Key takeaways
- California SB-327 (Civil Code Title 1.81.26, "Security of Connected Devices") was the first US state law requiring a baseline cybersecurity standard for internet-connected consumer products.
- The law defines a connected device broadly: any device or other physical object capable of connecting to the internet, directly or indirectly, and assigned an Internet Protocol address or Bluetooth address.
- Designed to protect the device and any information on it from unauthorized access, destruction, use, modification, or disclosure.
- Where the general standard is open-ended, SB-327 gives one specific, unambiguous requirement.
California SB-327 (Civil Code Title 1.81.26, "Security of Connected Devices") was the first US state law requiring a baseline cybersecurity standard for internet-connected consumer products. It is short — critics at the time called it "a bill of few words" — which makes it easy to summarize but genuinely hard to apply with confidence: the statute sets a general "reasonable security feature" standard plus one concrete, specific password rule, and leaves the rest to interpretation.
Where it came from, and when it applies
Originally drafted as the "Teddy Bear and Toaster Act" and substantially revised before passage, SB-327 was signed by Governor Jerry Brown on 28 September 2018 and took effect 1 January 2020 — the same date as the unrelated but much broader California Consumer Privacy Act (CCPA). The two statutes are separate: SB-327's connected-device security duties exist independently of, and in addition to, any CCPA privacy obligations the same manufacturer might also owe.
What counts as a "connected device"
The law defines a connected device broadly: any device or other physical object capable of connecting to the internet, directly or indirectly, and assigned an Internet Protocol address or Bluetooth address. That sweeps in smartphones, wearables, smart speakers, connected TVs, thermostats and doorbells, and covers consumer, commercial and industrial products alike — it is not limited to home consumer gadgets. The duty falls on manufacturers selling or offering the device for sale in California, regardless of where the manufacturer is headquartered.
The "reasonable security feature" standard
SB-327's central requirement is that a connected device be equipped with security features that are:
Appropriate to the nature and function of the device; Appropriate to the information it may collect, contain, or transmit; and Designed to protect the device and any information on it from unauthorized access, destruction, use, modification, or disclosure
The statute doesn't define a technical checklist for what satisfies this — a deliberate choice that gives flexibility but also leaves real interpretive uncertainty. The California Attorney General's office has pointed manufacturers toward demonstrating reasonableness by aligning with "an authoritative information security standard," citing ISO/IEC 27001 (see our ISO/IEC 27001 ISMS guide) or the CIS Critical Security Controls as examples, rather than treating the general standard as self-defining.
The one concrete rule: unique or first-use passwords
Where the general standard is open-ended, SB-327 gives one specific, unambiguous requirement. For a device that can be authenticated outside a local area network, a security feature is deemed reasonable if either:
- (a) the preprogrammed password is unique to each device manufactured, or
- (b) the device requires the user to generate a new means of authentication before being granted access for the first time.
This is functionally the same baseline later echoed in the UK's PSTI default-password rule and in NIST's IoT device cybersecurity requirements — SB-327 predates both, making it an early mover on a requirement that has since become close to an international norm for consumer connected devices.
Exemptions and enforcement limits
SB-327 includes several carve-outs that narrow its practical reach:
- No liability for third-party software or applications added to the device by someone other than the manufacturer.
- HIPAA-covered entities and devices already subject to federal security requirements or federal agency regulations and guidance are exempted, avoiding duplicate regimes where one already exists.
- Enforcement is exclusive to the California Attorney General and city/county attorneys — there is no private right of action, meaning an individual consumer cannot sue a manufacturer directly for an SB-327 violation, though a violation could still factor into separate CCPA-related litigation exposure where applicable.
As of this guide's research, no publicly reported enforcement action under SB-327 has been identified since it took effect in 2020 — a six-year track record of apparent non-enforcement that commentators (including the EFF's contemporaneous critique) have pointed to as evidence the law functions more as a floor-setting signal than an actively policed regime.
