Smart Bulb Privacy and What Your Lights Reveal at Home

When I was fitting alarm panels for a living, the most valuable thing in a survey was never the floor plan. It was the engineer's log of when the system had been set and unset over the previous month. Three weeks of that tells you which nights the house is empty, who comes home first, and whether anyone is in during the day. We were careful with those printouts.

Every Wi-Fi bulb in your house now produces the same log, in finer detail, and sends it somewhere you have probably never looked. Nobody worries about it because there is no lens and no microphone. I think that is the wrong way round. A bulb that reports every on and off event with a timestamp is a better occupancy sensor than the motion detectors I used to install, and the data leaves your house by design rather than by accident.

What a smart bulb actually sends

Start with what has to be transmitted for the thing to work. Any cloud connected bulb keeps an open connection to a server so that an app on a phone somewhere else can reach it. Over that connection it reports state changes: on, off, brightness value, colour value, and the time each change happened. It also reports availability, which is a heartbeat every thirty to sixty seconds confirming the bulb has power.

That heartbeat matters more than people expect. It means a server knows when the circuit in your hallway lost power, even if nobody touched the app. Combine the heartbeat with the state log and you have a record of when someone was physically in each room, accurate to the second, for every room with a bulb in it.

Then there is the second tier, which is not required for the bulb to function. Device identifiers, your phone model and operating system version, the local network name in some cases, approximate location derived from your connection, app open and close events, and crash diagnostics. The budget bulbs built on the Tuya platform, which covers a very large share of own brand bulbs sold under dozens of names, share one back end and one set of defaults for all of it.

I checked the retention terms on four bulb brands I own. Two gave a specific figure for how long event history is kept, one said "as long as necessary for the purposes described", and one did not mention lighting event data at all. That last one is the honest answer about where the industry is, and it is why our piece on reading a privacy policy before you buy is still the most useful twenty minutes you can spend before checkout.

What can be worked out from a lighting log

This is the part that gets dismissed as paranoia, so let me be concrete about what is trivially derivable rather than speculative.

Wake time, to within about ten minutes, from the first bedroom or bathroom event on weekday mornings. Departure time, from the hallway light going off. Whether the house was empty between those events, from the absence of any state change. Shift patterns, from the weekly rhythm. Holidays, from a week of either total silence or a suspiciously regular pattern, which is a real argument for using the varied timing in our guide to vacation mode lights that look lived in rather than a plain daily schedule.

Household size is harder but not much. Two people with different routines produce overlapping event clusters that a basic script separates in minutes. Illness, a new baby, a relationship ending: all of these change lighting patterns sharply enough to be visible in a chart.

None of that requires the manufacturer to be malicious. It requires the data to exist, which it does, and to be reachable by someone who wants it. Breaches happen, companies get acquired, and support staff have admin consoles. The security trade learned to treat set and unset logs as sensitive. The smart home trade has not got there yet.

The advice I would skip, at least at first

Ask this question in any smart home forum and within three replies somebody will tell you to put every device on a separate VLAN and block its internet access at the firewall. It is technically correct and it is also, for most households, the wrong first move.

Here is what I have seen happen. The VLAN goes up, the bulbs lose their cloud connection, half of them stop responding to the app because they were never designed to work locally, voice control breaks because the assistant lives on the other network, and after a fortnight of frustration somebody flattens the whole thing back onto one network and gives up on the subject entirely. Net privacy improvement after three months: none.

The decision that actually changes your exposure is made at purchase, not at the router. A Zigbee or Thread bulb paired to a local hub does not need an outbound connection for lights to work, so network segmentation becomes optional instead of load bearing. A cloud only Wi-Fi bulb is a cloud only Wi-Fi bulb whatever you do downstream of it. Buy the first kind and the hard networking problem mostly evaporates.

I do run a separate network for devices now. I set it up after I had already replaced the bulbs, which is the right order and took a tenth of the effort.

What to change this week

Find the analytics toggle and turn it off. In most lighting apps it sits under Settings, then Privacy or About, worded as usage data, diagnostics, or helping to improve the product. Switching it off has never broken a bulb for me. It stops the second tier of collection, not the first.
Delete the history you can. Hue, SmartThings and the Tuya based apps all have an account data request or deletion option, usually buried two levels into account settings. The event log is often not included in what gets deleted, so read the confirmation text rather than trusting the button.
Audit linked accounts. Every assistant, every IFTTT style service and every abandoned app that still holds a token for your lights is another copy of the same log. Revoke anything you have not deliberately used in three months. The same reasoning applies to assistant history, covered in our walkthrough on finding and deleting what your smart speaker recorded.
Turn off location permission for the lighting app. Geofencing is the only feature that needs it. If you are not using geofencing, the app is collecting location for nothing.
Check who else is on the account. Old housemates, an ex partner, a builder you added during a renovation. Shared access to a lighting account is shared access to the occupancy log, and nobody ever removes these.
Write down which rooms have cloud bulbs. Bedrooms and bathrooms are where lighting data is most revealing. Those are the rooms I would move to local control first, and in my house they were the last ones I got round to.

Six steps, about forty minutes, no hardware. That is a better return than any amount of firewall work on devices you have already bought.

Buying with this in mind

Three things I now check before a bulb goes in the basket. Does it work with the hub or app when the internet is down, which the manufacturer will usually answer in a support article rather than the product page. Does the brand publish a retention period for device event data in plain numbers. And does it support Matter, which at least gives you a route to local control through a hub you choose rather than one the vendor chose.

Zigbee bulbs with a bridge cost more up front, roughly 15 to 25 pounds a bulb against 8 to 12 for a bare Wi-Fi one, plus 40 to 60 for the bridge. For a whole house that gap is real money. For the three or four rooms where the log would bother you, it is the cheapest privacy improvement available, and the bulbs keep working when the company behind them loses interest. The rest of our smart lighting coverage goes into the practical side of living with each type.

One honest limit. I cannot tell you what any given manufacturer does with lighting event data internally, because none of them describe it at that level of detail and I have no way to verify what they would say. What I can tell you is that the data exists, that it is enough to profile a household, and that the industry has not yet earned the benefit of the doubt it currently gets.

FAQ

Can a smart bulb be used to spy on me?

Not in the sense of audio or video, since bulbs contain neither. What they produce is a precise occupancy record, which answers most of the questions a watcher would want answered anyway.

Do Zigbee or Thread bulbs send data to the manufacturer?

The bulb itself talks only to your hub over a local radio. Whether anything leaves the house depends on the hub and whether you have linked a cloud account to it. With cloud features off, the lighting log stays local.

Is it worth putting smart bulbs on a guest network?

It isolates them from your laptops and phones, which is worthwhile, but it does not stop them reporting to their own servers. Treat it as a security measure rather than a privacy one.

Does turning off analytics stop the event log?

No. Analytics covers app and diagnostic data. The on, off and brightness events are part of how a cloud bulb works, and the only way to stop sending them is to stop using cloud control.