What privacy concern do smart home devices and smart TVs raise even when nothing has been hacked?

That normal, intended operation collects extremely intimate data — and the vendor, not an attacker, is the party doing the collecting.

Two illustrations of the same point.

The smart home as a sensor network. A single vendor may make or own dozens of types of domestic device and service, from the garage to the bathroom, with a majority of its shoppers owning at least one. The stated purpose is an "ambient intelligence" that makes the home smart. The privacy question is not whether that is a lie — it is that making a home smart and instrumenting a home are the same activity, and no other kind of company reaches as deep into domestic life.

The television as a data source. Smart TVs have been reported to log and upload data continuously: recording audio while in standby, collecting information about all the devices in the household, scanning the local network for other devices, capturing data from HDMI inputs (so content from an attached console or box is not private either), and collecting video of the vendor's own channels — with less taken from third-party streaming apps for copyright reasons rather than privacy ones. The mechanism behind much of this is ACR — automatic content recognition — which identifies what is on screen in order to profile viewing.

Defensive measures for the TV case, in rough order of effectiveness:

• Do not connect it to the internet at all, not even for updates.
• If connected, refuse and disable everything you can to limit ACR data.
• Disable voice control — it is always listening — while knowing it will never be fully off.
• Block the traffic at the router or DNS; the TV will keep working.
• Re-check the settings after each update, since defaults can be restored.
• Use a separate streaming box and keep the TV offline — though the box brings its own ACR and analytics, and the HDMI capture point remains.

Tip: the threat model here is unusual and worth naming precisely: the adversary is the manufacturer operating as designed. Encryption does not help, because the data is being sent to exactly the party it was meant for. The only controls are refusal, network-level blocking and disconnection.

Go deeper:

• Wikipedia — Automatic content recognition — the fingerprinting mechanism behind the tracking, with measured reporting intervals from LG and Samsung sets and the business model it funds.
• Wikipedia — Smart TV — the privacy and security picture for the sets themselves, including remote microphone and camera concerns.