Streaming privacy and security come down to a short list: change the router’s admin password, use WPA3 or WPA2 Wi-Fi, put TVs and sticks on a guest network, install players only from official app stores, turn off smart TV viewing-data collection, and pay only by Interac e-Transfer from your own bank. Each step takes minutes.
Key takeaways
- Change the router’s admin password, use WPA3 or WPA2, update the firmware and switch off WPS.
- Put smart TVs and streaming sticks on a guest network, and install players only from official app stores.
- Turn off viewing-data collection and ad tracking on smart TVs, Fire TV and Google TV.
- Pay only by Interac e-Transfer from your own banking app, and never give a card number or banking password in a chat.
- A message that says your plan will renew or be charged automatically is not from us: our plans never renew by themselves.
The checklist at a glance
Here is the whole checklist in one place. The sections below explain each step and where to find the settings.
| Step | Why it matters | Time needed |
|---|---|---|
| Change the router’s admin password | Default passwords are often printed on the box or shared across models | 5 minutes |
| Use WPA3, or WPA2 if a device can’t | Older Wi-Fi security is easier to break | 5 minutes |
| Update the router and switch off WPS | Updates close security holes; the WPS PIN has a known weakness | 10 minutes |
| Guest network for TVs and sticks | Keeps smart devices away from your computers and phones | 10 minutes |
| Install apps only from official stores | Modified copies can carry unwanted code | Ongoing |
| Turn off viewing data and ad tracking | Limits what your TV reports about your viewing | 5 minutes per device |
| Pay by e-Transfer from your own bank | No card number or banking password leaves your hands | Each payment |
| Learn the signs of fake messages | Phishing is the most common way accounts and money are stolen | Ongoing |
None of these steps slows your streams down. A secure network and a private TV play exactly as well as an open one.
Lock down the router first
The router is the front door for every device in your home, so it comes first. It has two separate passwords: the Wi-Fi password your devices use to join, and the admin password that opens the router’s settings page. Many people change the first and never touch the second.
Sign in to the router’s settings, using the address and default login printed on its label or in its app, and change the admin password to a long passphrase. Get Cyber Safe, the Government of Canada’s awareness campaign, recommends passphrases because they are longer than a password yet easier to remember. Four or five unrelated words work well.
While you’re in the settings, look for three more things. Turn on automatic firmware updates, or install the latest version if updates are manual. Switch off remote management, which lets the router be configured from outside your home, unless your internet provider needs it. And switch off WPS, the push-button or PIN pairing feature.
WPS deserves its own warning. A weakness in the WPS PIN method was made public in December 2011, and the usual advice since then has been to turn WPS off entirely. Your devices don’t need it: they join with the Wi-Fi password like any other device. Our guide to router settings for streaming covers the performance settings on the same pages.
WPA3 or WPA2: choosing Wi-Fi security
WPA3 is the current Wi-Fi security standard. It was announced in 2018 and makes it much harder to guess a Wi-Fi password by trying thousands of possibilities offline. If your router and all your devices support it, use it.
Many homes have at least one device that can’t join a WPA3-only network, often an older streaming stick, smart TV or printer. For those homes, routers offer a mixed or transition mode, usually labelled WPA2/WPA3. Newer devices connect with WPA3 and older ones fall back to WPA2. That is a sensible middle ground.
Avoid anything older. If your router offers WEP, WPA (without a number) or TKIP, don’t use them, and treat a router that offers nothing better as due for replacement. An open network with no password at all is never a good idea at home, even in the country.
When you change the security mode, every device has to rejoin. Do it on an evening with no game on, and keep the Wi-Fi password handy for the TV and the streaming sticks, which are the slowest to type it into.
Put TVs and streaming sticks on a guest network
Smart TVs and streaming sticks run software you can’t inspect, from makers that stop sending updates after a few years. Keeping them on a separate network means that if one is ever compromised, it can’t reach the laptop where you do your banking. The Get Cyber Safe page on TVs and smart devices recommends exactly this, and suggests asking your service provider for help to create a guest network.
