California is the first state to pass a cybersecurity law addressing “smart” devices and Internet of Things (IoT) technology, impacting virtually anything connected to the internet, including smart home devices (e.g., WeMo Smart Plugs, August's Smart Lock, NEST thermostats, etc.) and connected appliances. SB-327 takes effect January 1, 2020.

The new law specifies the security obligations of “manufacturers” of connected devices. A manufacturer includes the person who manufactures, or contracts with another person to manufacture, connected devices sold or offered for sale in California. The law will therefore apply to manufacturers outside of California if their products are sold in California.

Under the new law, a covered manufacturer of a connected device must equip the device with a “reasonable security feature” that is:

• Appropriate to the device’s nature and function;
• Appropriate to the information the device may collect, contain or transmit; and
• Designed to protect the device and any of its information from unauthorized access, destruction, use, modification or disclosure.

The phrase “security feature” includes any feature designed to provide security for the device. “Unauthorized access, destruction, use, modification or disclosure” is defined to include access, destruction, use, modification or disclosure that is not authorized by the consumer. If a device has the ability to authenticate outside a local area network, the security feature is deemed to be reasonable if either:

• The preprogrammed password is unique to each device; or
• The security feature requires a user to generate a new means of authentication before access is granted to the device for the first time.

Although the law is sweeping in scope, there are some safeguards and exemptions. For example, there is no private right of action under the statutes, activities regulated by HIPAA are exempt, and manufacturers are not responsible for choices made by the owner/consumer or for the impact of non-affiliated software or apps. In light of the breadth of the law and the specific nature of the exemptions, manufacturers whose connected devices are or will be sold in California should assess which of their products will be subject to the new law and ensure that “reasonable security features” are in place.