Arnold & Porter Discusses New California Law On Security For Internet-Connected Devices

California has passed the first state law imposing security requirements on devices in the Internet of Things (IoT). On September 28, 2018, California Governor Jerry Brown signed into law the nearly identical Senate Bill 327 and Assembly Bill 1906,¹ which require manufacturers of Internet-connected devices that are sold or offered for sale in California to equip them with "reasonable security features."² Manufacturers of IoT devices are now on the clock to make the necessary changes to comply with the law before it becomes effective on January 1, 2020. While the law does provide some specific guidance for manufacturers—including new rules regarding default passwords and user authentication—it also imposes open-ended requirements that will require manufacturers to grapple with its interpretation when designing product security features.