CA SB 327

No changes recorded yet — we are watching, and nothing has been published.

1. 2023-01-01 AB 2392 amendments (NIST conforming labelling scheme option) take effect
2. 2022-09-29 AB 2392 approved by the Governor (Stats. 2022, ch. 785)
3. 2020-01-01 Connected device security requirements become operative
4. 2018-09-28 SB 327 and AB 1906 approved by the Governor

1. 2023-01-01
   Civil Code 1798.91.04–1798.91.06, as amended by AB 2392 (2022) AmendmentCurrent text

   AB 2392 (Stats. 2022, ch. 785) let manufacturers meet the security duty through a NIST conforming IoT labelling scheme and repealed the duplicate Title 1.81.26 added by SB 327. source

   More

   • The text in force is the one added by AB 1906 (Stats. 2018, ch. 860) and amended by AB 2392; the identical copy added by SB 327 (Stats. 2018, ch. 886) was repealed.
   • The labelling route requires meeting the baseline criteria of a NIST conforming scheme, a conformity assessment that includes a third-party test, inspection or certification, and bearing the scheme's binary label.
2. 2018-09-28
   SB 327 and AB 1906 (2018) Major version

   Two identical bills, SB 327 (Stats. 2018, ch. 886) and AB 1906 (ch. 860), signed on 28 September 2018, each conditional on the other, required reasonable security features on connected devices from 1 January 2020. source

Manufacturers of internet-connected devices sold in California, with carve-outs for devices under federal security requirements and for HIPAA- and CMIA-regulated activity.

Manufacturer

The person who manufactures, or contracts with another person to manufacture on its behalf, connected devices sold or offered for sale in California; a contract only to purchase, or to purchase and brand, a device does not count. source

Connected device

Any device or other physical object that can connect to the internet, directly or indirectly, and is assigned an IP address or Bluetooth address. source

Excluded

Devices whose functionality is subject to federal security requirements, and activity regulated by HIPAA or California's Confidentiality of Medical Information Act. source

Not covered

No duty for unaffiliated third-party software a user adds, for app stores to review compliance, or to stop users having full control of their device. source

The manufacturer builds in reasonable security features; a unique password per device or a forced credential change counts, and a NIST conforming label is an alternative route.

Security feature

Reasonable security features appropriate to the device's nature and function and to the information it handles, designed to protect it from unauthorized access, destruction, use, modification or disclosure. source

Passwords

A device with authentication outside a local area network is deemed compliant if its preprogrammed password is unique to each device, or if the user must generate a new means of authentication before first access. source

Labelling option

Alternatively, the device meets the baseline criteria of a NIST conforming labelling scheme, passes its conformity assessment including a third-party test, inspection or certification, and bears its binary label. source

Only public prosecutors can enforce it; the title creates no private right of action.

Enforcers

The Attorney General, a city attorney, a county counsel or a district attorney has exclusive authority to enforce the title. source

Private suits

The title shall not be construed to provide a basis for a private right of action. source

Other law

Its duties are cumulative with duties under other law and do not relieve anyone of them. source

1. Law text Civil Code 1798.91.04 – Security features of connected devices
2. Law text Civil Code 1798.91.05 – Definitions
3. Law text Civil Code 1798.91.06 – Scope, exclusions and enforcement
4. Law text SB 327 (2018), chaptered text
5. Law text AB 1906 (2018), chaptered text

1. CRA

   The EU Cyber Resilience Act sets cybersecurity requirements and CE conformity assessment for products with digital elements; California's law sets a general security-feature duty for connected devices sold in the state.

2. Australian Smart Devices Rules

   Australia's smart-device rules set a national security standard for consumer-grade connectable products under the Cyber Security Act 2024; California's law applies to connected devices sold in that state.

3. CA SB 1386

   California's breach notification law governs what happens after personal data is breached; the connected-device law governs security features built into devices.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to CA SB 327 (RSS)