Most routers and internet provider gateways have a guest network option. Turn it on, give it its own name and password, and join the TVs, sticks, game consoles and smart speakers to it. Keep computers, phones and anything with personal files on the main network.
There is one trade-off. Guest networks usually stop devices from seeing each other, so casting from a phone or using a phone as a remote may stop working. If you rely on those features, put the phone you use with the TV on the guest network too, or check whether your router lets you allow device-to-device traffic on the guest network.
A guest network doesn’t reduce speed for streaming. The TV still gets the full internet connection; it just can’t wander into the rest of your home network.
Install players only from official app stores
Player apps are available in the official stores for each platform: the Amazon Appstore on Fire TV, Google Play on Android TV and Google TV, the App Store on Apple TV and iPhone, and the Samsung and LG stores on their TVs. An app from an official store has been through that store’s checks and receives updates automatically.
The risk comes from modified copies of paid apps passed around on websites and in forums, often advertised as unlocked or free. They can carry code that shows ads, collects data or uses your device for someone else’s purposes, and they never receive security fixes. Our comparison of free and paid IPTV players explains how to try a real app before paying for it.
Some players on Fire TV are installed with a downloader app, because the developer distributes them directly. If you do that, download only from the developer’s own website, and turn the permission to install unknown apps back off for the downloader once you’re done. Our TiviMate setup guide for Fire TV walks through that process.
Before you install anything, check the developer name in the store listing. Copycat apps sometimes use a similar icon and name with a different developer behind them.
Check what each app is allowed to do
A player app needs very little: network access to reach the server, and storage if you record programmes or save backups. It doesn’t need your location, your contacts, your camera or, unless you use voice search inside it, your microphone.
On Android TV and Google TV, open Settings, then Apps, choose the player and review its permissions. On Fire TV, installed apps are listed under Settings → Applications → Manage installed applications. On phones, the same check sits in the app’s entry in the system settings.
If an app asks for something it has no reason to need, refuse the permission and see whether it still works. If it won’t run without access to your contacts or location, that is a good reason to choose another app.
Review permissions after big app updates too. A new version can ask for new permissions, and it is easy to tap Allow without reading when you just want the game to start.
Turn off viewing-data collection on smart TVs
Many smart TVs can recognise what is on the screen and report it back to the maker. The technology is called automatic content recognition, or ACR. It works by matching small samples of the picture or sound against a reference library, and the results are used for recommendations and advertising.
On Samsung TVs, the feature is called Viewing Information Services. Samsung’s page on its ACR feature says it is optional, that it can capture viewing history, TV identifiers and your IP address, and that you can opt out at any time in the TV’s settings. Look for it in the privacy section of the Settings menu, labelled Terms & Privacy or Privacy Choices depending on the year of the TV.
Other brands have similar switches under their own names. On an LG webOS TV or any other brand, open the general or privacy section of the settings and look for anything that mentions viewing information, content recognition, interest-based advertising or user agreements. Turn off what you don’t want, and accept that a few recommendation features may get less personal.
The simplest way to limit what a smart TV learns is to use a streaming stick for your viewing and keep the TV itself as a screen. Even then, turn off the TV’s ACR setting, because some sets can analyse what arrives through the HDMI inputs as well.
Privacy settings on Fire TV and Google TV
Streaming sticks and boxes have their own data and advertising settings, separate from the TV’s. Here is where to find the main ones.
| Device | Setting | Where to find it | What it does |
|---|---|---|---|
| Fire TV | Device Usage Data | Settings → Preferences → Privacy Settings | Stops use of device usage data for marketing and product improvement |
| Fire TV | Collect App Usage Data | Settings → Preferences → Privacy Settings | Stops collection of when and how long you use other apps |
| Fire TV | Interest-based Ads | Settings → Preferences → Privacy Settings | Asks apps not to use the advertising ID for profiling |
| Google TV | Delete advertising ID | Settings → Privacy → Ads | Removes the device’s advertising ID |
| Google TV | Location | Settings → Privacy → Location | Turns off location for the device |
Amazon notes that turning off Device Usage Data doesn’t stop features such as parental controls or the recently watched row from working. Google notes that even with location off, your general location can still be estimated from your IP address. Neither setting affects how streams play.
