A connected TV is the one measurement target on this wiki where you do not control the browser, cannot install a certificate, cannot drive the page, and cannot get a list. Almost nothing in Crawler transfers. That is not a warning at the top of the page; it is the whole page.

Four things break a web-trained intuition, and everything below follows from them.

1. The device is the browser, and it is somebody else's. A smart TV runs a closed OS (Tizen, webOS, Roku OS, Fire OS, Android TV / Google TV) that you cannot instrument from the inside. Your vantage point is the network the TV sits on, and whatever remote-control API the vendor happens to expose.
2. The TV reports what is on screen. Automatic content recognition (ACR) samples the panel — including the HDMI input from your games console or set-top box — and sends a fingerprint to the manufacturer. This is a measurement object with no web analogue at all: there is no page, no request initiated by a tracker, and no script to attribute it to.
3. There is a broadcast side. HbbTV rides the DVB signal and launches an application from the broadcaster the moment you tune to a channel, before any consent interaction exists. A crawler that only speaks HTTP cannot see this channel, and a vantage point on the Internet cannot reach it.
4. There is no Tranco for televisions. Nothing versioned, nothing archived, nothing citable. In this corpus the median TV study is a handful of physical devices in a lab, bought by the authors.

Everything on this page about “the literature” is a claim about seven venues — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, 5,859 papers with extracted full text (Corpus). Connected-TV work also appears at ACM TVX/IMX, MMSys, NOSSDAV, ACSAC and EuroS&P, none of which are in the corpus, so read the counts as “how these seven security, privacy and networking venues treat televisions”, not as the size of the field.

Six papers, each here for a methodological reason rather than a topical one.

1. [1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] — the instrumentation paper. Two platforms, 1,000 channels each, an automated crawler built on the vendors' own remote-control APIs, and an honest account of what TLS interception could and could not reach. Read Section 3 before you buy hardware.
2. [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — the one that reports its decryption hole. Roku and Fire TV, testbed and in-the-wild traffic, and the only paper in this population that publishes a per-app TLS decryption failure distribution.
3. [3Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — the app-analysis route. 4,745 Android TV APKs pulled apart statically, plus intercepted traffic from a small subset. The bridge between this page and Mobile and app measurement.
4. [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] — the broadcast side. HbbTV across 36 European channels on real televisions, with a survey of what viewers know about it. There is no other way into this material.
5. [5Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — ACR, measured. Two televisions, two countries, six viewing scenarios, and the first look at what the TV itself sends about what you are watching.
6. [6Ahn, Jungun; Jung, Sueun; Yoo, Seungwan; Park, Jungheum; Lee, Sangjin (2025): "Watch Out Your TV Box: Reversing and Blocking a P2P-based Illegal Streaming Ecosystem", in: Proceedings of the USENIX Security Symposium. (Link)] — the piracy set-top box. Reverse-engineering a device sold specifically to deliver infringing streams; the corpus's most recent Tier A paper and a reminder that “connected TV” includes hardware nobody ships a developer programme for.

Two more are worth reading for what they are not about. [7Oren, Yossef; Keromytis, Angelos D. (2014): "From the Aether to the Ethernet—Attacking the Internet using Broadcast Digital Television", in: Proceedings of the USENIX Security Symposium. (Link)] attacks televisions over the broadcast band in 2014 and is the ancestor of all the HbbTV work. [8Rye, Erik C.; Levin, Dave (2024): "Surveilling the Masses with Wi-Fi-Based Positioning Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] is a Wi-Fi-positioning paper in which streaming devices turn out to be two of the five most common vendor prefixes in a 490-million-entry dataset — a TV result nobody filed under “TV”.

The extraction has no “television” flag, and the platform enum offers only web, mobile, iot, other-online-service, offline and not-applicable. The population below is therefore hand-audited against a written rule, from a full-text candidate pool rather than from titles. The rule, the audit and every rejection are on connected_tv.

A television-class endpoint is a smart TV set, a TV operating system (Android TV / Google TV, tvOS, Tizen, webOS, Roku OS, Fire OS), a streaming stick, box or set-top box, an app running on one, or the broadcast path (HbbTV / DVB) into one.

Where they are, as a share of each venue's own output — IMC is the venue for this work and TheWebConf has published none of it:

And when, which is the finding a reader planning a study most needs:

2025–2026 is provisional by construction — CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and WWW 2026 are incompletely selected (Corpus). Even so, the last two years contain exactly one Tier A paper, and it is about a piracy box. Nobody in these seven venues has re-measured smart-TV tracking since 2024.

The roadmap row that queued this page noted that only one of its 16 title-probe candidates carried the web platform. On the derived population the figure is the same and it is not a weakness of the candidate set — it is the property being described:

The single web paper is [9Vetrivel, Swaathi; Eeten, Michel van; Gañán, Carlos (2026): "Missing, Present and Conflicting: A Large Scale Analysis of IoT Update Information in the EU Market", in: Proceedings of the USENIX Security Symposium. (Link)], which crawls EU online stores for update-support disclosures and never touches a television. Concretely: 6 of 35 papers fall inside the corpus-wide crawled population at all, and 20 of 35 draw a population whose unit is iot-devices. If you go looking for this literature with a web-measurement query, you will find almost none of it — which is also why so much of it is invisible to the reviewers who will read your paper.

