That "smart TV" you bought might be smarter than you expected. LG's smart TV sets send information back to the Korean company about what programmes you have watched, and even what files you may have stored on a USB disks attached to them, a British owner has found.

That has triggered an investigation by the the information commissioner's office over whether sending the data has been done without the user's proper consent.

The ICO says that it has "recently been made aware of a possible data breach which may involve LG smart TVs" and that it will be making inquiries.

The discovery of the data transmission was made by Jason Huntley, a UK-based IT consultant who blogged about his discovery that a setting buried deep in the system defaults included one which said "Collection of watching info", which was set to "on". He found that the data was sent whether the setting was "on" or "off".

On Thursday, LG defended its actions, saying that "information such as channel, broadcast source etc that is collected by certain LG smart TVs is not personal but viewing information". This was collected "to deliver more relevant advertisements and to offer recommendations to viewers based on what other LG smart TV owners are watching".

It conceded that the system also collected filenames of attached USB disks, which it said was "part of a new feature being readied to search for data from the internet (metadata) relating to the program being watched".

An LG spokesperson said that the company is now preparing a software update that will ensure the data is not collected if the relevant setting is off, and would stop collecting filenames.

Earlier this week, the company said that the owner had consented to the collection by accepting the terms and conditions displayed on the TV when it was set up – and so should complain to the retailer.

Millions of TVs with the ability to connect to the internet have been sold in the past two years: according to the consultancy IHS Suppli, 66m were sold in 2012, making up nearly a third of all TV sets sold. By 2015, it forecast that 55% of all TVs sold will be smart TVs, at 141m annually.

But until now it had been thought that the "smart" element was principally one-way - from the internet to the TV, rather than from the viewer to the TV set owner.

Dan Wallach, of Princeton University's centre for information technology policy, said the key problem was "incompetence", adding: "Somebody thought it was a good idea to build these TVs with all these features and nobody ever said 'maybe we need some security people on the design team to make sure we don’t have a problem', much less 'maybe all this data flowing from the TV to us constitutes a massive violation of our customers’ privacy that will land us in legal hot water'. The deep issue here is that it’s relatively easy to build something that works, but it’s significantly harder to build something that’s secure and respects privacy."

A growing number of smart TVs also offer app stores, like those found on smartphones and tablets - which could mean that they are seeking to gather more data on their users.

Data was not encrypted, meaning that it could be picked up by any system in between the TV set and LG's servers. Although the servers were not active, they could have been turned on at any time to receive user information.

In a statement, LG told the Guardian: "Customer privacy is a top priority at LG Electronics and as such, we take this issue very seriously. We are looking into reports that certain viewing information on LG smart TVs was shared without consent. LG offers many unique smart TV models, which differ in features and functions from one market to another."