[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Understanding the California IoT Security Law (SB-327)](/blog/california-iot-security-law) Publish date January 8, 2025 {x} minute read # Understanding the California IoT Security Law (SB-327) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Leah Sadoian](/team/leah-sadoian) Content Writer Leah is an experienced cybersecurity writer. Her work is read by leaders in security, tech, education, healthcare, and government. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) In September 2019,[ California signed Senate Bill 327,](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB327) also known as the California Internet of Things (IoT) Security Law. While not an extensively written piece of legislation like the[ California Consumer Privacy Act (CCPA),](https://www.upguard.com/blog/what-is-the-ccpa) SB-327 took effect on January 1, 2020, and focuses on manufacturers of connected devices—requiring updated security standards that protect both devices and end-users. [Learn how UpGuard can help your organization update security standards and monitor risk >](https://www.upguard.com/product/breachsight) ## The California IoT Security Law, Explained California has been at the forefront of developing standards around [IoT devices](https://www.upguard.com/blog/internet-of-things-iot), starting with the 2017 Internet of Things Cybersecurity Improvement Act. This marked the first state in the U.S. to adopt an IoT-specific [cybersecurity](https://www.upguard.com/blog/cyber-security) law. SB-327 builds upon that foundation, with detailed provisions meant to enhance device security in any product that connects to the internet. ### Key Provisions The two main provisions of SB-327 explain that manufacturers must equip devices with reasonable security features and unique passwords or security measures. 1. **Reasonable Security Features:** These requirements protect the device and prevent unauthorized access to information it collects, stores, or transmits. Some reasonable security features include[ data encryption,](https://www.upguard.com/blog/encryption) secure APIs, and regular software updates or patches. They are unique to the use case or function of the device. Most medical device providers already utilize these security requirements to prioritize [data privacy in healthcare](https://www.upguard.com/blog/hipaa-privacy-rule).**‍** 2. **Unique Passwords and Security Measures**: Connected devices outside local area networks must be assigned a unique preprogrammed password or require new users to[ create a new password](https://www.upguard.com/blog/the-password-security-checklist) before first-time access to an IoT device. ### Rationale There are a variety of reasons why California adopted SB-237. One of the major ones is the rapid increase in IoT devices over the last decade. These devices constantly collect, use, and store data at home, work, or in public spaces. This creates an increased risk for potential misuse or authorized data access. Many IoT devices manufactured in the last decade lack strong security measures. Devices have been shipped with default passwords, creating security issues and [vulnerabilities](https://www.upguard.com/blog/vulnerability), making them an easy target for hackers. The number of high-profile security breaches involving IoT devices showcases how easy it is to access protected data—posing a risk to personal privacy and potential financial damage. One example is the devastating [Mirai botnet in 2016,](https://www.cisecurity.org/insights/blog/the-mirai-botnet-threats-and-mitigations) which compromised over 100,000 devices that used a default username and password. Finally, SB-327 encourages manufacturers of IoT devices to[ prioritize cybersecurity](https://www.upguard.com/blog/cybersecurity-important) when designing and producing their devices. This type of responsible manufacturing provides additional security for end-users, protecting data and preventing [breaches](https://www.upguard.com/blog/data-breach). ### IoT Devices Defined An[ IoT device](https://www.upguard.com/blog/internet-of-things-iot), or “connected device,” is defined by this law as any device, sensor, or other object capable of connecting to the internet. This includes direct or indirect internet connections with an I.P. address or Bluetooth address. Examples of IoT devices include innovative home accessories like smart thermostats or intelligent home security systems. Because these devices connect via wifi to the Internet and sync data to the cloud, they fall under the umbrella of “Internet of Things” devices. Another example is wearable health devices, like Fitbit wristbands or Apple watches, that monitor and sync your health data to the cloud. ### Who Must Comply with SB-327? The main parties required to comply with SB-327 are IoT device manufacturers that sell in California. This includes the device manufacturer and other contracted businesses or individuals. Companies that design and produce devices and brands that sell white-label IoT devices are also required to comply with SB-327. SB-327 does not apply to any third party that connects to or offers services that use IoT devices since they are not manufacturers. Additionally, suppose a party only provides a platform for selling IoT devices, like