There are four vantage points and they answer different questions.

Counts are matches of a full-text probe, printed per paper in the report script — a mention is not a use, and the per-paper matrix is on connected_tv.

The router-capture row is the one to internalise. A connected-TV measurement is, by default, a network measurement: you are recording a device's traffic from outside it, the way DNS and Internet scanning record other people's hosts, not the way Crawler records a page. Everything the web side gets for free — a script's URL, a cookie's Set-Cookie header, a request's initiator chain — has to be reconstructed from flows, and most of it cannot be.

Mobile and app measurement owns the general pinning problem and the Frida toolchain; do not re-read it here. What that page cannot tell you is that on a TV the first step usually fails: there is often no way to install a root CA at all, because the platform exposes no certificate store to the user and no root shell to the researcher.

Two consequences a reviewer should ask about and almost nobody reports.

Your coverage number is platform-specific, not study-specific. A paper that says “we intercepted TLS” over a mixed device set is reporting an average of 95% and 4%. Report per platform or do not report at all.

Almost nobody reports the hole. Of the 13 Tier A papers, a probe for a phrase describing failed or impossible decryption matches 1 — [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)], which publishes the distribution: “1 out of 5 (or fewer) TLS connections for 80% of all apps”. That single sentence is the thing to copy.

A web crawler navigates. A TV has to be operated, and the automation interface is whatever the vendor shipped for its phone app. Two real examples, both from [1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]:

# Amazon Fire TV — Android underneath, so adb works
adb shell input keyevent 21          # "left"

# Roku — External Control Protocol, an unauthenticated HTTP API on port 8060
curl http://ROKU_DEVICE_IP_ADDRESS:8060/keydown/left

Roku's ECP is documented by Roku itself as “a simple RESTful API accessed using HTTP on port 8060”¹⁾ and can launch channels, send keypresses and return query/device-info. It carries no authentication — which is why [1Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] both used it to automate crawls and noted that it had been found vulnerable to DNS rebinding.

For Android TV, adb over the network is the equivalent, and the version threshold is TV-specific: Android's own documentation puts wireless debugging at Android 13 (API 33) or higher for TV and WearOS, against Android 11 for phones; below that you need the older adb tcpip 5555 route, which requires a USB connection first. The same page notes that Android 17 introduces “adb Wi-Fi 2.0”, which auto-connects a device to the workstation on a trusted network — so the pairing step this section describes is already changing under you.²⁾ On a TV that has no accessible USB-debug port, that distinction decides whether the study is possible.

Three things that will bite you and that no paper warns you about:

• Screen state is part of your measurement. [13Aafer, Yousra; You, Wei; Sun, Yi; Shi, Yu; Zhang, Xiangyu; Yin, Heng (2021): "Android SmartTVs Vulnerability Discovery via Log-Guided Fuzzing", in: Proceedings of the USENIX Security Symposium. (Link)] captured HDMI output externally and compared before/after signals precisely because a TV can fail visually and audibly without producing a log line — 16 of its 37 discovered vulnerabilities are “visual and auditory anomalies” that no crash handler would report.
• The remote control is a side channel, not just an input. [14Huang, Kong; Zhou, YuTong; Zhang, Ke; Xu, Jiacen; Chen, Jiongyi; Tang, Di; Zhang, Kehuan (2023): "HOMESPY: The Invisible Sniffer of Infrared Remote Control of Smart TVs", in: Proceedings of the USENIX Security Symposium. (Link)] recovers 47% of typed strings at rank 1 from infrared remote signals sniffed by a neighbouring IoT device, and [15Kannan, Tejas; Wang, Synthia Qia; Sunog, Max; Mesquita, Abraham Bueno de; Feamster, Nick; Hoffmann, Henry (2024): "Acoustic Keystroke Leakage on Smart Televisions", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] recovers up to 60.19% of common passwords within 100 guesses from the TV's own keyboard sounds. If your protocol has participants type anything on a TV, that is a disclosure your ethics section owns.
• On-screen keyboards make text entry expensive. Registering accounts, accepting consent dialogues and logging in are what Registration calls a cost on the web; on a D-pad they are the reason TV studies have samples of tens rather than thousands.

ACR is the reason this page exists as something other than a subsection of Mobile and app measurement. It is the television reporting what is on its own screen, back to its manufacturer, on a timer.

It is a different measurement object from a tracker. There is no page, no third-party request initiated by embedded content, no script to attribute, and nothing a filter list can match on by origin. The only observable is periodic traffic from the TV's own first-party domains, which is precisely the traffic every other method on this wiki is designed to exclude as benign.

