Law / United States / 
California
Security of Connected Devices
Cal. Civ. Code sections 1798.91.04-1798.91.06 (Title 1.81.26, added by Stats. 2018, Ch. 860 (AB 1906) and Ch. 886 (SB 327); sections 1798.91.04 and 1798.91.05 amended by Stats. 2022, Ch. 785 (AB 2392))
In force since .
A product security requirements rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Security
What it requires
- This binds a manufacturer of a physical connected device, a device or other physical object capable of connecting to the internet, directly or indirectly, and assigned an internet protocol or Bluetooth address, that is sold or offered for sale in California; it does not by itself reach a developer who publishes only an app or other software with no connected device of its own, and it does not reach unaffiliated third-party software or apps a user chooses to add to someone else's device.
- Equip the device with a security feature or features appropriate to its nature, function, and the information it may collect, contain, or transmit, designed to protect the device and that information from unauthorized access, destruction, use, modification, or disclosure.
- Where the device authenticates outside a local area network, give each unit a unique preprogrammed password or require the user to generate a new means of authentication before first use; meeting a National Institute of Standards and Technology (NIST)-conforming Internet of Things cybersecurity labeling scheme's baseline criteria and conformity assessment is an alternative way to satisfy the duty.
- The duty does not apply to a connected device already subject to security requirements under federal law, regulation, or federal agency guidance, or to an activity already regulated by Health Insurance Portability and Accountability Act (HIPAA) or California's Confidentiality of Medical Information Act.
- There is no private right of action for a violation; only the Attorney General, a city attorney, a county counsel, or a district attorney may enforce this title.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The Attorney General, a city attorney, a county counsel, or a district attorney, given exclusive authority to enforce this title; the statute names no other regulator and no penalty amount of its own.
What this law does
A manufacturer of a connected device, any device or other physical object capable of connecting to the internet, directly or indirectly, and assigned an internet protocol or Bluetooth address, that is sold or offered for sale in California, must equip the device with a reasonable security feature or features appropriate to the device's nature and function and to the information it may collect, contain, or transmit, designed to protect the device and any information in it from unauthorized access, destruction, use, modification, or disclosure.
Where a connected device authenticates outside a local area network, the statute deems that duty met if the device's preprogrammed password is unique to each unit manufactured, or the device requires the user to generate a new means of authentication before first use; a manufacturer may instead satisfy the duty by meeting or exceeding the baseline criteria of a National Institute of Standards and Technology (NIST)-conforming Internet of Things cybersecurity labeling scheme and completing that scheme's conformity assessment.
The duty does not reach unaffiliated third-party software or applications a user chooses to add to someone else's connected device. It also imposes no duty on an app store, gateway, or marketplace to review or enforce compliance, nor on the manufacturer to prevent a user from modifying the device's own software or firmware. The title does not apply to a connected device already subject to security requirements under federal law, regulation, or federal agency guidance.
It also does not apply to a covered entity, health care provider, health plan, business associate, contractor, or employer as to an activity already regulated by Health Insurance Portability and Accountability Act (HIPAA) or California's Confidentiality of Medical Information Act. The statute creates no private right of action; the Attorney General, a city attorney, a county counsel, or a district attorney have the exclusive authority to enforce it, and the statute names no penalty amount of its own.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .