A connected TV is the one measurement target on this wiki where you do not control the browser, cannot install a certificate, cannot drive the page, and cannot get a list. Almost nothing in Crawler transfers. That is not a warning at the top of the page; it is the whole page.

Four things break a web-trained intuition, and everything below follows from them.

1. The device is the browser, and it is somebody else's. A smart TV runs a closed OS (Tizen, webOS, Roku OS, Fire OS, Android TV / Google TV) that you cannot instrument from the inside. Your vantage point is the network the TV sits on, and whatever remote-control API the vendor happens to expose.
2. The TV reports what is on screen. Automatic content recognition (ACR) samples the panel — including the HDMI input from your games console or set-top box — and sends a fingerprint to the manufacturer. This is a measurement object with no web analogue at all: there is no page, no request initiated by a tracker, and no script to attribute it to.
3. There is a broadcast side. HbbTV rides the DVB signal and launches an application from the broadcaster the moment you tune to a channel, before any consent interaction exists. A crawler that only speaks HTTP cannot see this channel, and a vantage point on the Internet cannot reach it.
4. There is no Tranco for televisions. Nothing versioned, nothing archived, nothing citable. In this corpus the median stated device-set size is 66, and 14 of the 20 papers that state one never exceed 96 — but that median is dominated by general IoT testbeds. The studies that are actually about televisions are far smaller: the two ACR papers use 2 and 3 sets, and the largest TV-specific bench is 57.

Everything on this page about “the literature” is a claim about seven venues — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, 5,859 papers with extracted full text (Corpus). Connected-TV work also appears at ACM TVX/IMX, MMSys, NOSSDAV, ACSAC and EuroS&P, none of which are in the corpus, so read the counts as “how these seven security, privacy and networking venues treat televisions”, not as the size of the field.

Six papers, each here for a methodological reason rather than a topical one.

1. [1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] — the instrumentation paper. Two platforms, 1,000 channels each, an automated crawler built on the vendors' own remote-control APIs, and an honest account of what TLS interception could and could not reach. Read Section 3 before you buy hardware.
2. [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — the one that quantifies its decryption hole. Roku and Fire TV, testbed and in-the-wild traffic. Three of the thirteen Tier A papers say somewhere that they could not decrypt everything; this is the only one that publishes a per-app TLS decryption failure distribution rather than a sentence.
3. [3Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — the app-analysis route. 4,745 Android TV APKs pulled apart statically, plus intercepted traffic from a small subset. The bridge between this page and Mobile and app measurement.
4. [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] — the broadcast side. HbbTV across 36 European channels on real televisions, with a survey of what viewers know about it. There is no other way into this material.
5. [5Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — ACR, measured. Two televisions, two countries, six viewing scenarios, and the first look at what the TV itself sends about what you are watching.
6. [6Ahn, Jungun; Jung, Sueun; Yoo, Seungwan; Park, Jungheum; Lee, Sangjin (2025): "Watch Out Your TV Box: Reversing and Blocking a P2P-based Illegal Streaming Ecosystem", in: Proceedings of the USENIX Security Symposium. (Link)] — the piracy set-top box. Reverse-engineering a device sold specifically to deliver infringing streams; the corpus's most recent Tier A paper and a reminder that “connected TV” includes hardware nobody ships a developer programme for.

Two more are worth reading for what they are not about. [7Oren, Yossef; Keromytis, Angelos D. (2014): "From the Aether to the Ethernet—Attacking the Internet using Broadcast Digital Television", in: Proceedings of the USENIX Security Symposium. (Link)] attacks televisions over the broadcast band in 2014 and is the ancestor of all the HbbTV work. [8Rye, Erik C.; Levin, Dave (2024): "Surveilling the Masses with Wi-Fi-Based Positioning Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] is a Wi-Fi-positioning paper in which streaming devices turn out to be two of the five most common vendor prefixes in a 490-million-entry dataset — a TV result nobody filed under “TV”.

The extraction has no “television” flag, and the platform enum offers only web, mobile, iot, other-online-service, offline and not-applicable. The population below is therefore hand-audited against a written rule, from a full-text candidate pool rather than from titles. The rule, the audit and every rejection are on connected_tv.

A television-class endpoint is a smart TV set, a TV operating system (Android TV / Google TV, tvOS, Tizen, webOS, Roku OS, Fire OS), a streaming stick, box or set-top box, an app running on one, or the broadcast path (HbbTV / DVB) into one.

Where they are, as a share of each venue's own output — IMC is the venue for this work and TheWebConf has published none of it:

And when, which is the finding a reader planning a study most needs:

2025–2026 is provisional by construction — CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and WWW 2026 are incompletely selected (Corpus). Even so, the last two years contain exactly one Tier A paper, and it is about a piracy box. Nobody in these seven venues has re-measured smart-TV tracking since 2024.

The roadmap row that queued this page noted that only one of its 16 title-probe candidates carried the web platform. On the derived population the figure is the same and it is not a weakness of the candidate set — it is the property being described:

The single web paper is [9Vetrivel, Swaathi; Eeten, Michel van; Gañán, Carlos (2026): "Missing, Present and Conflicting: A Large Scale Analysis of IoT Update Information in the EU Market", in: Proceedings of the USENIX Security Symposium. (Link)], which crawls EU online stores for update-support disclosures and never touches a television. Concretely: 6 of 35 papers fall inside the corpus-wide crawled population at all, and 20 of 35 draw a population whose unit is iot-devices. If you go looking for this literature with a web-measurement query, you will find almost none of it — which is also why so much of it is invisible to the reviewers who will read your paper.

