Unlock unlimited alerts, exports & API access — RuleWatch Pro at $29/mo
Regulation dossier
A focused view of the rule, its enforcement posture, and the timeline teams should keep in their operating plan.
Plain-English summary
California requires manufacturers of connected devices sold in the state to equip those devices with reasonable security features suited to the device and the data it handles. It affects IoT manufacturers and is aimed at reducing unauthorized access to devices and the information they collect, transmit, or store.
Reading guide
Use the timeline below to see how the rule progressed from enactment to current obligations.
Related regulations surface adjacent requirements in the same jurisdiction or policy lane.
Timeline
Feb 13, 2017
California SB 327 was introduced to require reasonable security features for connected devices.
Sep 28, 2018
The governor signed California's connected-device security law.
Jan 1, 2020
Manufacturers selling connected devices in California became subject to the reasonable-security requirement.
Get email alerts when this regulation changes and export records to CSV for your compliance workflow — available with RuleWatch Pro.
Subscribe for regulation alerts
Free weekly digest for compliance professionals following material legal changes.
Related regulations
Pulled from the same jurisdiction or category so teams can compare adjacent obligations quickly.
California, United States
California requires covered generative AI providers to give users clear provenance disclosures when AI-generated or AI-altered content is created or presented. It affects providers and some licensees of large generative AI systems and gives the Attorney General and local public lawyers a civil-enforcement path.
California, United States
California requires developers of generative AI systems made available to Californians to publish documentation about the data used to train those systems. It affects developers releasing public-facing generative AI systems or major modifications and is meant to improve transparency around dataset sources and composition.
California, United States
California created child-focused design and privacy duties for online services likely to be accessed by minors, including high-privacy defaults, data protection impact assessments, and limits on harmful profiling or nudging. It affects businesses offering online products, services, or features to children in California, even though enforcement has been tied up in litigation.