Enacts the "connected consumer product end of life disclosure act", relating to requiring manufacturers of connected consumer products to disclose for how long they will provide technical support, security updates, or bug fixes for the software, hardware, or firmware necessary for the product to securely function.
STATE OF NEW YORK
________________________________________________________________________
10132
IN ASSEMBLY
February 3, 2026
___________
Introduced by M. of A. OTIS -- read once and referred to the Committee
on Science and Technology
AN ACT to amend the general business law, in relation to enacting the
"connected consumer product end of life disclosure act"
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Short title. This act shall be known and may be cited as
2 the "connected consumer product end of life disclosure act".
3 § 2. The general business law is amended by adding a new section 399-
4 mm to read as follows:
5 § 399-mm. Connected consumer product end of life disclosure. 1. Defi-
6 nitions. As used in this section, the following terms shall have the
7 following meanings:
8 (a) "Connected consumer product" means any product that is intended
9 for consumer use and depends for its functioning, in whole or in part,
10 on connection to the internet. The term includes the product, the mobile
11 application, and necessary cloud infrastructure.
12 (b) "End of life" means the point at which the manufacturer ceases
13 providing technical support, security updates, or bug fixes for the
14 software, hardware, or firmware necessary for the connected consumer
15 product to securely function, even if the product is still in use.
16 (c) "Firmware" means low-level software that is embedded into hardware
17 devices, where such software provides the essential instructions needed
18 for hardware to operate properly, acting as a middle layer between the
19 hardware and higher-level software such as device operating systems or
20 applications.
21 (d) "Minimum guaranteed support time frame" means the minimum amount
22 of time for which a company has publicly committed to providing techni-
23 cal support, security updates, or bug fixes for the software, hardware,
24 or firmware, expressed as continuing until a specific date.
25 (e) "Product web page" means a web page specific to the particular
26 connected consumer product that contains information about such product
27 and its features.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD13518-03-6
A. 10132 2
1 (f) "Security updates" means updates released to address vulnerabili-
2 ties in the software, hardware, or firmware used by a connected consumer
3 product.
4 (g) "Support" means service to ensure that a connected consumer prod-
5 uct continues to fully function and to provide information and guidance
6 to consumers regarding proper use of the product.
7 (h) "Update" means a security update, or an update released for a
8 connected consumer product to address effectively a flaw in the soft-
9 ware, hardware, or firmware running on the product that interferes with
10 the full functioning of the product.
11 (i) "Vulnerability" means a flaw in the software, hardware, or firm-
12 ware running on a connected consumer product that lessens the security
13 and integrity of the software, hardware, or firmware needed to operate
14 such product.
15 2. Requirements. The following requirements shall apply to any
16 connected consumer product manufactured or sold after January first, two
17 thousand twenty-seven:
18 (a) The manufacturer shall clearly and conspicuously disclose a mini-
19 mum guaranteed support time frame on the product webpage.
20 (b) The seller shall clearly and conspicuously disclose at the point
21 of sale instructions on how to find the information outlined in para-
22 graph (a) of this subdivision.
23 (c) The minimum guaranteed support time frame shall not be inconsist-
24 ent with reasonable consumer expectations about how long a connected
25 consumer product's features that depend upon internet connectivity will
26 continue to function safely and effectively.
27 (d) The minimum guaranteed support time frame for a connected consumer
28 product shall not be reduced after it is disclosed pursuant to this
29 subdivision. A manufacturer may extend the minimum guaranteed support
30 time frame at any time by making a new disclosure pursuant to this
31 subdivision.
32 (e) The disclosures described in paragraph (a) of this subdivision
33 shall also include a detailed account of the features and functionality
34 that will be lost when the connected consumer product reaches its end of
35 life.
36 (f) The manufacturer shall provide advance notice of the decision to
37 cease providing technical support, security updates, or bug fixes for
38 the software, hardware, or firmware on the product webpage. Such notice
39 shall:
40 (i) be posted six months before the product reaches end of life; and
41 (ii) disclose the date on which the product reaches end of life.
42 (g) The disclosure outlined in paragraph (a) of this subdivision and
43 the notification outlined in paragraph (f) of this subdivision shall
44 include clear information about actions the user can take if they want
45 to continue using the connected consumer product in a secure and effec-
46 tive manner, disconnecting such product from the internet and shall
47 provide a list of features lost, and vulnerabilities and security risks
48 that are likely to result from the end of life.
49 (h) A business that owns or controls a connected consumer product and
50 leases or otherwise provides such connected consumer product to their
51 customers shall:
52 (i) ensure that updates associated with the minimum guaranteed support
53 time frame associated with such connected consumer product are promptly
54 received by the customer; and
55 (ii) when the product has reached end of life:
56 (A) promptly notify customers; and
A. 10132 3
1 (B) replace the product, at no additional cost to customers, with a
2 comparable product capable of receiving necessary updates and support,
3 when such comparable product is reasonably available to the business,
4 and notify customers of such replacement product.
5 3. Enforcement. Any retailer that violates this section shall be
6 subject to a civil penalty of not more than one hundred dollars for the
7 first violation, not more than two hundred fifty dollars for the
8 second violation, and not more than five hundred dollars for each
9 violation thereafter. The provisions of subdivision one of this
10 section may be enforced concurrently by the director of a municipal
11 consumer affairs office, or by the town attorney, city corporation coun-
12 sel, or other lawful designee of a municipality or local govern-
13 ment, and all moneys collected thereunder shall be retained by such
14 municipality or local government.
15 § 3. This act shall take effect immediately.