There are four vantage points and they answer different questions.

Counts are matches of a full-text probe, printed per paper in the report script — a mention is not a use, and the per-paper matrix is on connected_tv.

The router-capture row is the one to internalise. A connected-TV measurement is, by default, a network measurement: you are recording a device's traffic from outside it, the way DNS and Internet scanning record other people's hosts, not the way Crawler records a page. Everything the web side gets for free — a script's URL, a cookie's Set-Cookie header, a request's initiator chain — has to be reconstructed from flows, and most of it cannot be.

Mobile and app measurement owns the general pinning problem and the Frida toolchain; do not re-read it here. What that page cannot tell you is that on a TV the first step usually fails: there is often no way to install a root CA at all, because the platform exposes no certificate store to the user and no root shell to the researcher.

Two consequences a reviewer should ask about and almost nobody reports.

Your coverage number is platform-specific, not study-specific. A paper that says “we intercepted TLS” over a mixed device set is reporting an average of 95% and 4%. Report per platform or do not report at all.

Most papers do not quantify the hole. Of the 13 Tier A papers, 3 say somewhere that they could not decrypt or intercept everything, or that pinning had to be bypassed: [1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] (Frida, “to bypass certificate pinning” on the Fire TV stick), [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (“we cannot install our own self-signed certificates on the Roku”) and [3Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (“there is no way to install custom certificates on Android TV”, so the APKs were instrumented to remove the pinning checks instead). Only one turns that into a number: [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)] publishes the distribution — “1 out of 5 (or fewer) TLS connections for 80% of all apps”. That single sentence is the thing to copy.

This paragraph is a worked example of why a probe width is a claim. An earlier version of this page ran a narrow regex (could not decrypt, failed to decrypt, decryption fail, unable to decrypt|intercept) over the same 13 papers, matched 1, and printed “almost nobody reports the hole” — while quoting, three sections earlier, two of the sentences the regex had missed. Widening it to include cannot install … certificate, bypass … pinning and no way to install custom certificates takes the count from 1 to 3. Both widths are printed by the report script, which also asserts that the narrow set is a subset of the wide one — if a narrowing probe ever returns more, it is broken, not informative.

A web crawler navigates. A TV has to be operated, and the automation interface is whatever the vendor shipped for its phone app. Two real examples, both from [1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]:

# Amazon Fire TV — Android underneath, so adb works
adb shell input keyevent 21          # "left"

# Roku — External Control Protocol, an unauthenticated HTTP API on port 8060
curl http://ROKU_DEVICE_IP_ADDRESS:8060/keydown/left

Roku's ECP is documented by Roku itself as “a simple RESTful API accessed using HTTP on port 8060”¹⁾ and can launch channels, send keypresses and return query/device-info. It carries no authentication — which is why [1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] both used it to automate crawls and noted that it had been found vulnerable to DNS rebinding.

For Android TV, adb over the network is the equivalent, and the version threshold is TV-specific: Android's own documentation puts wireless debugging at Android 13 (API 33) or higher for TV and WearOS, against Android 11 for phones; below that you need the older adb tcpip 5555 route, which requires a USB connection first. The same page notes that Android 17 introduces “adb Wi-Fi 2.0”, which auto-connects a device to the workstation on a trusted network — so the pairing step this section describes is already changing under you.²⁾ On a TV that has no accessible USB-debug port, that distinction decides whether the study is possible.

Three things that will bite you and that no paper warns you about:

• Screen state is part of your measurement. [13Aafer, Yousra; You, Wei; Sun, Yi; Shi, Yu; Zhang, Xiangyu; Yin, Heng (2021): "Android SmartTVs Vulnerability Discovery via Log-Guided Fuzzing", in: Proceedings of the USENIX Security Symposium. (Link)] captured HDMI output externally and compared before/after signals precisely because a TV can fail visually and audibly without producing a log line — 16 of its 37 discovered vulnerabilities are “visual and auditory anomalies” that no crash handler would report.
• The remote control is a side channel, not just an input. [14Huang, Kong; Zhou, YuTong; Zhang, Ke; Xu, Jiacen; Chen, Jiongyi; Tang, Di; Zhang, Kehuan (2023): "HOMESPY: The Invisible Sniffer of Infrared Remote Control of Smart TVs", in: Proceedings of the USENIX Security Symposium. (Link)] recovers 47% of typed strings at rank 1 from infrared remote signals sniffed by a neighbouring IoT device, and [15Kannan, Tejas; Wang, Synthia Qia; Sunog, Max; Mesquita, Abraham Bueno de; Feamster, Nick; Hoffmann, Henry (2024): "Acoustic Keystroke Leakage on Smart Televisions", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] recovers up to 60.19% of common passwords within 100 guesses from the TV's own keyboard sounds. If your protocol has participants type anything on a TV, that is a disclosure your ethics section owns.
• On-screen keyboards make text entry expensive. Registering accounts, accepting consent dialogues and logging in are what Registration calls a cost on the web; on a D-pad they are the reason TV studies have samples of tens rather than thousands.

ACR is the reason this page exists as something other than a subsection of Mobile and app measurement. It is the television reporting what is on its own screen, back to its manufacturer, on a timer.

It is a different measurement object from a tracker. There is no page, no third-party request initiated by embedded content, no script to attribute, and nothing a filter list can match on by origin. The only observable is periodic traffic from the TV's own first-party domains, which is precisely the traffic every other method on this wiki is designed to exclude as benign.

