U.S. California SB-327 — Security of Connected Devices

Why does it matter?

SB-327 was the first state law to put a security duty on the maker of an internet-connected product rather than on the data holder, and it applies by point of sale: a device offered for sale in California is covered wherever it was designed or built (1798.91.05(c)). The duty is short but enforceable by the Attorney General, any city attorney, county counsel or district attorney (1798.91.06(e)), and because the standard is appropriateness to the device and its data, the password safe harbor in 1798.91.04(b) is the floor, not the ceiling. The Legislature's own analysis of the bill described default and shared passwords on consumer devices as the weakness the law targets.

Key benefits include:

• One statutory duty

Equip each connected device with a reasonable security feature or features that meet the three tests of 1798.91.04(a): appropriate to the device, appropriate to its data, and designed to protect against unauthorized access, destruction, use, modification or disclosure.

• A concrete safe harbor

For devices authenticated from outside a local area network, a password unique to each unit or a forced change of authentication before first access is deemed reasonable (1798.91.04(b)).

• A standards route

A device that meets the baseline criteria, passes a third-party conformity assessment and bears the binary label of a NIST conforming labeling scheme satisfies subdivision (a) (1798.91.04(c)).

• A wide device definition

Any device or physical object that can connect to the internet directly or indirectly and has an IP or Bluetooth address is a connected device (1798.91.05(b)); there is no consumer-only limit in the text.

• Public enforcement only

No private right of action; the Attorney General, city attorneys, county counsel and district attorneys have exclusive authority (1798.91.06(e)), cumulative with other law (1798.91.06(f)).

How does it work?

Section 1798.91.04(a) is the whole obligation. A manufacturer of a connected device shall equip it with a reasonable security feature or features that are all of the following: appropriate to the nature and function of the device; appropriate to the information it may collect, contain or transmit; and designed to protect the device and any information contained in it from unauthorized access, destruction, use, modification or disclosure. Section 1798.91.05(f) adds that unauthorized means not authorized by the consumer, and (e) that a security feature is a feature of a device designed to provide security for that device. The standard therefore scales with the product: a sensor that stores nothing and a camera that streams video are judged against their own function and data.

Subdivision (b) supplies the safe harbor that gave the law its reputation as the no-default-passwords law. Subject to all of the requirements of subdivision (a), if a connected device is equipped with a means for authentication outside a local area network, it is deemed to have a reasonable security feature if either the preset password is unique to each device manufactured or the device contains a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time. Authentication is defined in 1798.91.05(a) as a method of verifying the authority of a user, process or device to access resources in an information system.

Subdivision (c), in the section since January 1, 2023, lets a manufacturer satisfy subdivision (a) by ensuring the device meets or exceeds the baseline product criteria of a NIST conforming labeling scheme, satisfies a conformity assessment under that scheme that includes a third-party test, inspection or certification, and bears the scheme's binary label. Section 1798.91.05(d) ties the term to NIST's Cybersecurity White Paper Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products of February 4, 2022, including revisions and successor publications. The Assembly Privacy and Consumer Protection Committee analyzed the amendment as AB 2392 (Irwin) at its hearing of April 19, 2022.

Section 1798.91.05 fixes the reach. A connected device is any device, or other physical object, capable of connecting to the internet directly or indirectly and assigned an internet protocol address or Bluetooth address. A manufacturer is the person who manufactures, or contracts with another person to manufacture on its behalf, connected devices sold or offered for sale in California; a contract only to purchase a device, or to purchase and brand it, does not make the buyer a manufacturer. Section 1798.91.06 then limits the title: no duty for third-party software a user adds (a), none for app stores (b), no duty to stop users modifying their own device (c), no application to devices under federal security requirements (d) or to HIPAA or CMIA regulated activity (h).

