Free apps become residential proxy infrastructure

Bright Data's consumer-app SDK has been reverse-engineered in research showing how free apps can turn user devices, including always-on smart TVs, into exit nodes for web-scraping traffic.

The company, previously known as Luminati, advertises more than 400 million residential IPs and describes an SDK-sourced pool of more than 150 million IPs.

The practical exposure is that a household connection and bandwidth can be used as someone else's scraping infrastructure.

Smart TVs are sensitive in that model because they are usually plugged in, connected to fast networks and left running for long periods.

Consent screens face a technical gap

The researcher found that the channel carrying scraping jobs lacked normal authentication controls and, on iOS, could bypass a configured VPN.

The SDK could also continue relaying traffic in the background while a user watched the screen or took a call, unless the battery was low.

One Roku app, Petflix, presented an opt-in screen saying the device and connection would be used occasionally.

The SDK settings reviewed in the research allowed up to 200 GB of traffic a month, with far higher limits in a few countries, including Uzbekistan and Oman.

AI demand changes the economics

Demand for residential IP addresses is rising as AI data harvesting runs into anti-bot defenses.

Cloudflare and DataDome can block scrapers using datacenter IPs and push scraping traffic toward residential connections.

That does not make consent-based proxy networks the same as criminal botnets.

Bright Data says its exit nodes opt in through a consent screen, while botnets hijack devices.

The question is whether that consent is specific and durable enough when the device may be a living-room TV.

What device owners and IT teams can watch

Bright Data's public partner list includes smart-TV app makers such as PlayWorks Digital, CloudTV and Longvision, although the list alone does not prove a current app still carries the SDK.

Google, Amazon and Roku have restricted background proxy SDKs, and Bright Data dropped those platforms while still listing Samsung's Tizen and LG's webOS.

For households, the actionable watchpoint is unusual background traffic from free apps to Bright Data SDK-related infrastructure.

Router-level tools such as Pi-hole or NextDNS can help reduce that exposure when the relevant domains are identified.

The practical question is whether app stores, device makers and network administrators can make background proxy use visible before residential bandwidth becomes a hidden AI supply chain.