Smart TVs that run Fire TV or Google TV as their built-in system can have two sets of controls: the TV maker’s own viewing-data setting and the platform’s privacy menu. Check both.
Microphones, cameras and voice remotes
Voice remotes and TVs with built-in microphones or cameras are convenient, but they add sensors to the room. Get Cyber Safe advises turning off features such as cameras, microphones, Bluetooth and location when you aren’t using them, so they can’t be misused.
On a TV with a camera, close its privacy shutter or push it down when it isn’t in use, if the model has one. If you never use voice search, look for the microphone or voice assistant setting on the TV and switch it off. A streaming stick’s voice remote can still be used as an ordinary remote.
Smart speakers paired with a TV are worth a look too. Review their voice recordings in the maker’s app, delete the ones you don’t want kept, and mute the microphone during private conversations.
Finally, Get Cyber Safe suggests switching off or disconnecting a smart device you only use occasionally. A basement TV that is on twice a month doesn’t need to stay connected the rest of the time.
Pay safely with Interac e-Transfer
We take payment only by Interac e-Transfer, sent from your own online or mobile banking. That means you never need to give anyone a card number or your banking password to pay for your plan. You log in to your own bank, enter the amount and the recipient, and send.
The Interac e-Transfer page recommends sending money only to people and businesses you know and trust, and choosing a security answer that isn’t obvious, never written in the message itself. If the recipient uses Autodeposit, no security question is needed at all.
Send only to the recipient shown on our order page or in your order confirmation. If a message, call or chat asks you to send money to a different address, to “correct” a payment or to pay a fee you didn’t expect, stop and check with Online Support first, reaching us by typing our address yourself rather than tapping a link.
Because no card is involved, nothing renews or is charged without you sending a new transfer. Our prices are listed on the plans and prices page, so an offer in our name at a very different price is a warning sign.
Spot fake renewal messages and phishing
Phishing messages copy the look of real companies to get you to click a link, pay or hand over a password. Streaming subscriptions are a popular disguise, because most people have one and expect renewal notices. The Get Cyber Safe guide to recognising phishing advises not opening unexpected links or attachments and confirming urgent payment requests through a separate channel.
A few facts about how we work make fake messages easier to spot:
- Our plans never renew automatically. A message saying your plan “will be charged” or “has renewed” is not from us.
- We send a reminder before your plan ends. It never threatens to delete your account within hours.
- We never need a card number, your banking password or a one-time code from your bank.
- Your login arrives by email and in the Online Support chat after you pay, not through a link to another site.
Report phishing text messages by forwarding them to 7726, which spells SPAM on most keypads, so mobile providers can block them. If you lost money, contact your bank right away, then report it to the Canadian Anti-Fraud Centre at 1-888-495-8501 and to your local police.
Keep your login private
Your login is the key to your screens. Anyone who has it can use them, sometimes at the exact moment you want to watch, and you may first notice when your own TV reports that all connections are in use.
An M3U playlist link contains your username and password inside it. So does a screenshot of a player’s playlist settings. Don’t post either in a forum, a group chat or a review when asking for help, and crop or blur the server and password lines from any photo you share. Our guide to Xtream Codes and M3U logins shows which parts of each login are sensitive.
Share the login only with the people in your household who watch on your screens. If you think it has leaked, or a former roommate still has it, ask Online Support to change the password. You’ll then enter the new one on each of your devices.
The Online Support chat is private to your mobile number, so it is the right place to send login details when we ask for them. Email to help@supportiptv.ca works too.
Public Wi-Fi, hotels and VPNs
Hotel, campground and café networks are shared with strangers. Streaming a channel over them is fine, but avoid signing in to your router, your bank or your email on a network you don’t control, unless you’re sure the page is encrypted and genuine.
A VPN can add privacy on public Wi-Fi by encrypting traffic between your device and the VPN server. It also adds distance and processing, which can slow streams. Our article on whether a VPN slows down IPTV explains when it helps and when it hurts.