Why the brevity matters for a device maker
Because SB-327 doesn't mandate specific technical controls beyond the password rule — no required encryption, no mandated patching cadence, no vulnerability-disclosure duty — a manufacturer can be technically compliant with the letter of the law while still shipping a device with weak security in every area the statute doesn't name. That gap is exactly why the EFF and other critics called it "weak" at passage: it was the first state law of its kind, but intentionally narrow. For a manufacturer building an actual security program, SB-327's password rule is a floor, not a target — compare against the fuller baselines in ETSI EN 303 645 or NIST's IoT device cybersecurity requirements for what a more complete consumer IoT security program covers beyond passwords alone.
A workable starting point
Treat the password rule as a hard floor, not a complete programEvery device with authentication reachable outside a LAN needs either a per-unit unique default password or a forced first-use credential change — this is the one part of SB-327 with no ambiguity. Document your reasonable-security rationale against a named standardSince the general standard isn't self-defining, being able to point to ISO/IEC 27001 or CIS Controls alignment gives you a concrete answer if a customer, retailer or regulator asks what "reasonable" means for your product. Don't assume SB-327 compliance covers other marketsThe UK's PSTI, the EU's upcoming CRA requirements and NIST's IoT baseline all go further than SB-327's password-only floor — treat it as the minimum US state-law layer, not a substitute for those. Keep the HIPAA and federal-regulation exemptions in mind when scoping,but don't rely on them unless your device is clearly within a covered category — the carve-outs are narrow, not a general compliance alternative.
SoftWSP's device and firmware security assessments can document the password-handling and update evidence that SB-327's reasonable-security standard, and the fuller baselines beyond it, both expect: see Device & Firmware Security.
This guide summarizes California's SB-327 statutory text and independent secondary legal analysis current as of this guide's last-updated date. This is general information, not legal advice — confirm current statutory text and any enforcement developments directly before relying on it for a compliance decision.
Sources
- California Legislative Information: SB-327 Information Privacy: Connected Devices, full chaptered bill text (Chapter 886, Statutes of 2018)
- Kelley Drye: California Passes Bill Requiring Reasonable Security Features for Connected Devices
- King & Spalding (khlaw.com): California Enacts First IoT Cybersecurity Law
- EFF: California Passes Weak, Ineffective IoT Security Law (critique of SB-327's scope and limits)
- National Law Review: California's IoT Devices' Security Law — what manufacturers need to know
Frequently asked questions
What is California SB-327, and when did it take effect?
SB-327 (Information Privacy: Connected Devices), originally nicknamed the 'Teddy Bear and Toaster Act' during drafting, was signed into law by Governor Jerry Brown on 28 September 2018 and took effect 1 January 2020 — the same day as the California Consumer Privacy Act (CCPA), though SB-327 is a separate and much narrower statute. It added Title 1.81.26 to the California Civil Code and was the first US state law to set minimum cybersecurity requirements for internet-connected consumer products.
What counts as a 'connected device' under the law, and who must comply?
A connected device is any device or physical object capable of connecting to the internet, directly or indirectly, and assigned an Internet Protocol address or Bluetooth address — covering smartphones, wearables, smart speakers, connected TVs, thermostats and doorbells, among others, including consumer, commercial and industrial products. The duty falls on manufacturers of connected devices sold or offered for sale in California, regardless of where the manufacturer itself is based, as long as the device reaches California consumers.
What does the 'reasonable security feature' requirement actually mean?
The law requires a connected device to have security features appropriate to the device's nature and function, appropriate to the information it may collect, contain or transmit, and designed to protect the device and any information on it from unauthorized access, destruction, use, modification or disclosure. The statute itself doesn't define a technical checklist; the California Attorney General's office has pointed to alignment with 'an authoritative information security standard,' such as ISO/IEC 27001 or the CIS Critical Security Controls, as one way to demonstrate reasonableness.
What is the specific password rule, and what are the law's main exemptions and enforcement limits?
For a device that can be authenticated outside a local area network, a security feature is deemed reasonable if either the preprogrammed password is unique to each individual device manufactured, or the device requires a user to generate a new means of authentication before first-time access is granted — this is the law's one concrete, unambiguous technical requirement. SB-327 exempts manufacturers from liability for third-party software or applications added to the device, and carves out entities already covered by HIPAA or by security requirements under federal law or federal agency regulations. Enforcement is reserved exclusively to the California Attorney General and city/county attorneys; there is no private right of action, and no publicly reported enforcement action has been identified as of this guide's research.
In this cluster
