Privacy & Information Security Law Blog

On September 6, 2022, the California legislature presented Assembly Bill 2392 to Governor Gavin Newsom. AB-2392, which has not yet been signed by Governor Newsom, would allow Internet-connected device manufacturers to satisfy existing device labeling requirements by complying with National Institute of Standards and Technology (“NIST”) standards for consumer Internet of Things (“IoT”) products.

Current California law requires manufacturers of Internet-connected devices to equip such devices with security features that are reasonable and appropriate to “the nature and function of the device” and to “the information [the device] may collect, contain, or transmit.” Existing law also requires that devices are “designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure.”

AB-2392 would allow device manufacturers to satisfy the above-described requirements by meeting or exceeding NIST standards for consumer IoT products, which would include satisfying a conformity assessment and displaying the binary label, as required by the NIST conforming labeling scheme.

Update: California Governor Gavin Newsom signed this bill into law on September 29, 2022.