The nearest thing the corpus has to an ancestor is ultrasonic cross-device tracking, where a beacon emitted by a television advertisement is picked up by an SDK in a phone in the room [16Mavroudis, Vasilios; Hao, Shuang; Fratantonio, Yanick; Maggi, Federico; Kruegel, Christopher; Vigna, Giovanni (2017): "On the Privacy and Security of the Ultrasound Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. That is the mirror image of ACR — the TV emits and the phone listens, rather than the TV watching and reporting — and the method there was Android app analysis, not TV instrumentation. It is adjacent work, not a precedent for how to measure ACR.

[5Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] is the corpus's only ACR measurement and its population is two televisions — one LG and one Samsung — run in the UK and the US across six one-hour viewing scenarios. Its findings, with that denominator in front of them:

• ACR traffic exists when watching linear broadcast TV and when the TV is used as an external display over HDMI. Nothing about the source of the picture stops the reporting.
• The two vendors differ in cadence. LG's ACR network traffic appears every 15 seconds; Samsung's once per minute. The paper reads these as batching intervals over much faster on-screen capture — 10 ms for LG, 500 ms for Samsung — rather than as the sampling rate itself.
• Opting out worked, on these two sets. After the opt-out, the paper reports “a complete absence of communication with any previously identified ACR domains”.
• The UK and US televisions contacted distinct ACR domains, so an ACR result is a result about one jurisdiction's configuration.
• Login status made no material difference.

One paper, two devices, 2024. Treat every ACR number as a case study, and note that the corpus contains no replication and no larger device set.

This is the one area on this wiki where the regulatory file is a richer source than the venues, and reading it first will stop you re-measuring a configuration that no longer exists.

Sony, Hisense and TCL have not settled. The Attorney General has published agreements with Samsung and LG only; as of 2026-09-12 no settlement, dismissal or further order for the other three appears on its newsroom. So the timeline above is the beginning of a proceeding, not the end of one, and a 2026 measurement of a Sony, Hisense or TCL set is measuring a product whose behaviour is still contested in court. Nothing comparable was found from an EU or UK regulator: the search there came back empty, which is itself worth knowing before someone assumes the GDPR angle is already covered.

Three things follow for a study designed today. The 2024 measurement is a pre-order baseline for exactly the two vendors that have since settled, which makes a replication unusually valuable and unusually easy to justify. A US measurement after February 2026 is measuring a consent flow, not a default, and needs the Consent apparatus — accept, reject, no-interaction — that the ACR literature has never applied. And the Texas filings' “every 500 milliseconds” sits alongside the paper's 500 ms Samsung capture estimate; agreeing with a regulator's pleading is not verification, so say which one you are citing for what.

HbbTV (Hybrid Broadcast Broadband TV) is a European standard that lets a broadcaster ship an application descriptor in the DVB transport stream. Tune to a channel and the television fetches and runs the broadcaster's HTML application over the Internet, unprompted.

For a measurement this changes three things at once:

1. The trigger is a radio signal, not a URL. You cannot reach it from a cloud vantage point. [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] needed real televisions in the broadcast footprint, and [7Oren, Yossef; Keromytis, Angelos D. (2014): "From the Aether to the Ethernet—Attacking the Internet using Broadcast Digital Television", in: Proceedings of the USENIX Security Symposium. (Link)] needed a transmitter: its attack retransmits a modified DVB-T multiplex, and it costs a 1 W amplifier to cover a 1.4 km² area.
2. The application runs before anything resembling consent. [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] found that of 36 European TV channels, 26 communicated with trackers before the user had expressed any consent — the TV equivalent of the pre-consent cookie measurements on Consent, but with no cookie banner in the path and no CMP to detect.
3. Filter lists do not cover it. In the same study, common tracking denylists blocked “at maximum 44% in 2021 and 81% in 2022” of the domains the authors had manually identified as tracking. That is a coverage hole of a different order from the web figures on Filter lists — and see that page for the companion smart-TV row, where the best of four DNS blocklists blocked 22% and 27% of contacted FQDNs in the Roku and Fire TV app ecosystems [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)].

The current specification is HbbTV 2.0.5, published 2026-02-25, an incremental update over 2.0.4 (March 2023) adding DRM and WebAssembly recognition and correcting the accessibility and DVB-I material introduced in 2.0.4.¹⁰⁾ A 2023 measurement is therefore two specification revisions old.

The North American analogue is ATSC 3.0 / NextGen TV, which ATSC describes as offering “more accessibility, personalization and interactivity” over the current standard and which it states reaches “more than 76% of U.S. households” as of its July 2026 deployment map.¹¹⁾ No paper in these seven venues measures it, and that is the largest single gap on this page.

The regulator has got there first here too. The FCC's Fifth Further Notice of Proposed Rulemaking in GN Docket No. 16-142, adopted in October 2025, proposes to remove restrictions on the ATSC 1.0 simulcast whose “substantially similar” rule “was initially scheduled to sunset on July 17, 2023, and was extended to July 17, 2027”, and seeks comment on a list of outstanding NextGen TV issues that includes “The sunset of 1.0 service”, tuner and labelling standards, and — in its own one-word bullet — “Privacy”.¹²⁾ A measurement of what ATSC 3.0 broadcaster applications actually collect would be evidence in a live proceeding, and there is none.