Enforcement is public. Section 1798.91.06(e) states that the title provides no basis for a private right of action and that the Attorney General, a city attorney, a county counsel or a district attorney has exclusive authority to enforce it; (f) makes its duties cumulative with other law, (g) preserves law enforcement access to device information under lawful process, and (i) made the title operative on January 1, 2020. The bill passed with contingent enactment language so that SB-327 and AB 1906 took effect only together; both were chaptered in 2018 (Chapters 886 and 860, Statutes of 2018).

Key Elements

• Reasonable security feature (1798.91.04(a))

Appropriate to the nature and function of the device, appropriate to the information it may collect, contain or transmit, and designed to protect the device and its information from unauthorized access, destruction, use, modification or disclosure.

• Authentication safe harbor (1798.91.04(b))

For devices authenticated from outside a local area network: a preset password unique to each device, or a forced new means of authentication before first access.

• NIST labeling route (1798.91.04(c) and 1798.91.05(d))

Baseline criteria met, third-party conformity assessment passed and binary label borne under a scheme conforming to NIST's February 4, 2022 consumer IoT labeling criteria or its successors.

• Connected device and manufacturer (1798.91.05(b) and (c))

Any internet-connectable device or object with an IP or Bluetooth address; the person who makes it or contracts for its making for sale in California, but not a mere purchaser or purchaser-and-brander.

• Carve-outs (1798.91.06(a) to (d) and (h))

Third-party software and app stores, user modification rights, devices under federal security requirements, and HIPAA or CMIA regulated activity are outside the title.

• Enforcement (1798.91.06(e) to (g))

No private right of action; exclusive public enforcement by the Attorney General, city attorneys, county counsel and district attorneys; duties cumulative with other law; law enforcement access preserved.

What does it cover?

The title applies to manufacturers, as defined in 1798.91.05(c), of connected devices sold or offered for sale in California, whatever the device's purpose: the definition in 1798.91.05(b) covers any device or physical object that can connect to the internet directly or indirectly and has an IP or Bluetooth address, so consumer, commercial and industrial products are all in scope unless 1798.91.06 excludes them. It does not reach retailers, importers who only buy or buy and brand a device, providers of app stores, or unaffiliated software the user installs, and it does not apply to devices whose functionality is already subject to federal security requirements or to HIPAA and CMIA regulated activity (1798.91.06(a), (b), (d) and (h)). The duty has applied since January 1, 2020 (1798.91.06(i)).

What are its objectives?

The title states no separate purpose clause; its objectives follow from the operative text and the Legislature's committee analysis.

Require every connected device sold in California to ship with security appropriate to what it does and what data it holds (1798.91.04(a)).

End shared and default passwords on devices reachable from outside the local network by making unique or user-set authentication the deemed-reasonable feature (1798.91.04(b)).

Give manufacturers a standards-based route to compliance through a NIST conforming labeling scheme with third-party assessment (1798.91.04(c)).

Place the duty on the manufacturer, not the retailer, user or app developer, and keep it cumulative with other law (1798.91.05(c) and 1798.91.06(f)).

Enforce through public prosecutors only, without a private right of action (1798.91.06(e)).

Framework in Context

SB-327 predates the federal consumer IoT labeling work it now references: the Legislature's 2022 amendment pointed subdivision (c) at NIST's Recommended Criteria for Cybersecurity Labeling for Consumer IoT Products of February 4, 2022, the document behind the U.S. Cyber Trust Mark, and the Assembly committee analysis of AB 2392 recorded that the identical SB-327 and AB 1906 of 2018 had rejected a standards-based approach at the time. The title sits in the Civil Code beside the Customer Records title, whose breach-notification section 1798.82 governs what happens when a device's stored data are taken, and the Legislature wrote in 1798.91.06(f) that the device duty is cumulative with those laws. Devices already governed by federal security requirements, such as regulated medical devices, are left to their federal regime (1798.91.06(d)).

Common Framework Mappings

Organizations map the section 1798.91.04 duty to the security frameworks below so that the device's authentication design, conformity evidence and label records satisfy California and the standards their customers expect.

Mapped frameworks include:

CIS Controls v8.1

COPPA

GDPR

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2

UL 2900-1