The nearest thing the corpus has to an ancestor is ultrasonic cross-device tracking, where a beacon emitted by a television advertisement is picked up by an SDK in a phone in the room [16Mavroudis, Vasilios; Hao, Shuang; Fratantonio, Yanick; Maggi, Federico; Kruegel, Christopher; Vigna, Giovanni (2017): "On the Privacy and Security of the Ultrasound Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. That is the mirror image of ACR — the TV emits and the phone listens, rather than the TV watching and reporting — and the method there was Android app analysis, not TV instrumentation. It is adjacent work, not a precedent for how to measure ACR.

[5Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] is the corpus's only ACR measurement and its population is two televisions — one LG and one Samsung — run in the UK and the US across six one-hour viewing scenarios. Its findings, with that denominator in front of them:

• ACR traffic exists when watching linear broadcast TV and when the TV is used as an external display over HDMI. Nothing about the source of the picture stops the reporting.
• The two vendors differ in cadence. LG's ACR network traffic appears every 15 seconds; Samsung's once per minute. The paper reads these as batching intervals over much faster on-screen capture — 10 ms for LG, 500 ms for Samsung — rather than as the sampling rate itself.
• Opting out worked, on these two sets. After the opt-out, the paper reports “a complete absence of communication with any previously identified ACR domains”.
• The UK and US televisions contacted distinct ACR domains, so an ACR result is a result about one jurisdiction's configuration.
• Login status made no material difference.

One paper, two devices, 2024. Treat every ACR number as a case study, and note that the corpus contains no replication and no larger device set.

This is the one area on this wiki where the regulatory file is a richer source than the venues, and reading it first will stop you re-measuring a configuration that no longer exists.

Sony, Hisense and TCL have not settled. The Attorney General has published agreements with Samsung and LG only; as of 2026-09-12 no settlement, dismissal or further order for the other three appears on its newsroom. So the timeline above is the beginning of a proceeding, not the end of one, and a 2026 measurement of a Sony, Hisense or TCL set is measuring a product whose behaviour is still contested in court. Europe is not empty, and an earlier version of this page said it was. Two European actions were missed on the first pass because both describe the phenomenon without using the words “ACR” or “automatic content recognition”, so an ACR-shaped search cannot see them. They are the two rows added to the table above, and the first of them is the most directly useful document on this page for a measurement researcher: a supervisory authority ran the experiment, on a three-device testbed, and published a per-power-state breakdown of where the traffic went. Read it as a paper. What still appears to be absent — searched on 2026-09-13, and this is a negative result from a search, not from the corpus — is any EU or UK fine or enforcement order specifically about smart-TV data collection. Guidance and a joint investigation are not an order, and the Texas record remains the only place a television's behaviour has been changed by a legal instrument.

Three things follow for a study designed today. The 2024 measurement is a pre-order baseline for exactly the two vendors that have since settled, which makes a replication unusually valuable and unusually easy to justify. A US measurement after February 2026 is measuring a consent flow, not a default, and needs the Consent apparatus — accept, reject, no-interaction — that the ACR literature has never applied. And the Texas filings' “every 500 milliseconds” sits alongside the paper's 500 ms Samsung capture estimate; agreeing with a regulator's pleading is not verification, so say which one you are citing for what.

HbbTV (Hybrid Broadcast Broadband TV) is a European standard that lets a broadcaster ship an application descriptor in the DVB transport stream. Tune to a channel and the television fetches and runs the broadcaster's HTML application over the Internet, unprompted.

For a measurement this changes three things at once:

1. The trigger is a radio signal, not a URL. You cannot reach it from a cloud vantage point. [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] needed real televisions in the broadcast footprint, and [7Oren, Yossef; Keromytis, Angelos D. (2014): "From the Aether to the Ethernet—Attacking the Internet using Broadcast Digital Television", in: Proceedings of the USENIX Security Symposium. (Link)] needed a transmitter: its attack retransmits a modified DVB-T multiplex, and it costs a 1 W amplifier to cover a 1.4 km² area.
2. The application runs before anything resembling consent. [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] found that of 36 European TV channels, 26 communicated with trackers before the user had expressed any consent — the TV equivalent of the pre-consent cookie measurements on Consent, but with no cookie banner in the path and no CMP to detect.
3. Filter lists do not cover it. In the same study, common tracking denylists blocked “at maximum 44% in 2021 and 81% in 2022” of the domains the authors had manually identified as tracking. That is a coverage hole of a different order from the web figures on Filter lists — and see that page for the companion smart-TV row, where the best of four DNS blocklists blocked 22% and 27% of contacted FQDNs in the Roku and Fire TV app ecosystems [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)].

The current specification is HbbTV 2.0.5, published 2026-02-25, an incremental update over 2.0.4 (March 2023) adding DRM and WebAssembly recognition and correcting the accessibility and DVB-I material introduced in 2.0.4.¹²⁾ A 2023 measurement is therefore two specification revisions old.

The North American analogue is ATSC 3.0 / NextGen TV, which ATSC describes as offering “more accessibility, personalization and interactivity” over the current standard and which it states reaches “more than 76% of U.S. households” as of its July 2026 deployment map.¹³⁾ No paper in these seven venues measures it, and that is the largest single gap on this page.¹⁴⁾

What a measurement would find is written down. The broadcaster-application layer is standardised as A/344, “ATSC 3.0 Interactive Content” — current revision A/344:2026-04, 14 April 2026 — and a broadcaster application is an HTML5 document in a W3C User Agent talking to the receiver over a JSON-RPC WebSocket. Three parts of it are directly measurable, and each has a web analogue that does not behave the same way.

• A normative advertising identifier. The Query Device Info API returns deviceId and advertisingId, the second “a persistent, globally unique UUID associated with advertising on the device”; the standard expects both to be “initialized once by the Receiver to afford long-term persistence across all Services and Receiver power cycles”. Opt-out is observable rather than inferred: a refused identifier comes back as all zeros (urn:uuid:00000000-0000-0000-0000-000000000000), and an unsupported one is absent, so a measurement can tell “the user declined” from “this receiver does not implement it” without guessing. That is a cleaner signal than any of the platform identifiers below.
• Personalisation is a broadcaster-defined integer. filterCode is “an unsigned integer associated with personalization categories as determined by the broadcaster”, carried in Filter Code Instances that have their own expiry. The category vocabulary is not in the standard, so recovering what a code means is a measurement problem rather than a lookup: there is no published vocabulary to join against, and no equivalent of the shared, inspectable rule sets that Filter lists describes for web requests.
• Cookies, on the television. The broadcaster application “is expected to manage a local name space for setting cookies and other local User Agent storage elements”, and “may choose to provide its own settings user interface and store the collected settings as cookies on the Receiver”. The object is the one Cookies is about; none of that page's instruments reach it, because there is no profile directory to read and no CDP to attach.¹⁵⁾

The regulator has got there first here too. The FCC's Fifth Further Notice of Proposed Rulemaking in GN Docket No. 16-142, adopted in October 2025, proposes to remove restrictions on the ATSC 1.0 simulcast whose “substantially similar” rule “was initially scheduled to sunset on July 17, 2023, and was extended to July 17, 2027”, and seeks comment on a list of outstanding NextGen TV issues that includes “The sunset of 1.0 service”, tuner and labelling standards, and — in its own one-word bullet — “Privacy”.¹⁶⁾ A measurement of what ATSC 3.0 broadcaster applications actually collect would be evidence in a live proceeding, and there is none.

Mobile and app measurement owns store scraping, static and dynamic analysis, and the reproducibility discipline for app sets. Everything there applies. Four things are different enough to state.

• There is no TV-specific archive, but Android TV apps are inside AndroZoo. The mobile page's whole first section is a comparison of bulk-download routes; for televisions there is no equivalent TV archive, no research access programme and no historical store-chart corpus — nothing you can cite a version of. What there is, for the Android-derived platforms only, is the general Android archive: [3Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)] pulled its 4,745 Android TV APKs from AndroZoo and APKMirror, having first found the package names through the Play Store, and [17Girish, Aniketh; Hu, Tianrui; Prakash, Vijay; Dubois, Daniel J.; Matic, Srdjan; Huang, Danny Yuxing; Egelman, Serge; Reardon, Joel; Tapiador, Juan; Choffnes, David R.; Vallina-Rodriguez, Narseo (2023): "In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] drew 1,348 comparison apps from AndroZoo the same way. So the sampling problem is not “no bulk source” — it is that AndroZoo has no TV facet, so you cannot ask it for TV apps; you have to arrive with package names you obtained somewhere else. For Roku, Tizen and webOS there is no archive at all and every paper built its own set.
• The store is the platform. The population sources these papers state are, verbatim: “Roku Channel Store” (3 papers), “Amazon Fire TV channel store”, “Fire TV app store”, “Amazon curated list 'Top Featured' apps”, “Apple iTunes Preview / Apple App Store”, “Roku-Top1K”, “FireTV-Top1K”. There is no cross-platform frame; a “top-1000 TV apps” result is a result about one vendor's chart on one day.
• Android TV apps are Android apps, and that is a route in. [3Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)] obtained 4,745 Android TV APKs and ran ordinary Android tooling on them — LibScout for third-party libraries, a customised FlowDroid for taint flows — finding “at least one sensitive data flow in 78% of the files”, advertising libraries in 77% and analytics in 75%. If your question is about SDKs rather than about the television, this is far cheaper than buying hardware.
• The same app is a different app per platform. [18Varmarken, Janus; Al Aaraj, Jad; Trimananda, Rahmadi; Markopoulou, Athina (2022): "FingerprinTV: Fingerprinting Smart TV Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] matched 80 apps available on Apple TV, Fire TV and Roku alike and found that “among 80 apps that are made available on all three smart TV platforms, 76% exhibit a different fingerprint on each platform”. Do not generalise a Roku finding to Fire TV.

Every major TV platform ships an IDFA-equivalent, and the vendor documentation is the primary source a reviewer will accept. These were checked on 2026-09-12:

Two measurement points follow. A TV advertising identifier is device-scoped, not app-scoped, so every app on the set shares it — which is why [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)] could count 697 Fire TV apps sending the advertising ID alongside a serial number and a device ID, an identifier pairing that defeats the reset. And the opt-out is a documented, testable control: run your crawl twice, once each side of it, and report the difference. Two papers in this population do that, five years apart and at different layers. [1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] repeated its whole Roku and Fire TV crawl with “Limit Ad Tracking” and “Disable Interest-based Ads” enabled, and concluded the countermeasures were “practically ineffective”. [5Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] crossed the ACR opt-out with login state into four conditions — logged in or out, opted in or out — which is the stronger design, because on a television the account is a second identifier the ad control does not touch.

