Philips Hue is a smart lighting system — bulbs, light strips, sensors, and the Hue Bridge hub — sold by Signify N.V., the Euronext-listed company (ticker LIGHT) that was renamed from Philips Lighting in 2018 and uses the Philips brand under license from Royal Philips. The Hue Bridge communicates with lamps over Zigbee, exposes a documented local REST API on the home network, and supports the Matter smart-home standard. Signify's Data Notice describes product telemetry limited to lighting and device state, typically 10-100 data items per day, with cloud-stored data retained up to two years. In 2023 Signify announced that the Hue app would require a Hue account, which was previously optional; after public criticism it decoupled account creation from consent to usage-data processing, though the account requirement itself remained. The privacy notice states personal data is never sold or rented, while permitting sharing with service providers, affiliates, and user-connected platforms. A 2020 Zigbee vulnerability disclosed by Check Point was patched via automatic firmware update.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
COLLECTION
Signify's Philips Hue privacy notice (last updated April 2023) describes collection of account data, purchase data, tracking data, and 'Usage Data relating to our products and their functionalities,' which Signify uses for product functionality as well as analytics, personalization, and marketing.
Signify's Philips Hue Data Notice (September 2025) states that Hue products record lighting and device telemetry — typically 10-100 data items per day — and that data stored in the products themselves is temporary and overwritten, while data Signify stores in the cloud is kept up to two years.
In September 2023 Signify announced that the Philips Hue app would begin requiring users to sign in with a Hue account, which had previously been optional; on October 2, 2023, following criticism, Signify said it would update its privacy policy so that sharing usage data requires separate user consent.
The Philips Hue privacy notice identifies the data controller precisely as Signify Netherlands B.V., including its Dutch company registration number and registered address in Eindhoven.
Philips Hue is made by Signify N.V. (Euronext: LIGHT), which changed its name from Philips Lighting N.V. in May 2018 and continues to use the Philips brand for its products under a licensing agreement with Royal Philips — Hue is not a product of Royal Philips itself.
The Philips Hue privacy notice states that Signify never sells or rents personal data, while its disclosed sharing includes trusted third-party service providers performing functions for Signify and Signify affiliates worldwide.
Signify's Philips Hue Data Notice commits to sharing product data with third parties only as described in its privacy notice, and cloud-to-cloud third-party integrations require developer credentials and user-initiated connection.
Philips Hue can be connected to Amazon Alexa, Apple Home, and Google Assistant through Matter; these integrations are user-initiated, and connecting them extends lighting activity and control to those third-party platforms.
Philips Hue maintains a public security advisory page that directs vulnerability reports to Signify's responsible disclosure program and advises users to keep system software up to date.
In February 2020 Check Point Research published CVE-2020-6007, a Zigbee-protocol vulnerability that let attackers compromise a Hue bulb and pivot to the control bridge and the home or business network; the flaw was disclosed to Signify in November 2019, and Signify issued patched firmware distributed by automatic update.
After backlash over the 2023 account mandate, Hue founder George Yianni said Signify was decoupling account creation from consent to usage-data processing so that an account could be created without sharing usage data; the account requirement itself was not withdrawn.
The Hue Bridge has been updated to support Matter, the cross-vendor smart-home standard, extending standards-based interoperability to Hue lights and accessories connected via the bridge.
The Philips Hue privacy notice discloses that, after opt-in consent, Signify sometimes discloses personal data collected via cookies for cross-contextual behavioral advertising — activity the notice itself says may qualify as 'sharing' personal data under the CCPA/CPRA.
Every Hue Bridge exposes a local HTTP API on the user's home network: Signify's developer documentation instructs developers to discover the bridge's IP address on their own network and control lights through a test web app built into the bridge, meaning core light control does not have to transit Signify's cloud.