Mobile and app measurement owns store scraping, static and dynamic analysis, and the reproducibility discipline for app sets. Everything there applies. Four things are different enough to state.

• There is no AndroZoo for TV apps. The mobile page's whole first section is a comparison of bulk-download routes; for televisions there is no equivalent archive, no research access programme, and no historical corpus. Every paper in this population that analysed TV apps built its own set.
• The store is the platform. The population sources these papers state are, verbatim: “Roku Channel Store” (3 papers), “Amazon Fire TV channel store”, “Fire TV app store”, “Amazon curated list 'Top Featured' apps”, “Apple iTunes Preview / Apple App Store”, “Roku-Top1K”, “FireTV-Top1K”. There is no cross-platform frame; a “top-1000 TV apps” result is a result about one vendor's chart on one day.
• Android TV apps are Android apps, and that is a route in. [3Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)] obtained 4,745 Android TV APKs and ran ordinary Android tooling on them — LibScout for third-party libraries, a customised FlowDroid for taint flows — finding “at least one sensitive data flow in 78% of the files”, advertising libraries in 77% and analytics in 75%. If your question is about SDKs rather than about the television, this is far cheaper than buying hardware.
• The same app is a different app per platform. [17Varmarken, Janus; Al Aaraj, Jad; Trimananda, Rahmadi; Markopoulou, Athina (2022): "FingerprinTV: Fingerprinting Smart TV Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] matched 80 apps available on Apple TV, Fire TV and Roku alike and found that “among 80 apps that are made available on all three smart TV platforms, 76% exhibit a different fingerprint on each platform”. Do not generalise a Roku finding to Fire TV.

Every major TV platform ships an IDFA-equivalent, and the vendor documentation is the primary source a reviewer will accept. These were checked on 2026-09-12:

Two measurement points follow. A TV advertising identifier is device-scoped, not app-scoped, so every app on the set shares it — which is why [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)] could count 697 Fire TV apps sending the advertising ID alongside a serial number and a device ID, an identifier pairing that defeats the reset. And the opt-out is a documented, testable control: run your crawl twice, once each side of it, and report the difference. Exactly one paper in this population does that [5Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)].

There is no versioned, archived, citable ranking of televisions, TV apps or TV channels. What stands in for one, in this population:

The sizes are the story. 20 of the 35 papers state an iot-devices population size, 39 values between them, and the median stated value is 66 devices. Taking each paper's largest set, the median is 75.5 and 14 of the 20 never exceed 96 devices — that is the lab bench, and it is what a TV study looks like. Only six exceed it, and every one of them is a vantage point rather than a bench: 83,000,000 devices inferred from a security product's home-network scans [18Kumar, Deepak; Shen, Kelly; Case, Benton; Garg, Deepali; Alperovich, Galina; Kuznetsov, Dmitry; Gupta, Rajarshi; Durumeric, Zakir (2019): "All Things Considered: An Analysis of IoT Devices on Home Networks", in: Proceedings of the USENIX Security Symposium. (Link)], 7,000,000 set-top boxes in an IPTV operator's own logs [11Song, Han Hee; Ge, Zihui; Mahimkar, Ajay; Wang, Jia; Yates, Jennifer; Zhang, Yin; Basso, Andrea; Chen, Min (2011): "Q-score: proactive service quality assessment in a large IPTV system", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], 54,950 and 25,123 from device fingerprinting at scale [19Jakaria, Md; Huang, Danny Yuxing; Das, Anupam (2024): "Connecting the Dots: Tracing Data Endpoints in IoT Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)], 31,850 and 26,478 from public Wi-Fi [20Yu, Lingjing; Luo, Bo; Ma, Jun; Zhou, Zhaoyu; Liu, Qingyun (2020): "You Are What You Broadcast: Identification of Mobile and IoT Devices from (Public) WiFi", in: Proceedings of the USENIX Security Symposium. (Link)], 13,487 from a crowdsourced smart-home dataset [21Girish, Aniketh; Hu, Tianrui; Prakash, Vijay; Dubois, Daniel J.; Matic, Srdjan; Huang, Danny Yuxing; Egelman, Serge; Reardon, Joel; Tapiador, Juan; Choffnes, David R.; Vallina-Rodriguez, Narseo (2023): "In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], and 2,014 from vendor certificate collection [22Dong, Hongying; Shu, Hao; Prakash, Vijay; Zhang, Yizhe; Paracha, Muhammad Talha; Choffnes, David R.; Torres-Arias, Santiago; Huang, Danny Yuxing; Sun, Yixin (2023): "Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. A separate IPTV study puts roughly 3,000,000 set-top boxes behind its traces [10Gopalakrishnan, Vijay; Jana, Rittwik; Ramakrishnan, K. K.; Swayne, Deborah F.; Vaishampayan, Vinay A. (2011): "Understanding couch potatoes: measurement and modeling of interactive usage of IPTV at large scale", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], though it records them as subscribers rather than as a device population, so it is not one of the 20.