There is no versioned, archived, citable ranking of televisions, TV apps or TV channels. What stands in for one, in this population:

The sizes are the story. 20 of the 35 papers state an iot-devices population size, 39 values between them, and the median stated value is 66 devices. Taking each paper's largest set, the median is 75.5 and 14 of the 20 never exceed 96 devices — that is the lab bench, and it is what a TV study looks like. Only six exceed it, and every one of them is a vantage point rather than a bench: 83,000,000 devices inferred from a security product's home-network scans [19Kumar, Deepak; Shen, Kelly; Case, Benton; Garg, Deepali; Alperovich, Galina; Kuznetsov, Dmitry; Gupta, Rajarshi; Durumeric, Zakir (2019): "All Things Considered: An Analysis of IoT Devices on Home Networks", in: Proceedings of the USENIX Security Symposium. (Link)], 7,000,000 set-top boxes in an IPTV operator's own logs [11Song, Han Hee; Ge, Zihui; Mahimkar, Ajay; Wang, Jia; Yates, Jennifer; Zhang, Yin; Basso, Andrea; Chen, Min (2011): "Q-score: proactive service quality assessment in a large IPTV system", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], 54,950 and 25,123 from device fingerprinting at scale [20Jakaria, Md; Huang, Danny Yuxing; Das, Anupam (2024): "Connecting the Dots: Tracing Data Endpoints in IoT Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)], 31,850 and 26,478 from public Wi-Fi [21Yu, Lingjing; Luo, Bo; Ma, Jun; Zhou, Zhaoyu; Liu, Qingyun (2020): "You Are What You Broadcast: Identification of Mobile and IoT Devices from (Public) WiFi", in: Proceedings of the USENIX Security Symposium. (Link)], 13,487 from a crowdsourced smart-home dataset [17Girish, Aniketh; Hu, Tianrui; Prakash, Vijay; Dubois, Daniel J.; Matic, Srdjan; Huang, Danny Yuxing; Egelman, Serge; Reardon, Joel; Tapiador, Juan; Choffnes, David R.; Vallina-Rodriguez, Narseo (2023): "In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], and 2,014 from vendor certificate collection [22Dong, Hongying; Shu, Hao; Prakash, Vijay; Zhang, Yizhe; Paracha, Muhammad Talha; Choffnes, David R.; Torres-Arias, Santiago; Huang, Danny Yuxing; Sun, Yixin (2023): "Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. A separate IPTV study puts roughly 3,000,000 set-top boxes behind its traces [10Gopalakrishnan, Vijay; Jana, Rittwik; Ramakrishnan, K. K.; Swayne, Deborah F.; Vaishampayan, Vinay A. (2011): "Understanding couch potatoes: measurement and modeling of interactive usage of IPTV at large scale", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — the paper's own words are “the average number of set-top boxes provisioned was approximately 3 million” — but the extraction files that tuple under unit other rather than iot-devices, so it falls outside the 20 by a taxonomy boundary, not by anything the paper did. Count it when you are asking how big an IPTV vantage point gets; do not count it when you are comparing device-set sizes.

The sampling methods say the same thing: purposive 19 papers, pre-existing-dataset 11, convenience 10, top-n 5, random 5. In the corpus as a whole top-n is the signature of web-measurement work (Sampling); here it is a minority route and it always means a store chart.

The network-vantage row deserves one warning of its own. Identifying a television from flow data is a classification problem with a published error rate, not a lookup: [8Rye, Erik C.; Levin, Dave (2024): "Surveilling the Masses with Wi-Fi-Based Positioning Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] found that two of the five most common vendor prefixes in its BSSID dataset belonged to Roku, and [23Ahmed, Dilawer; Das, Anupam; Zaffar, Fareed (2022): "Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)] reports that its own device classifier mislabels Roku TVs as other devices when generalised across datasets. If your denominator is “TVs seen in the wild”, that denominator has a confidence interval.

All figures below come from the 35-paper population, with the denominator named. The script is scripts/report_connected_tv.mjs; its unedited output and every query are on connected_tv.

Fifteen of the 35 papers are IoT studies in which a television is one row of a device table. That is the single most useful thing this table says: if you are planning a TV measurement, most of your “related work” is not about televisions, and the results you can borrow from it are per-device rows in appendices.

