New York S 7269: Relates to the security of connected devices

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
S07269 Summary:

BILL NOS07269 

&nbsp

SAME ASNo Same As

&nbsp

SPONSORGRIFFO

&nbsp

COSPNSR

&nbsp

MLTSPNSR

&nbsp

Add §390-f, Gen Bus L

&nbsp

Requires manufacturers of connected devices to equip such devices with reasonable security features.

Go to top S07269 Actions:

BILL NOS07269 

&nbsp

04/07/2025REFERRED TO INTERNET AND TECHNOLOGY

01/07/2026REFERRED TO INTERNET AND TECHNOLOGY

Go to topS07269 Committee&nbspVotes:

Go to topS07269 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topS07269 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 7269

 2025-2026 Regular Sessions

 IN SENATE

 April 7, 2025
 ___________

 Introduced by Sen. GRIFFO -- read twice and ordered printed, and when
 printed to be committed to the Committee on Internet and Technology

 AN ACT to amend the general business law, in relation to the security of
 connected devices

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. The general business law is amended by adding a new section
 2 390-f to read as follows:
 3 § 390-f. Security of connected devices. 1. For the purposes of this
 4 section, the following terms have the following meanings:
 5 (a) "Authentication" means a method of verifying the authority of a
 6 user, process, or device to access resources in an information system.
 7 (b) "Connected device" means any device, or other physical object that
 8 is capable of connecting to the internet, directly or indirectly, and
 9 that is assigned an internet protocol address or bluetooth address.
 10 (c) "Manufacturer" means the person who manufactures, or contracts
 11 with another person to manufacture on the person's behalf, connected
 12 devices that are sold or offered for sale in the state. For the purposes
 13 of this section, a contract with another person to manufacture on the
 14 person's behalf does not include a contract only to purchase a connected
 15 device, or only to purchase and brand a connected device.
 16 (d) "Security feature" means a feature of a device designed to provide
 17 security for that device.
 18 (e) "Unauthorized access, destruction, use, modification, or disclo-
 19 sure" means access, destruction, use, modification, or disclosure that
 20 is not authorized by the consumer.
 21 2. (a) A manufacturer of a connected device shall equip such device
 22 with a reasonable security feature or features that are all of the
 23 following:
 24 (1) Appropriate to the nature and function of the device.

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD11568-01-5

 S. 7269 2

 1 (2) Appropriate to the information it may collect, contain, or trans-
 2 mit; and
 3 (3) Designed to protect the device and any information contained ther-
 4 ein from unauthorized access, destruction, use, modification, or disclo-
 5 sure.
 6 (b) Subject to all of the requirements of paragraph (a) of this subdi-
 7 vision, if a connected device is equipped with a means for authentica-
 8 tion outside a local area network, it shall be deemed a reasonable secu-
 9 rity feature under such paragraph if either of the following
 10 requirements are met:
 11 (1) The preprogrammed password is unique to each device manufactured;
 12 or
 13 (2) The device contains a security feature that requires a user to
 14 generate a new means of authentication before access is granted to the
 15 device for the first time.
 16 3. (a) This section shall not be construed to impose any duty upon the
 17 manufacturer of a connected device related to unaffiliated third-party
 18 software or applications that a user chooses to add to a connected
 19 device.
 20 (b) This section shall not be construed to impose any duty upon a
 21 provider of an electronic store, gateway, marketplace, or other means of
 22 purchasing or downloading software or applications, to review or enforce
 23 compliance with this section.
 24 (c) This section shall not be construed to impose any duty upon the
 25 manufacturer of a connected device to prevent a user from having full
 26 control over a connected device, including the ability to modify the
 27 software or firmware running on the device at the user's discretion.