The sampling methods say the same thing: purposive 19 papers, pre-existing-dataset 11, convenience 10, top-n 5, random 5. In the corpus as a whole top-n is the signature of web-measurement work (Sampling); here it is a minority route and it always means a store chart.

The network-vantage row deserves one warning of its own. Identifying a television from flow data is a classification problem with a published error rate, not a lookup: [8Rye, Erik C.; Levin, Dave (2024): "Surveilling the Masses with Wi-Fi-Based Positioning Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] found that two of the five most common vendor prefixes in its BSSID dataset belonged to Roku, and [23Ahmed, Dilawer; Das, Anupam; Zaffar, Fareed (2022): "Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)] reports that its own device classifier mislabels Roku TVs as other devices when generalised across datasets. If your denominator is “TVs seen in the wild”, that denominator has a confidence interval.

All figures below come from the 35-paper population, with the denominator named. The script is scripts/report_connected_tv.mjs; its unedited output and every query are on connected_tv.

Fifteen of the 35 papers are IoT studies in which a television is one row of a device table. That is the single most useful thing this table says: if you are planning a TV measurement, most of your “related work” is not about televisions, and the results you can borrow from it are per-device rows in appendices.

All fifteen are worth listing, because none of them is findable by searching for televisions: [24Ren, Jingjing; Dubois, Daniel J.; Choffnes, David R.; Mandalari, Anna Maria; Kolcun, Roman; Haddadi, Hamed (2019): "Information Exposure From Consumer IoT Devices: A Multidimensional, Network-Informed Measurement Approach", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (81 devices, the Mon(IoT)r lab set), [25Trimananda, Rahmadi; Varmarken, Janus; Markopoulou, Athina; Demsky, Brian (2020): "Packet-Level Signatures for Smart Home Devices", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (packet-level signatures), [26Zhu, Yanzi; Xiao, Zhujun; Chen, Yuxin; Li, Zhijing; Liu, Max; Zhao, Ben Y.; Zheng, Haitao (2020): "Et Tu Alexa? When Commodity WiFi Devices Turn into Adversarial Motion Sensors", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (a “Smart TV (& Sticks)” row with its own packet-rate measurement), [27Saidi, Said Jawad; Mandalari, Anna Maria; Kolcun, Roman; Haddadi, Hamed; Dubois, Daniel J.; Choffnes, David R.; Smaragdakis, Georgios; Feldmann, Anja (2020): "A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (IoT devices detected at an IXP), [28Paracha, Muhammad Talha; Dubois, Daniel J.; Vallina-Rodriguez, Narseo; Choffnes, David R. (2021): "IoTLS: understanding TLS usage in consumer IoT devices", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (TLS usage, TV category n=5), [29Mandalari, Anna Maria; Dubois, Daniel J.; Kolcun, Roman; Paracha, Muhammad Talha; Haddadi, Hamed; Choffnes, David (2021): "Blocking Without Breaking: Identification and Mitigation of Non-Essential IoT Traffic", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (which destinations a device can lose without breaking), [23Ahmed, Dilawer; Das, Anupam; Zaffar, Fareed (2022): "Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (device fingerprinting, with a per-device Roku TV row), [30Sharma, Rahul Anand; Soltanaghaei, Elahe; Rowe, Anthony; Sekar, Vyas (2022): "Lumos: Identifying and Localizing Diverse Hidden IoT Devices in an Unfamiliar Environment", in: Proceedings of the USENIX Security Symposium. (Link)] (hidden devices in unfamiliar rooms), [22Dong, Hongying; Shu, Hao; Prakash, Vijay; Zhang, Yizhe; Paracha, Muhammad Talha; Choffnes, David R.; Torres-Arias, Santiago; Huang, Danny Yuxing; Sun, Yixin (2023): "Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (vendor certificate practice, with a dedicated smart-TV capture), [21Girish, Aniketh; Hu, Tianrui; Prakash, Vijay; Dubois, Daniel J.; Matic, Srdjan; Huang, Danny Yuxing; Egelman, Serge; Reardon, Joel; Tapiador, Juan; Choffnes, David R.; Vallina-Rodriguez, Narseo (2023): "In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (local-network communication; explicitly leaves the smart-TV ecosystem to future work), [31Hu, Tianrui; Dubois, Daniel J.; Choffnes, David R. (2024): "IoT Bricks Over v6: Understanding IPv6 Usage in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (IPv6-only survivability), [19Jakaria, Md; Huang, Danny Yuxing; Das, Anupam (2024): "Connecting the Dots: Tracing Data Endpoints in IoT Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (tracing data endpoints), [32Maali, Eman; Alrawi, Omar; McCann, Julie (2025): "Evaluating Machine Learning-Based IoT Device Identification Models for Security Applications", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (evaluating device-identification models, with a Smart TV class), plus [18Kumar, Deepak; Shen, Kelly; Case, Benton; Garg, Deepali; Alperovich, Galina; Kuznetsov, Dmitry; Gupta, Rajarshi; Durumeric, Zakir (2019): "All Things Considered: An Analysis of IoT Devices on Home Networks", in: Proceedings of the USENIX Security Symposium. (Link)] and [20Yu, Lingjing; Luo, Bo; Ma, Jun; Zhou, Zhaoyu; Liu, Qingyun (2020): "You Are What You Broadcast: Identification of Mobile and IoT Devices from (Public) WiFi", in: Proceedings of the USENIX Security Symposium. (Link)] at network scale. Read their appendices, not their abstracts. A sixteenth paper, [8Rye, Erik C.; Levin, Dave (2024): "Surveilling the Masses with Wi-Fi-Based Positioning Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)], sits in its own device population in the wild row rather than this one, and is the most surprising of the lot: it is a Wi-Fi-positioning study in which Roku hardware turns out to be two of the five most common vendor prefixes in a 490-million-entry dataset.