All fifteen are worth listing, because none of them is findable by searching for televisions: [24Ren, Jingjing; Dubois, Daniel J.; Choffnes, David R.; Mandalari, Anna Maria; Kolcun, Roman; Haddadi, Hamed (2019): "Information Exposure From Consumer IoT Devices: A Multidimensional, Network-Informed Measurement Approach", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (81 devices, the Mon(IoT)r lab set), [25Trimananda, Rahmadi; Varmarken, Janus; Markopoulou, Athina; Demsky, Brian (2020): "Packet-Level Signatures for Smart Home Devices", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (packet-level signatures), [26Zhu, Yanzi; Xiao, Zhujun; Chen, Yuxin; Li, Zhijing; Liu, Max; Zhao, Ben Y.; Zheng, Haitao (2020): "Et Tu Alexa? When Commodity WiFi Devices Turn into Adversarial Motion Sensors", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (a “Smart TV (& Sticks)” row with its own packet-rate measurement), [27Saidi, Said Jawad; Mandalari, Anna Maria; Kolcun, Roman; Haddadi, Hamed; Dubois, Daniel J.; Choffnes, David R.; Smaragdakis, Georgios; Feldmann, Anja (2020): "A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (IoT devices detected at an IXP), [28Paracha, Muhammad Talha; Dubois, Daniel J.; Vallina-Rodriguez, Narseo; Choffnes, David R. (2021): "IoTLS: understanding TLS usage in consumer IoT devices", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (TLS usage, TV category n=5), [29Mandalari, Anna Maria; Dubois, Daniel J.; Kolcun, Roman; Paracha, Muhammad Talha; Haddadi, Hamed; Choffnes, David (2021): "Blocking Without Breaking: Identification and Mitigation of Non-Essential IoT Traffic", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (which destinations a device can lose without breaking), [23Ahmed, Dilawer; Das, Anupam; Zaffar, Fareed (2022): "Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (device fingerprinting, with a per-device Roku TV row), [30Sharma, Rahul Anand; Soltanaghaei, Elahe; Rowe, Anthony; Sekar, Vyas (2022): "Lumos: Identifying and Localizing Diverse Hidden IoT Devices in an Unfamiliar Environment", in: Proceedings of the USENIX Security Symposium. (Link)] (hidden devices in unfamiliar rooms), [22Dong, Hongying; Shu, Hao; Prakash, Vijay; Zhang, Yizhe; Paracha, Muhammad Talha; Choffnes, David R.; Torres-Arias, Santiago; Huang, Danny Yuxing; Sun, Yixin (2023): "Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (vendor certificate practice, with a dedicated smart-TV capture), [17Girish, Aniketh; Hu, Tianrui; Prakash, Vijay; Dubois, Daniel J.; Matic, Srdjan; Huang, Danny Yuxing; Egelman, Serge; Reardon, Joel; Tapiador, Juan; Choffnes, David R.; Vallina-Rodriguez, Narseo (2023): "In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (local-network communication; explicitly leaves the smart-TV ecosystem to future work), [31Hu, Tianrui; Dubois, Daniel J.; Choffnes, David R. (2024): "IoT Bricks Over v6: Understanding IPv6 Usage in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (IPv6-only survivability), [20Jakaria, Md; Huang, Danny Yuxing; Das, Anupam (2024): "Connecting the Dots: Tracing Data Endpoints in IoT Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (tracing data endpoints), [32Maali, Eman; Alrawi, Omar; McCann, Julie (2025): "Evaluating Machine Learning-Based IoT Device Identification Models for Security Applications", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (evaluating device-identification models, with a Smart TV class), plus [19Kumar, Deepak; Shen, Kelly; Case, Benton; Garg, Deepali; Alperovich, Galina; Kuznetsov, Dmitry; Gupta, Rajarshi; Durumeric, Zakir (2019): "All Things Considered: An Analysis of IoT Devices on Home Networks", in: Proceedings of the USENIX Security Symposium. (Link)] and [21Yu, Lingjing; Luo, Bo; Ma, Jun; Zhou, Zhaoyu; Liu, Qingyun (2020): "You Are What You Broadcast: Identification of Mobile and IoT Devices from (Public) WiFi", in: Proceedings of the USENIX Security Symposium. (Link)] at network scale. Read their appendices, not their abstracts. A sixteenth paper, [8Rye, Erik C.; Levin, Dave (2024): "Surveilling the Masses with Wi-Fi-Based Positioning Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)], sits in its own device population in the wild row rather than this one, and is the most surprising of the lot: it is a Wi-Fi-positioning study in which Roku hardware turns out to be two of the five most common vendor prefixes in a 490-million-entry dataset.

Tools with usedOrMentioned == used, folded through a hand alias list, counted by paper, over the 35:

The shape is a network-measurement toolchain, not a crawling one: packet capture at the top, one browser-automation framework in the whole population. The alias fold maps 27 raw spellings onto 22 canonical names; the 191 distinct raw tool names it does not fold are printed in full on connected_tv, and they are worth reading — the broadcast-side instruments (Avalpa OpenCaster, TSDuck, DekTec DTU-215, HiDes UT-100c, a RedOrbit HbbTV Emulator, an HDMI Video Capture Device, the Roku External Control Protocol, IRDB) have no equivalent anywhere else on this wiki.

Only 6 of the 35 papers carry a crawl configuration at all, and the values they carry are almost entirely sentinels:

Read the zeros carefully: browsers is empty because a television is not driven with a browser, and consentAction is not-applicable or not-stated because none of these studies had a cookie banner to click. But statefulness is a real gap, and the shape of the gap needs stating carefully. All 6 of the papers with an extracted crawlConfig object record statefulness as not-stated — so the structured field is empty for every paper that has one, and silent for the other 29, which is not the same as those 29 saying nothing. A full-text probe for factory reset over all 35 returns 2, and one is off-topic — a BLE re-pairing paper where a factory reset is how a device loses its key. The one that means what it says is [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)]: “We perform a factory reset of the TV for each channel analysis to prevent interference in the captured traffic.” One paper in thirty-five, and the field that was supposed to capture it is empty even there. On a TV this is the equivalent of a fresh browser profile and the only way to know whether an ACR opt-out or a login carried over, so say what you did.

On the fields the corpus measures everywhere, this population is at or above the corpus norm:

The artifact record is genuinely good for a small field, and the code is where the reusable instrumentation lives:

None of the five repositories has been touched in 2025 or 2026 (checked 2026-09-13), and one of the five — [18Varmarken, Janus; Al Aaraj, Jad; Trimananda, Rahmadi; Markopoulou, Athina (2022): "FingerprinTV: Fingerprinting Smart TV Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — has never contained the code it promises. Treat them as reference implementations to read, not as maintained tools to depend on — mitmproxy itself, by contrast, is at v12.2.3 (2026-05-12) with commits this month.²²⁾

Each with the paper's own denominator. These are the figures a reviewer will expect you to position against.

The population is a hand audit, so it carries a hand audit's error. The candidate pool was 103 papers selected by full-text probes over all 5,859 paper.cols.txt files; 35 survived the inclusion rule, a precision of 34.0%. The roadmap's original title-and-summary probe returns 16 papers, of which 10 are in the population — and it misses 25 of the 35, including [3Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)], the largest TV app analysis in the corpus. Tier B is the softer boundary: “reports at least one result broken out for them” is a judgement, and a reasonable person would draw it one or two papers differently. Every verdict, including the 52 rejections and the 16 adjacent papers with the reason each was excluded, is published on connected_tv together with the full query log, the unmapped fold residue and the quote checks.

Dated deliberately, because a corpus this small drifts to whatever was fashionable in its densest years.

State these explicitly in a paper, because a reviewer trained on web measurement will assume all of them.

• Filter lists. Filter lists is built around rules evaluated against a request in the context of a page. On a TV there is no page, no document origin, no third-party option to evaluate, and no $script/$image type to match. Lists still work as domain denylists and that is all — with 22–27% coverage on app traffic [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)] and 44–81% on HbbTV [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].
• Request labelling by initiator. Requests asks you to pick a unit — request, domain, script, third party. On a TV you have flows and DNS names, so the only unit available is the destination domain, and “first party” means the TV manufacturer, who is also the tracker. AdGraph, WebGraph and Khaleesi need a DOM and a JavaScript execution trace; none exist here.
• Cookie and storage measurement. Cookies and Browser storage describe instrumentation inside a browser you launched. There is no such browser.
• Consent-notice detection. Consent and TCF consent strings detect banners and CMPs in a page's DOM. TV consent lives in the platform's setup wizard and settings menu, is navigated with a D-pad, and leaves no __tcfapi anywhere. The Texas agreements above make this a live and completely unmeasured surface.
• Ranking lists and top-n sampling. Website selection and Sampling assume a versioned list. See The Sampling Problem.
• Vantage-point selection as a free variable. Crawling location assumes you can move. A broadcast measurement has to be physically inside the transmitter's footprint, and an ACR result is specific to the storefront country the set was configured with.

What does transfer: Traffic files for what to do with the captures, Ownership resolution for turning a contacted domain into a company, Annotation for validating whatever classifier you build, and the whole of Ethics — a device in a lab that a household also uses is a human-subjects question.

• Every device: make, model, firmware version at the start and end, purchase date, storefront country, network egress country. A TV model number without a firmware version is not a reproducible device.
• The interception result per platform, as a fraction: TLS connections seen, decrypted, and failed-to-establish-under-interception. Say which platforms you could install a certificate on and which you could not.
• Whether the device was factory-reset between conditions, and whether it auto-updated mid-study.
• The automation interface you used, verbatim — adb keyevents, ECP URLs, an IR blaster — and how you knew the action landed. Screen capture is a check, not decoration.
• The store, the chart, and the date for any app or channel set, plus the per-app identity you used, since the same title is a different binary per platform.
• Both sides of the opt-out. If the platform documents an advertising-identifier or ACR control, measure with it on and off, and report the difference. Two papers in this literature do it ([1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)], [5Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]), and only the second crosses it with login state.
• The country, at the top. Half of the findings here are jurisdiction-specific, and after the 2026 Texas agreements a US result and an EU result are measurements of different products.

• Mobile and app measurement — store scraping, static versus dynamic analysis, and the general certificate-pinning toolchain. Read it first; this page only states what is different on a TV.
• Automated measurements — where crawling, scanning and device analysis diverge. A TV study is device analysis with a network vantage point.
• Sampling and Website selection — the ranking-list machinery that does not exist here.
• Longitudinal — pinning instruments across waves, when the firmware updates itself.
• Existing datasets — the testbed captures (Mon(IoT)r, YourThings, UNSW) in which TVs are a handful of rows.
• Ownership resolution — attributing a contacted domain to a company, which on a TV is most of the analysis.
• Traffic files — what to do with the PCAPs afterwards.
• Filter lists — the blocklist coverage numbers for smart TVs, and why the rule syntax mostly does not apply.
• Requests — the request-labelling methods, and which of them need a DOM you will not have.
• Consent — the consent apparatus that TV measurement has never used and now needs.
• Ethics — devices in homes, participants typing on remotes, and traffic that contains what somebody watched.
• Legal enforcement — the regulatory record that is currently ahead of this literature.
• Artifacts — publishing a device list with firmware versions.
• connected_tv — the population audit, every query, the fold residue and the quote checks behind this page.

[1]

Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[2]

Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[3]

Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[4]

Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[5]

Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[6]

Ahn, Jungun; Jung, Sueun; Yoo, Seungwan; Park, Jungheum; Lee, Sangjin (2025): "Watch Out Your TV Box: Reversing and Blocking a P2P-based Illegal Streaming Ecosystem", in: Proceedings of the USENIX Security Symposium. (Link)

[7]

Oren, Yossef; Keromytis, Angelos D. (2014): "From the Aether to the Ethernet—Attacking the Internet using Broadcast Digital Television", in: Proceedings of the USENIX Security Symposium. (Link)

[8]

Rye, Erik C.; Levin, Dave (2024): "Surveilling the Masses with Wi-Fi-Based Positioning Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[9]

Vetrivel, Swaathi; Eeten, Michel van; Gañán, Carlos (2026): "Missing, Present and Conflicting: A Large Scale Analysis of IoT Update Information in the EU Market", in: Proceedings of the USENIX Security Symposium. (Link)

[10]

Gopalakrishnan, Vijay; Jana, Rittwik; Ramakrishnan, K. K.; Swayne, Deborah F.; Vaishampayan, Vinay A. (2011): "Understanding couch potatoes: measurement and modeling of interactive usage of IPTV at large scale", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[11]

Song, Han Hee; Ge, Zihui; Mahimkar, Ajay; Wang, Jia; Yates, Jennifer; Zhang, Yin; Basso, Andrea; Chen, Min (2011): "Q-score: proactive service quality assessment in a large IPTV system", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[12]

