Data Collection in SaaS: The Lesson From LG TVs

You signed up for a management system last month. Do you know what it does with your customers' data? Most business owners I work with do not. And it is not carelessness. It is because data collection in SaaS was designed to stay invisible. The recent LG story is a great example of this, and it is worth a careful look.

What happened with LG

An investigation published online claimed that around 216 million LG TVs were recording audio and tracking what people watch. LG responded fast and hard. It said the accusations are not true, that the TV does not record conversations, and that content tracking depends on user consent.

I have no way of saying who is right on the details. But there is one point nobody disputes: connected TVs have a technology called ACR, automatic content recognition. It identifies what is on the screen, whether a channel, a streaming service, or a video game, and sends that information to servers. LG says this is optional and you can turn it off. It probably is. It just sits in a menu almost nobody opens, on by default in many cases, with a name that looks nothing like "tracking".

My TV knows I watched three seasons of a baking reality show. I would rather that stayed between us.

Here is the point: a company can be within the law, within its terms of use, and still collect far more than the customer imagines. And the customer only finds out when it makes headlines.

Why a TV has anything to do with your company's SaaS

Because the model is the same. You buy a TV and think you bought a device. In reality, you bought a device with software that keeps talking to the manufacturer every day. SaaS, that subscription system you use to issue invoices, manage inventory, answer on WhatsApp, or run your finances, works the same way. It lives on someone else's server. You have access, not ownership.

And that changes three things in practice:

• Your customers' data sits with a third party. Name, phone, address, purchase history. All of it is in the tool's database, not yours.
• The tool can use that data for itself. Training models, generating market statistics, selling aggregated "insights". It is in the terms, almost always. You accepted without reading, almost always.
• If the tool leaks, the name that shows up is yours. Data protection law makes you the controller. The SaaS is the processor. The one who answers to the customer is the one whose name is on the invoice.

If you do not know what the tool collects, you cannot promise the customer anything.

I saw this up close with a clinic that used a free scheduling system. Great system. Months later, patients started receiving health insurance ads on the same day as their appointment. Coincidence? The contract said "anonymized" data could be shared with partners. Anonymized, on paper. In practice, the zip code and the appointment date were enough.

How to know what a SaaS collects before you sign

You do not need to be a lawyer or a programmer. You need to ask four questions and accept only clear answers.

1. Where does the data live? Brazil, United States, Europe? That changes which law applies and how easy it is to recover everything if something goes wrong. A serious vendor answers in one sentence.

2. Can I export everything and leave? Ask to see the export button. If the answer is "open a ticket with support", be suspicious. Data you cannot take out is not yours.

3. What do you do with the data beyond running the service? This is where answers get vague. "Improving the experience" is the favorite phrase. Push: do you use it to train AI? Share it with partners? Sell aggregated statistics?

4. Is there a data processing agreement? Under data protection law this is an obligation, not a courtesy. If the vendor has no document by that name, it is not prepared to deal with a company that takes the subject seriously.

Free in exchange for data is the most expensive business model there is. You do not pay with money. You pay with your customers' trust, and that cannot be replaced.

The other side: when the software is yours

Many companies that come to me want to build something of their own: an app for customers, a customer service automation, an internal dashboard. At that moment you stop being the SaaS customer and become the TV manufacturer. And LG's mistake, whether in communication or product, becomes your risk.

The path I follow with my clients is simple:

• Collect only what the feature needs. If the quote form does not use date of birth, it does not go in the form. Every extra field is one more problem to store.
• Default off, not on. Any extra tracking starts disabled. The customer turns it on if they want. It is the opposite of what most TVs do, and it is what keeps you out of the headlines.
• Explain in plain language. No "experience optimization". If you collect what someone watches, write "we log what you watch to recommend content". Those who dislike it turn it off. Those who like it trust you more.
• Write down what the automation does with each piece of data. A simple table: data, what it is for, how long it is kept, who has access. It fits on one page and settles ninety percent of an audit.

A custom furniture store I built a WhatsApp quote flow for wanted to keep the audio of conversations "to train the team". We talked and switched to keeping only the transcript, deleting it after ninety days, and telling the customer in the first message. The result for the team was the same. And the store does not have to explain to anyone why it has two-year-old customer audio on a server.

What to do this week

You do not need to replace all your systems. You need one hour of attention.

1. List the subscription tools that store customer data. It is usually between five and fifteen.
2. For each one, open the privacy page and search for the word "share" or "partners". Read only that section.
3. Mark the ones where you cannot explain in one sentence what they do with the data.
4. Send the four questions above to those tools' support. In writing, so there is a record.
5. If you are building something of your own, start the data table today. Even if it is in a notebook.

LG will settle its fight with whoever published the investigation. What is left for you is the question it raised: is the software you use every day listening to more than you think? If the answer is "I don't know", that is the only real problem, and it is easy to fix.

If you want help mapping this out or building an automation that respects the customer from the very first field, take a look at who I am and how I work.

My TV knows I watched three seasons of a baking reality show. I would rather that stayed between us.

LG is fighting to prove its TVs do not record conversations. That may well be true. But tracking of what you watch exists, ships on by default, and sits hidden in a menu nobody opens.

Now think about the subscription software that stores your customers' data. You have access, not ownership. If it leaks, the name in the headline is yours, not the vendor's.

I saw a clinic using a free scheduling system whose patients started getting health insurance ads on the day of their appointment. Free in exchange for data is the most expensive business model there is.

Four questions solve most of this: where the data lives, whether I can export everything, what you do with it beyond running the service, and whether there is a data processing agreement.

If you cannot say what your tools collect, that is the only real problem. I wrote about how to fix it in one hour, the link is in the comments.

#DataPrivacy #SaaS #DataProtection #Automation #SmallBusiness