Tools with usedOrMentioned == used, folded through a hand alias list, counted by paper, over the 35:

The shape is a network-measurement toolchain, not a crawling one: packet capture at the top, one browser-automation framework in the whole population. The alias fold maps 27 raw spellings onto 22 canonical names; the 191 distinct raw tool names it does not fold are printed in full on connected_tv, and they are worth reading — the broadcast-side instruments (Avalpa OpenCaster, TSDuck, DekTec DTU-215, HiDes UT-100c, a RedOrbit HbbTV Emulator, an HDMI Video Capture Device, the Roku External Control Protocol, IRDB) have no equivalent anywhere else on this wiki.

Only 6 of the 35 papers carry a crawl configuration at all, and the values they carry are almost entirely sentinels:

Read the zeros carefully: browsers is empty because a television is not driven with a browser, and consentAction is not-applicable or not-stated because none of these studies had a cookie banner to click. But statefulness is a real gap — no paper in this population states whether the device was factory-reset between conditions, which on a TV is the equivalent of a fresh browser profile and is the only way to know whether an ACR opt-out or a login carried over.

On the fields the corpus measures everywhere, this population is at or above the corpus norm:

The artifact record is genuinely good for a small field, and the code is where the reusable instrumentation lives:

None of the five public repositories has been touched in 2025 or 2026 (checked 2026-09-12). Treat them as reference implementations to read, not as maintained tools to depend on — mitmproxy itself, by contrast, is at v12.2.3 (2026-05-12) with commits this month.¹⁶⁾

Each with the paper's own denominator. These are the figures a reviewer will expect you to position against.

The population is a hand audit, so it carries a hand audit's error. The candidate pool was 103 papers selected by full-text probes over all 5,859 paper.cols.txt files; 35 survived the inclusion rule, a precision of 34.0%. The roadmap's original title-and-summary probe returns 16 papers, of which 10 are in the population — and it misses 25 of the 35, including [3Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)], the largest TV app analysis in the corpus. Tier B is the softer boundary: “reports at least one result broken out for them” is a judgement, and a reasonable person would draw it one or two papers differently. Every verdict, including the 52 rejections and the 16 adjacent papers with the reason each was excluded, is published on connected_tv together with the full query log, the unmapped fold residue and the quote checks.

Dated deliberately, because a corpus this small drifts to whatever was fashionable in its densest years.

State these explicitly in a paper, because a reviewer trained on web measurement will assume all of them.

• Filter lists. Filter lists is built around rules evaluated against a request in the context of a page. On a TV there is no page, no document origin, no third-party option to evaluate, and no $script/$image type to match. Lists still work as domain denylists and that is all — with 22–27% coverage on app traffic [2Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)] and 44–81% on HbbTV [4Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].
• Request labelling by initiator. Requests asks you to pick a unit — request, domain, script, third party. On a TV you have flows and DNS names, so the only unit available is the destination domain, and “first party” means the TV manufacturer, who is also the tracker. AdGraph, WebGraph and Khaleesi need a DOM and a JavaScript execution trace; none exist here.
• Cookie and storage measurement. Cookies and Browser storage describe instrumentation inside a browser you launched. There is no such browser.
• Consent-notice detection. Consent and TCF consent strings detect banners and CMPs in a page's DOM. TV consent lives in the platform's setup wizard and settings menu, is navigated with a D-pad, and leaves no __tcfapi anywhere. The Texas agreements above make this a live and completely unmeasured surface.
• Ranking lists and top-n sampling. Website selection and Sampling assume a versioned list. See The Sampling Problem.
• Vantage-point selection as a free variable. Crawling location assumes you can move. A broadcast measurement has to be physically inside the transmitter's footprint, and an ACR result is specific to the storefront country the set was configured with.

What does transfer: Traffic files for what to do with the captures, Ownership resolution for turning a contacted domain into a company, Annotation for validating whatever classifier you build, and the whole of Ethics — a device in a lab that a household also uses is a human-subjects question.