electronic stores or online marketplaces, and has no control over the connected devices. In that case, this law does not apply to them. ### Penalties for Non-Compliance SB-327 does not[ ](https://www.upguard.com/blog/internet-of-things-iot)list specific penalties for non-compliance in the bill’s text. Instead, the law empowers attorneys, ranging from California’s Attorney General to local district attorneys, to enforce the provisions of SB-237. This can lead to penalties, although those penalties will depend on the specific nature of the case, the violation, and whether the violation caused any harm. Additionally, the law does not provide a private right of action for end-users. This means that an individual consumer or a business cannot sue an IoT manufacturer directly for not complying with SB-327. ## Impact of SB-327 Since taking effect in January 2020, SB-327 has had a widespread impact across manufacturers and end-users. ### IoT Manufacturers To remain compliant with SB-327, IoT device manufacturers must equip their devices with reasonable security features. While this requirement enhances each device's cybersecurity, it also increases costs and production times for manufacturers. Companies must invest more time and resources to design, implement, and test new security features. While these secondary effects might seem negative,[ manufacturers](https://www.upguard.com/blog/cybersecurity-in-the-manufacturing-industry) who go above and beyond the minimum requirements set themselves apart from the competition. As the public grows increasingly aware of the increased threat of [malware](https://www.upguard.com/blog/malware) and the need for solid cybersecurity, it becomes a priority when customers choose a product to purchase. A business that values security becomes a better option than one that does the bare minimum. ### End-Users Users of IoT devices also benefit from SB-237. The biggest gain is that their devices are now more secure than ever. Because the law mandates that IoT devices come with reasonable security features, like unique authentication, users can be confident that their devices have measures to prioritize information privacy. These improved security features mean better protection of end-users’ data. Because IoT devices often collect, store, and share [sensitive information](https://www.upguard.com/blog/sensitive-data), users want to secure their [data](https://www.upguard.com/blog/personally-identifiable-information-pii). SB-237’s IoT cybersecurity features help provide peace of mind that a user’s data is protected from cyberattacks. With the passing of SB-237 and other recent cybersecurity laws, consumers are increasingly aware of the cybersecurity landscape. This awareness helps users take steps to protect their own data and online presence, both with IoT devices and beyond. ## Comparing SB-327 to Existing IoT Security Frameworks California is the first state in the U.S. to enact a law around IoT devices, but Oregon and the federal government closely followed it with their legislation. Oregon’s IoT Law, House Bill 2395, was passed in 2019 and requires manufacturers to equip IoT devices with reasonable security standards and authentication requirements for first-time users. The IoT Cyber Security Improvement Act, passed in December 2020, is a federal law that sets minimum security standards for any IoT device purchased by the federal government. Other states often adopt the [NIST Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework), written by the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) in 2014. The NIST Cybersecurity Framework is not specifically about IoT device protection, but the general cybersecurity principles it suggests can be applied to IoT devices. For example, strong authentication for IoT devices is an access control tool that falls under the Protect function of the framework. [Learn more about NIST >](https://www.upguard.com/resources/nist-compliance-guide) There has also been an increase in these types of legislation in other countries worldwide. In the European Union,[ The General Data Protection Regulation (GDPR)](https://www.upguard.com/glossary/gdpr) indirectly affects IoT devices by mandating regulations for protecting the personal data of its citizens. Similarly, the E.U. Agency for Cybersecurity (ENISA) has proposed detailed privacy and security standards for IoT devices. The U.K. government’s “Secure by Design” code of practice for IoT devices ensures that devices are made with suitable security guidelines starting with their design stage. In 2020, a law was proposed to raise the security standards of consumer smart devices according to this code of practice. ## The Future of IoT Security and SB-327 The adoption of SB-237 in California showcases how both state and federal governments are starting to notice the need for increased cybersecurity risk management, especially across personal devices. As we look to the future of IoT security, we expect increased regulation, standardization, and updated privacy laws to address the growing ecosystem of IoT devices and manufacturers. With this increase in devices, we can also predict a greater threat landscape as cybercriminals evolve and identify potential entry points to target protected data. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)