Jin, Xin; Manandhar, Sunil; Kafle, Kaushal; Lin, Zhiqiang; Nadkarni, Adwait (2022): "Understanding IoT Security from a Market-Scale Perspective", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[13]

Aafer, Yousra; You, Wei; Sun, Yi; Shi, Yu; Zhang, Xiangyu; Yin, Heng (2021): "Android SmartTVs Vulnerability Discovery via Log-Guided Fuzzing", in: Proceedings of the USENIX Security Symposium. (Link)

[14]

Huang, Kong; Zhou, YuTong; Zhang, Ke; Xu, Jiacen; Chen, Jiongyi; Tang, Di; Zhang, Kehuan (2023): "HOMESPY: The Invisible Sniffer of Infrared Remote Control of Smart TVs", in: Proceedings of the USENIX Security Symposium. (Link)

[15]

Kannan, Tejas; Wang, Synthia Qia; Sunog, Max; Mesquita, Abraham Bueno de; Feamster, Nick; Hoffmann, Henry (2024): "Acoustic Keystroke Leakage on Smart Televisions", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[16]

Mavroudis, Vasilios; Hao, Shuang; Fratantonio, Yanick; Maggi, Federico; Kruegel, Christopher; Vigna, Giovanni (2017): "On the Privacy and Security of the Ultrasound Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[17]

Girish, Aniketh; Hu, Tianrui; Prakash, Vijay; Dubois, Daniel J.; Matic, Srdjan; Huang, Danny Yuxing; Egelman, Serge; Reardon, Joel; Tapiador, Juan; Choffnes, David R.; Vallina-Rodriguez, Narseo (2023): "In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[18]

Varmarken, Janus; Al Aaraj, Jad; Trimananda, Rahmadi; Markopoulou, Athina (2022): "FingerprinTV: Fingerprinting Smart TV Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[19]

Kumar, Deepak; Shen, Kelly; Case, Benton; Garg, Deepali; Alperovich, Galina; Kuznetsov, Dmitry; Gupta, Rajarshi; Durumeric, Zakir (2019): "All Things Considered: An Analysis of IoT Devices on Home Networks", in: Proceedings of the USENIX Security Symposium. (Link)

[20]

Jakaria, Md; Huang, Danny Yuxing; Das, Anupam (2024): "Connecting the Dots: Tracing Data Endpoints in IoT Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[21]

Yu, Lingjing; Luo, Bo; Ma, Jun; Zhou, Zhaoyu; Liu, Qingyun (2020): "You Are What You Broadcast: Identification of Mobile and IoT Devices from (Public) WiFi", in: Proceedings of the USENIX Security Symposium. (Link)

[22]

Dong, Hongying; Shu, Hao; Prakash, Vijay; Zhang, Yizhe; Paracha, Muhammad Talha; Choffnes, David R.; Torres-Arias, Santiago; Huang, Danny Yuxing; Sun, Yixin (2023): "Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[23]

Ahmed, Dilawer; Das, Anupam; Zaffar, Fareed (2022): "Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[24]

Ren, Jingjing; Dubois, Daniel J.; Choffnes, David R.; Mandalari, Anna Maria; Kolcun, Roman; Haddadi, Hamed (2019): "Information Exposure From Consumer IoT Devices: A Multidimensional, Network-Informed Measurement Approach", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[25]

Trimananda, Rahmadi; Varmarken, Janus; Markopoulou, Athina; Demsky, Brian (2020): "Packet-Level Signatures for Smart Home Devices", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[26]

Zhu, Yanzi; Xiao, Zhujun; Chen, Yuxin; Li, Zhijing; Liu, Max; Zhao, Ben Y.; Zheng, Haitao (2020): "Et Tu Alexa? When Commodity WiFi Devices Turn into Adversarial Motion Sensors", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[27]

Saidi, Said Jawad; Mandalari, Anna Maria; Kolcun, Roman; Haddadi, Hamed; Dubois, Daniel J.; Choffnes, David R.; Smaragdakis, Georgios; Feldmann, Anja (2020): "A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[28]

Paracha, Muhammad Talha; Dubois, Daniel J.; Vallina-Rodriguez, Narseo; Choffnes, David R. (2021): "IoTLS: understanding TLS usage in consumer IoT devices", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[29]

Mandalari, Anna Maria; Dubois, Daniel J.; Kolcun, Roman; Paracha, Muhammad Talha; Haddadi, Hamed; Choffnes, David (2021): "Blocking Without Breaking: Identification and Mitigation of Non-Essential IoT Traffic", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[30]

Sharma, Rahul Anand; Soltanaghaei, Elahe; Rowe, Anthony; Sekar, Vyas (2022): "Lumos: Identifying and Localizing Diverse Hidden IoT Devices in an Unfamiliar Environment", in: Proceedings of the USENIX Security Symposium. (Link)

[31]

Hu, Tianrui; Dubois, Daniel J.; Choffnes, David R. (2024): "IoT Bricks Over v6: Understanding IPv6 Usage in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[32]

Maali, Eman; Alrawi, Omar; McCann, Julie (2025): "Evaluating Machine Learning-Based IoT Device Identification Models for Security Applications", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[33]

Akhtar, Zahaib; Nam, Yun Seong; Chen, Jessica; Govindan, Ramesh; Katz-Bassett, Ethan; Rao, Sanjay G.; Zhan, Jibin; Zhang, Hui (2018): "Understanding Video Management Planes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[34]

Wang, Yifan; Lyu, Minzhao; Sivaraman, Vijay (2024): "Characterizing User Platforms for Video Streaming in Broadband Networks", in: Proceedings of the ACM Internet Measurement Conference. (DOI)