Roku lets you turn off the feature that watches what is on your screen, but even after you turn it off, the TV still sends information about which apps you use, how long you watch, and other data to Roku servers. The off switch does not actually stop all tracking.
critical
Roku says it would get parental permission before collecting children's data, but two state attorneys general found Roku was secretly collecting children's location, viewing habits, and voice recordings and selling this data to advertisers — all without telling parents or getting their consent.
critical
When you plug a game console or cable box into your Roku TV via HDMI, Roku secretly takes screenshots of what is on screen from those other devices too — not just Roku apps. Your Roku TV is spying on what you do on your PlayStation or cable box, and most people have no idea.
Roku sells you a cheap streaming stick, but the real product is you. The device watches everything you watch — every show, every ad, every DVD — second by second, and sells that information to advertisers. This is Roku's primary business model, generating over $1.4 billion in advertising revenue, but the marketing focuses entirely on entertainment features.
critical
Roku has built a sophisticated system to track your viewing habits and link all your devices for advertising purposes, but an independent security review found they don't even have basic security measures in place. They can track what you watch second by second, but they couldn't prevent hackers from accessing over half a million accounts.
high
The Roku app is supposed to be a remote control for your TV, but it requests five different advertising tracking permissions, can detect if you're recording your screen, has microphone access, and comes with a built-in advertising network. A remote control doesn't need to know who you are for ad targeting.
Roku makes 80% of its money from advertising. Now they sell cameras, doorbells, and smart plugs. Your security camera data feeds into the same infrastructure that serves you TV ads. Roku knows what you watch AND when you're home. An advertising company now has cameras inside and outside your house.
high
576,000 Roku accounts breached. Then 15,000 more. Attackers used stolen passwords to log in and make purchases on victims' accounts. Roku had no two-factor authentication until after the breaches forced it. The company that wants cameras in your home couldn't secure the accounts those cameras connect to.