• Every device: make, model, firmware version at the start and end, purchase date, storefront country, network egress country. A TV model number without a firmware version is not a reproducible device.
• The interception result per platform, as a fraction: TLS connections seen, decrypted, and failed-to-establish-under-interception. Say which platforms you could install a certificate on and which you could not.
• Whether the device was factory-reset between conditions, and whether it auto-updated mid-study.
• The automation interface you used, verbatim — adb keyevents, ECP URLs, an IR blaster — and how you knew the action landed. Screen capture is a check, not decoration.
• The store, the chart, and the date for any app or channel set, plus the per-app identity you used, since the same title is a different binary per platform.
• Both sides of the opt-out. If the platform documents an advertising-identifier or ACR control, measure with it on and off, and report the difference. One paper in this literature does this.
• The country, at the top. Half of the findings here are jurisdiction-specific, and after the 2026 Texas agreements a US result and an EU result are measurements of different products.

• Mobile and app measurement — store scraping, static versus dynamic analysis, and the general certificate-pinning toolchain. Read it first; this page only states what is different on a TV.
• Automated measurements — where crawling, scanning and device analysis diverge. A TV study is device analysis with a network vantage point.
• Sampling and Website selection — the ranking-list machinery that does not exist here.
• Longitudinal — pinning instruments across waves, when the firmware updates itself.
• Existing datasets — the testbed captures (Mon(IoT)r, YourThings, UNSW) in which TVs are a handful of rows.
• Ownership resolution — attributing a contacted domain to a company, which on a TV is most of the analysis.
• Traffic files — what to do with the PCAPs afterwards.
• Filter lists — the blocklist coverage numbers for smart TVs, and why the rule syntax mostly does not apply.
• Requests — the request-labelling methods, and which of them need a DOM you will not have.
• Consent — the consent apparatus that TV measurement has never used and now needs.
• Ethics — devices in homes, participants typing on remotes, and traffic that contains what somebody watched.
• Legal enforcement — the regulatory record that is currently ahead of this literature.
• Artifacts — publishing a device list with firmware versions.
• connected_tv — the population audit, every query, the fold residue and the quote checks behind this page.

[1]

Moghaddam, Hooman Mohajeri; Acar, Gunes; Burgess, Ben; Mathur, Arunesh; Huang, Danny Yuxing; Feamster, Nick; Felten, Edward W.; Mittal, Prateek; Narayanan, Arvind (2019): "Watching You Watch: The Tracking Ecosystem of Over-the-Top TV Streaming Devices", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[2]

Varmarken, Janus; Le, Hieu; Shuba, Anastasia; Markopoulou, Athina; Shafiq, Zubair (2020): "The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[3]

Tileria, Marcos; Blasco, Jorge (2022): "Watch Over Your TV: A Security and Privacy Analysis of the Android TV Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[4]

Tagliaro, Carlotta; Hahn, Florian; Sepe, Riccardo; Aceti, Alessio; Lindorfer, Martina (2023): "I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[5]

Anselmi, Gianluca; Vekaria, Yash; D'Souza, Alexander; Callejo, Patricia; Mandalari, Anna Maria; Shafiq, Zubair (2024): "Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[6]

Ahn, Jungun; Jung, Sueun; Yoo, Seungwan; Park, Jungheum; Lee, Sangjin (2025): "Watch Out Your TV Box: Reversing and Blocking a P2P-based Illegal Streaming Ecosystem", in: Proceedings of the USENIX Security Symposium. (Link)

[7]

Oren, Yossef; Keromytis, Angelos D. (2014): "From the Aether to the Ethernet—Attacking the Internet using Broadcast Digital Television", in: Proceedings of the USENIX Security Symposium. (Link)

[8]

Rye, Erik C.; Levin, Dave (2024): "Surveilling the Masses with Wi-Fi-Based Positioning Systems", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[9]

Vetrivel, Swaathi; Eeten, Michel van; Gañán, Carlos (2026): "Missing, Present and Conflicting: A Large Scale Analysis of IoT Update Information in the EU Market", in: Proceedings of the USENIX Security Symposium. (Link)

[10]

Gopalakrishnan, Vijay; Jana, Rittwik; Ramakrishnan, K. K.; Swayne, Deborah F.; Vaishampayan, Vinay A. (2011): "Understanding couch potatoes: measurement and modeling of interactive usage of IPTV at large scale", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[11]

Song, Han Hee; Ge, Zihui; Mahimkar, Ajay; Wang, Jia; Yates, Jennifer; Zhang, Yin; Basso, Andrea; Chen, Min (2011): "Q-score: proactive service quality assessment in a large IPTV system", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[12]

Jin, Xin; Manandhar, Sunil; Kafle, Kaushal; Lin, Zhiqiang; Nadkarni, Adwait (2022): "Understanding IoT Security from a Market-Scale Perspective", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[13]

Aafer, Yousra; You, Wei; Sun, Yi; Shi, Yu; Zhang, Xiangyu; Yin, Heng (2021): "Android SmartTVs Vulnerability Discovery via Log-Guided Fuzzing", in: Proceedings of the USENIX Security Symposium. (Link)

[14]

