On January 1, 2020, California’s new Internet of Things
(IoT) Security Law will go into effect. (Senate Bill 327.) Signed
into law in September 2019, this is the first IoT-specific security
law in the country. With all the discussion of the California
Consumer Privacy Act (CCPA) this year, many have overlooked
California’s first-in-the-nation IoT law.
The law requires all connected devices sold or offered for sale
in California to be equipped with “reasonable security”
measures. The law defines “connected device” as
“any device, or other physical object that is capable of
connecting to the internet, directly or indirectly, and that is
assigned an Internet Protocol address or Bluetooth address.”
Such a device may include copy machines, printers, fax machines,
televisions, Bluetooth headsets, keycard readers,
“smart” light bulbs, personal fitness monitors, medical
diagnostic equipment and a host of other devices.
