apps running on desktop PCs and mobile devices, the company claims to operate 150 million such residential proxies worldwide. Together, these devices gather petabytes of public web data from a wide range of different locations and IP addresses. This approach allows the company to capture localized versions of websites, but also helps to circumvent web crawler blacklists. The gathered data is then resold to companies to train AI models, among other things.

Here’s how Bright’s smart TV partnerships work: When a consumer downloads and installs a participating app, they’ll see an opt-in screen asking them to confirm their willingness to participate in Bright’s proxy network. For instance, for an app called Petflix that was until recently available on the Roku app store, the note reads:

“To enjoy Petflix for free with fewer ads, you are allowing Bright Data to occasionally use your device’s free resources and IP address to download public web data from the internet. Bright Data will only use your IP address for approved business-related use cases. None of your personal information is accessed or collected except your IP address. Period.”

“Our network is based on consensual individual participation,” explains Bright Data spokesperson Jennifer Burns. “All users can opt-out at any time via a fast two-click process.”

Once a consumer opts in to Bright Data’s network, their smart TV starts downloading publicly available webpages as well as audio and video data, which is then forwarded to Bright’s cloud servers. The company claims to only do so when it doesn’t impact the device’s bandwidth or processing capacities, with Shulman saying that individual devices download only around 50MB of data per day. In reality, there is no way for a user to know whether the SDK downloads web data at any given moment.

In some cases, your smart TV may even crawl the web for Bright as soon as you turn it on. “On some operating systems, […] our SDK is given permissions by the user to run in the background,” Shulman explained during his webinar. “This means that our monetization continues even if the app itself is not running.” All it takes for consumers is to run the app once and opt in to Bright’s network, and the device will keep crawling the web every day until they opt out again or uninstall the app.

Bright Data is not the only company operating such residential proxy networks. Some of its competitors have come under fire for unsavory business practices. Last month, Google took action against the IPIDEA network, which Google’s Threat Intelligence Group called “the world’s largest proxy network.” IPIDEA worked with a number of SDK providers to distribute its code in third-party apps, including on smart TVs.

Once devices were enrolled in its network, IPIDEA’s operators allegedly rented out those resources to hacking groups in China, North Korea, Iran, and Russia. “We […] observe IPIDEA being leveraged by a vast array of espionage, crime, and information operations threat actors,” Google’s Threat Intelligence Group wrote in a January blog post.

To be clear: Google’s security researchers did not draw any connection whatsoever between IPIDEA and Bright Data, and Bright goes to great lengths to set itself apart from bad actors. “Our SDK, along with all of our technology, is reviewed by Apesteem, Google, McAfee, and more, and audited regularly, most recently by PwC,” says Burns. “Bright SDK implements rigorous partner selection criteria and vets every application through strict compliance processes.”

The company has nonetheless been impacted by a broader backlash against residential proxy activities. Google has adopted policies against proxy SDKs running in the background, and is now telling developers that they’re only allowed to use proxy services “in apps where that is the primary, user-facing core purpose of the app.” Amazon added a provision to its developer policies that outright bans “apps that facilitate proxy services to third parties.” Roku also bars developers from using Bright SDK and similar proxy services.

All those changes have made it more difficult to figure out how widespread the use of the SDK on smart TVs actually is. A few dozen Fire TV apps still mention the SDK on Amazon’s app store, but don’t appear to make use of it anymore. I was able to download a few apps from Roku’s store that were still using the SDK, including the aforementioned Petflix app. However, those apps disappeared from the store after I contacted Roku for this story.

New restrictions against proxy SDKs have had a direct impact on Bright’s addressable market in the smart TV space. The company used to pitch its solution to Roku, Android TV, and Fire TV app developers, but Burns tells me that it no longer supports these platforms. Bright does still list Samsung’s Tizen OS and LG’s webOS as supported smart TV platforms, and has published more than 200 first-party apps to LG’s app store alone. LG spokesperson Léa Lee tells me that Bright SDK is “not officially supported by LG, and their operation on the webOS platform is not guaranteed.” Samsung did not respond to multiple requests for comment.

There are arguably many legitimate use cases for web crawling. “Our network serves exclusively legitimate purposes, supporting journalists, non-profits, academic researchers, cybersecurity companies, and other leading businesses worldwide,” says Burns.

The problem is that consumers have no idea whether that legitimate purpose is something that aligns with their own personal values. Case in point: Bright Data does support a number of nonprofits, including some that use its proxy network to track hate speech on social media. However, the company also works with AMCHA Initiative. The group maintains an “anti-zionist faculty barometer” and includes student and faculty statements against Israel’s war in Gaza, as well as calls for schools to divest from the country, in its antisemitic incident tracker.

With AI companies facing scrutiny over their environmental impact, treatment of intellectual property, and potential to replace human labor, some consumers may also feel uneasy about their TVs gathering data to train AI models.

Now, some consumers may decide that such concerns are overblown, and willingly opt in to Bright’s network if it means that they get to watch fewer ads or pay less for their streaming services. I, for one, would rather watch an extra ad break or two.