This California law requires manufacturers of connected devices, like smart gadgets, to build in reasonable security features. These features must fit the device's use and the kinds of data it handles, keeping information safe from unauthorized access or changes. If a device can be accessed outside a local network, it must either have a unique password per unit or require users to choose a new password upon first use. In turn, manufacturers can meet these rules by aligning with standards from the National Institute of Standards and Technology (NIST), including third-party testing and labeling requirements.

This section defines key terms for a California law about internet-connected devices. 'Authentication' is about confirming who's allowed to use a system. A 'connected device' is any object that can go online, even if indirectly, like a smart fridge. 'Manufacturer' refers to those who make these devices for sale in the state. A 'NIST conforming labeling scheme' involves special labels for IoT products that meet certain cybersecurity standards. 'Security feature' means anything on a device meant to keep it secure. Lastly, 'unauthorized access' covers any use of a device that wasn't given the green light by the user.

This law explains that manufacturers of connected devices and providers of apps can't be held responsible for third-party software users install on these devices. It also confirms that device users have the right to fully control and modify their devices. Security obligations under federal law take precedence, and private lawsuits aren't allowed under this statute — only certain government attorneys can enforce it. Furthermore, the law clarifies that these rules don't override existing legal duties and allow law enforcement access to device information as needed. Entities covered by specific health privacy laws like HIPAA aren't affected. This statute became effective on January 1, 2020.