California's connected-device law: what it asks of a product list

California Civil Code 1798.91.04 binds manufacturers of connected devices made or contracted to be made for sale in California: a reasonable security feature appropriate to the device, and for authentication outside a local area network, a preprogrammed password unique to each device or a user-set credential before first access.

Named, not quoted: the NIST IR 8259 series and NIST's recommended criteria for consumer IoT labelling. The duty binds the manufacturer; a business that only buys, or buys and brands, a device is not the manufacturer.

Duties by role

Role	Clauses
manufacturer	California 1798.91.04(a) Reasonable security feature or features California 1798.91.04(b) Authentication outside a local area network: unique password or forced new credential California 1798.91.04(c) Elective compliance through a NIST conforming labeling scheme
importer	none here
distributor	none here
own brand (becomes the manufacturer)	none here

Notes that cite it

Note	Clause
6. A universal default password	California 1798.91.04(b)
13. Sold in California with no reasonable security feature recorded	California 1798.91.04(a) California 1798.91.04(b)

California: every clause cited

3 of the 3 held

The requirement text is our statement of each clause, read against the copy we hold and cited to it; it is not the instrument verbatim.

California 1798.91.04(a)Reasonable security feature or features

A manufacturer of a connected device shall equip the device with a reasonable security feature or features that are all of the following: (1) appropriate to the nature and function of the device; (2) appropriate to the information the device may collect, contain or transmit; and (3) designed to protect the device and any information contained in it from unauthorized access, destruction, use, modification or disclosure (unauthorized meaning not authorized by the consumer). The duty applies to every connected device, meaning any device or physical object that can connect to the internet directly or indirectly and is assigned an IP address or Bluetooth address, made or contracted to be made by a manufacturer for sale in California; a business that only buys, or buys and brands, a device is not the manufacturer. Operative from 1 January 2020.

What a notified body or authority asks to see: Product security requirements per connected device model, showing how the chosen features fit the device's nature and function; Data inventory for each device model: what information it collects, contains and transmits, with the protection applied to each; Threat analysis or security design review covering unauthorized access, destruction, use, modification and disclosure; Scope determination listing which products are connected devices sold in California and which entity is the manufacturer

Where lists usually fall short: Generic security features never justified against the specific device and its data; Protection designed only against access, leaving modification, destruction and disclosure unaddressed; Contract-manufactured or white-label devices wrongly assumed to fall on someone else

Source: California Civil Code 1798.91.04 (connected devices)

California 1798.91.04(b)Authentication outside a local area network: unique password or forced new credential

Subject to all the requirements of subdivision (a), a connected device equipped with a means of authentication outside a local area network is deemed to have a reasonable security feature if either (1) the preprogrammed password is unique to each device manufactured, or (2) the device has a security feature that requires the user to generate a new means of authentication before access is granted to the device for the first time. Authentication means a method of verifying the authority of a user, process or device to access resources in an information system. The subdivision does not displace (a): a device that meets (b) must still carry features appropriate to its function and data.

What a notified body or authority asks to see: Inventory of every remotely reachable authentication interface on each device model; Manufacturing and provisioning records showing a distinct preprogrammed password per unit, with how it is generated and printed; Design and test evidence that first access is blocked until the user sets a new credential; Records showing the (a) assessment was still performed for devices relying on this subdivision

Where lists usually fall short: A shared default password across a product line or a password derived from the serial number or MAC address; Forced credential change on the app but not on other remote interfaces such as web, telnet or APIs; Treating (b) as full compliance without the features (a) requires

Source: California Civil Code 1798.91.04 (connected devices)

California 1798.91.04(c)Elective compliance through a NIST conforming labeling scheme

A manufacturer may elect to satisfy subdivision (a) by ensuring the connected device does all of the following: (1) meets or exceeds the baseline product criteria of a NIST conforming labeling scheme; (2) satisfies a conformity assessment as described by that scheme that includes a third-party test, inspection or certification; and (3) bears the binary label the scheme describes. A NIST conforming labeling scheme is one conforming to NIST's Cybersecurity White Paper Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products of 4 February 2022, including revisions and successor publications. Added by AB 2392 (Stats. 2022, Ch. 785), effective 1 January 2023. The FCC's voluntary U.S. Cyber Trust Mark, finalised in January 2025 with accredited-lab testing, is the federal labeling programme a manufacturer would assess against that definition.

What a notified body or authority asks to see: The labeling scheme relied on and the manufacturer's analysis that it conforms to the NIST February 2022 criteria; Evidence the device meets or exceeds the scheme's baseline product criteria; Third-party test, inspection or certification report from the scheme's conformity assessment; The binary label as applied to the device or its packaging, with the authorisation to use it

Where lists usually fall short: Label claimed on a self-declaration with no third-party test, inspection or certification; Label applied to a firmware version or model variant that was never assessed; All three elements not met, so the election fails and (a) applies in full

Source: California Civil Code 1798.91.04 (connected devices)