A phone hotspot is often the more private choice for short trips: the network is yours and protected by your own password. Watch the data use, which our guide to watching IPTV while travelling works out per hour.
Whatever network you use away from home, keep the same habits as at home: official apps only, and no login details typed into pages you reached from a pop-up.
Children and shared devices
Privacy at home includes what children can open and buy. Streaming devices, app stores and player apps each have their own controls, and they work best in layers.
Set a PIN for purchases in the app store on each device, so a child can’t install apps or buy in-app content without you. Then add a PIN in the player for adult categories, and use profiles on devices that support them so each person’s history and recommendations stay separate.
Our guide to IPTV parental controls covers PIN locks in common player apps, device-level controls on Fire TV, Google TV and Apple TV, and filtering at the router.
Shared devices also mean shared logins. Children don’t need to know the account password to watch; once it is entered in the player, it stays there.
Old devices that no longer get updates
Every smart TV and streaming stick eventually stops receiving software updates. After that, security holes found in its system stay open. Get Cyber Safe advises turning on automatic updates, or installing updates as soon as you’re prompted, for exactly this reason.
Check each device’s update setting today, and turn on automatic updates where the option exists. If the maker’s support page says a model no longer receives updates, keep it on the guest network, avoid signing in to personal accounts on it, and plan to replace it.
The same goes for the router. A router that hasn’t had a firmware update in years is the weakest point in the home, however careful you are with everything behind it. Replacing it often improves Wi-Fi speed as well.
Before you sell or give away an old TV, stick or router, do a factory reset. That removes saved Wi-Fi passwords, app logins and account links.
If something has already gone wrong
If you clicked a suspicious link, sent money to the wrong place or think someone else is using your network or your login, act in this order:
- Money sent by e-Transfer to the wrong recipient: call your bank first, right away. The sooner they know, the better the chance of stopping it.
- A password typed into a fake page: change that password, and any other account that uses the same one, starting with email and banking.
- Unknown devices on your Wi-Fi: change the Wi-Fi password and the router admin password, then rejoin your own devices.
- Your streaming login in the wrong hands: ask Online Support to change it.
- A device acting strangely after installing an app: uninstall the app, and factory reset the device if the behaviour continues.
- Report fraud to the Canadian Anti-Fraud Centre and your local police, and forward scam texts to 7726.
When you contact us, tell us what happened, when, and which device or message was involved. A screenshot of a suspicious message helps us warn other customers. Questions like this are part of the help that comes with our IPTV Canada service, and the same checklist protects the rest of your connected home.
Questions people ask
Can a smart TV track what I watch?
Many can. Smart TVs with automatic content recognition, such as Samsung’s Viewing Information Services, can report viewing history, TV identifiers and your IP address to the maker. You can turn the feature off in the TV’s privacy settings. Do the same for ad tracking on any streaming stick you use.
Is it safe to pay for streaming with Interac e-Transfer?
Yes, when you send it yourself from your own online or mobile banking to a recipient you know. No card number or banking password leaves your hands. Use a security answer that isn’t obvious, never put it in the message, and confirm any request to change the recipient through a separate channel.
Should my smart TV be on a guest Wi-Fi network?
It is a good idea. A guest network keeps TVs and streaming sticks away from computers and phones that hold personal files, and it doesn’t slow streaming. The trade-off is that casting from a phone may stop working unless the phone joins the guest network too.
Is WPA2 still safe for streaming devices?
WPA2 with a long, unique password is still acceptable, but WPA3 is stronger against password guessing. If some devices can’t join a WPA3 network, use the router’s mixed WPA2/WPA3 mode so newer devices get WPA3 and older ones fall back. Avoid WEP, plain WPA and TKIP.
How do I spot a fake streaming renewal message?
Watch for urgency, a link to a site you didn’t type yourself, a request for card details or a banking code, and payment to a new address. Our plans never renew automatically, so a message saying you have been charged or renewed is not from us. Check with Online Support first.