Huang, Kong; Zhou, YuTong; Zhang, Ke; Xu, Jiacen; Chen, Jiongyi; Tang, Di; Zhang, Kehuan (2023): "HOMESPY: The Invisible Sniffer of Infrared Remote Control of Smart TVs", in: Proceedings of the USENIX Security Symposium. (Link)

[15]

Kannan, Tejas; Wang, Synthia Qia; Sunog, Max; Mesquita, Abraham Bueno de; Feamster, Nick; Hoffmann, Henry (2024): "Acoustic Keystroke Leakage on Smart Televisions", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[16]

Mavroudis, Vasilios; Hao, Shuang; Fratantonio, Yanick; Maggi, Federico; Kruegel, Christopher; Vigna, Giovanni (2017): "On the Privacy and Security of the Ultrasound Ecosystem", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[17]

Varmarken, Janus; Al Aaraj, Jad; Trimananda, Rahmadi; Markopoulou, Athina (2022): "FingerprinTV: Fingerprinting Smart TV Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[18]

Kumar, Deepak; Shen, Kelly; Case, Benton; Garg, Deepali; Alperovich, Galina; Kuznetsov, Dmitry; Gupta, Rajarshi; Durumeric, Zakir (2019): "All Things Considered: An Analysis of IoT Devices on Home Networks", in: Proceedings of the USENIX Security Symposium. (Link)

[19]

Jakaria, Md; Huang, Danny Yuxing; Das, Anupam (2024): "Connecting the Dots: Tracing Data Endpoints in IoT Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[20]

Yu, Lingjing; Luo, Bo; Ma, Jun; Zhou, Zhaoyu; Liu, Qingyun (2020): "You Are What You Broadcast: Identification of Mobile and IoT Devices from (Public) WiFi", in: Proceedings of the USENIX Security Symposium. (Link)

[21]

Girish, Aniketh; Hu, Tianrui; Prakash, Vijay; Dubois, Daniel J.; Matic, Srdjan; Huang, Danny Yuxing; Egelman, Serge; Reardon, Joel; Tapiador, Juan; Choffnes, David R.; Vallina-Rodriguez, Narseo (2023): "In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[22]

Dong, Hongying; Shu, Hao; Prakash, Vijay; Zhang, Yizhe; Paracha, Muhammad Talha; Choffnes, David R.; Torres-Arias, Santiago; Huang, Danny Yuxing; Sun, Yixin (2023): "Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[23]

Ahmed, Dilawer; Das, Anupam; Zaffar, Fareed (2022): "Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[24]

Ren, Jingjing; Dubois, Daniel J.; Choffnes, David R.; Mandalari, Anna Maria; Kolcun, Roman; Haddadi, Hamed (2019): "Information Exposure From Consumer IoT Devices: A Multidimensional, Network-Informed Measurement Approach", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[25]

Trimananda, Rahmadi; Varmarken, Janus; Markopoulou, Athina; Demsky, Brian (2020): "Packet-Level Signatures for Smart Home Devices", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[26]

Zhu, Yanzi; Xiao, Zhujun; Chen, Yuxin; Li, Zhijing; Liu, Max; Zhao, Ben Y.; Zheng, Haitao (2020): "Et Tu Alexa? When Commodity WiFi Devices Turn into Adversarial Motion Sensors", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[27]

Saidi, Said Jawad; Mandalari, Anna Maria; Kolcun, Roman; Haddadi, Hamed; Dubois, Daniel J.; Choffnes, David R.; Smaragdakis, Georgios; Feldmann, Anja (2020): "A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[28]

Paracha, Muhammad Talha; Dubois, Daniel J.; Vallina-Rodriguez, Narseo; Choffnes, David R. (2021): "IoTLS: understanding TLS usage in consumer IoT devices", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[29]

Mandalari, Anna Maria; Dubois, Daniel J.; Kolcun, Roman; Paracha, Muhammad Talha; Haddadi, Hamed; Choffnes, David (2021): "Blocking Without Breaking: Identification and Mitigation of Non-Essential IoT Traffic", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[30]

Sharma, Rahul Anand; Soltanaghaei, Elahe; Rowe, Anthony; Sekar, Vyas (2022): "Lumos: Identifying and Localizing Diverse Hidden IoT Devices in an Unfamiliar Environment", in: Proceedings of the USENIX Security Symposium. (Link)

[31]

Hu, Tianrui; Dubois, Daniel J.; Choffnes, David R. (2024): "IoT Bricks Over v6: Understanding IPv6 Usage in Smart Homes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[32]

Maali, Eman; Alrawi, Omar; McCann, Julie (2025): "Evaluating Machine Learning-Based IoT Device Identification Models for Security Applications", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[33]

Akhtar, Zahaib; Nam, Yun Seong; Chen, Jessica; Govindan, Ramesh; Katz-Bassett, Ethan; Rao, Sanjay G.; Zhan, Jibin; Zhang, Hui (2018): "Understanding Video Management Planes", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[34]

Wang, Yifan; Lyu, Minzhao; Sivaraman, Vijay (2024): "Characterizing User Platforms for Video Streaming in Broadband Networks", in: Proceedings of the ACM Internet Measurement Conference. (DOI)