Enacts the "connected consumer product end of life disclosure act", relating to requiring manufacturers of connected consumer products to disclose for how long they will provide technical support, security updates, or bug fixes for the software, hardware, or firmware necessary for the product to securely function.
STATE OF NEW YORK
________________________________________________________________________
10132--B
Cal. No. 280
IN ASSEMBLY
February 3, 2026
___________
Introduced by M. of A. OTIS, SIMON -- read once and referred to the
Committee on Science and Technology -- reported and referred to the
Committee on Codes -- committee discharged, bill amended, ordered
reprinted as amended and recommitted to said committee -- reported
from committee, advanced to a third reading, amended and ordered
reprinted, retaining its place on the order of third reading
AN ACT to amend the general business law, in relation to enacting the
"connected consumer product end of life disclosure act"
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Short title. This act shall be known and may be cited as
2 the "connected consumer product end of life disclosure act".
3 § 2. The general business law is amended by adding a new section 399-
4 mm to read as follows:
5 § 399-mm. Connected consumer product end of life disclosure. 1. Defi-
6 nitions. As used in this section, the following terms shall have the
7 following meanings:
8 (a) "Connected consumer product" means any physical product, including
9 any mobile application or cloud infrastructure related to the function-
10 ing of such product, that is intended for consumer use and depends for
11 its functioning, in whole or in part, on connection to the internet.
12 (b) "End of life" means the point at which the manufacturer ceases
13 providing a necessary update or support for a connected consumer prod-
14 uct, even if such product is still in use.
15 (c) "Firmware" means low-level software that is embedded into hardware
16 devices, where such software provides the essential instructions needed
17 for hardware to operate properly, acting as a middle layer between the
18 hardware and higher-level software such as device operating systems or
19 applications.
20 (d) "Minimum guaranteed support time frame" means the minimum amount
21 of time for which a company has publicly committed to providing all
22 necessary updates and support for a connected consumer product,
23 expressed as a specific date for the end of the time frame.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD13518-08-6
A. 10132--B 2
1 (e) "Product update" means an update, other than a security update,
2 released for a connected consumer product to address effectively a flaw
3 in the software, hardware, or firmware running on such product that
4 interferes with the full functioning of such product.
5 (f) "Product web page" means a web page specific to the particular
6 connected consumer product that contains information about such product
7 and its features.
8 (g) "Security update" means an update released for a connected consum-
9 er product to address effectively a vulnerability in the software, hard-
10 ware, or firmware running on such product.
11 (h) "Support" means service to ensure that a connected consumer prod-
12 uct continues to fully function and to provide information and guidance
13 to consumers regarding proper use of such product.
14 (i) "Update" means a product update or a security update.
15 (j) "Vulnerability" means a flaw in the software, hardware, or firm-
16 ware running on a connected consumer product that lessens the security
17 or integrity of such product.
18 2. Requirements. The following requirements shall apply to any
19 connected consumer product manufactured or sold after January first, two
20 thousand twenty-seven:
21 (a) The manufacturer shall clearly and prominently disclose a minimum
22 guaranteed support time frame to prospective buyers, in all of the
23 following ways:
24 (i) disclosing on the product web page;
25 (ii) disclosing at the point of sale, in a manner reasonably designed
26 to reach the attention of the prospective buyer, if the manufacturer has
27 the ability to make the disclosure directly to prospective buyers at the
28 point of sale; and
29 (iii) if the manufacturer does not have the ability to make the
30 disclosure directly to prospective buyers at the point of sale, disclos-
31 ing to the retailer with instructions to disclose to prospective buyers
32 at the point of sale.
33 (b) The minimum guaranteed support time frame shall not be inconsist-
34 ent with reasonable consumer expectations about how long a connected
35 consumer product's features that depend upon internet connectivity will
36 continue to function safely and effectively.
37 (c) The minimum guaranteed support time frame for a connected consumer
38 product shall not be reduced after it is first disclosed pursuant to
39 paragraph (a) of this subdivision. A manufacturer may extend the minimum
40 guaranteed support time frame at any time in the manner described under
41 paragraph (a) of this subdivision.
42 (d) The disclosures described in paragraph (a) of this subdivision
43 shall also include a detailed account of the features and functionality
44 that will be lost or compromised when the connected consumer product
45 reaches its end of life.
46 (e) The manufacturer shall provide advance notification of the
47 connected consumer product's end of life, as described in paragraph (f)
48 of this subdivision, to the public and owners of such product:
49 (i) six months before such product reaches end of life; and
50 (ii) on the date on which such product reaches end of life.
51 (f) A manufacturer shall provide the notification described in para-
52 graph (e) of this subdivision in each of the following ways:
53 (i) through an interface on the connected consumer product or an asso-
54 ciated application, if practicable;
55 (ii) through email to owners of the connected consumer product for
56 whom the manufacturer possesses an email address; and
A. 10132--B 3
1 (iii) on the connected consumer product's web page.
2 (g) Notification about the connected consumer product's end of life
3 shall include clear information about actions consumers can take if they
4 want to continue using the connected consumer product in a secure and
5 effective manner, disconnecting such product from the internet and shall
6 provide a list of features lost in, and vulnerabilities and security
7 risks that are likely to result from such product's end of life.
8 (h) The manufacturer shall not sell, lease, or otherwise distribute
9 the connected consumer product after the date that is one year before
10 the minimum guaranteed support time frame end date for such product.
11 (i) A business that owns or controls a connected consumer product that
12 it leases or otherwise provides to its customers as part of a service
13 shall:
14 (i) ensure that updates provided by the manufacturer for such product
15 are promptly received and applied; and
16 (ii) when the product has reached end of life:
17 (A) promptly so notify customers; and
18 (B) replace such product, at no additional cost to customers, with a
19 comparable product capable of receiving necessary updates and support,
20 when such comparable product is reasonably available to the business,
21 and so notify customers.
22 3. Exemption. Nothing in this section shall apply to a medical device,
23 as defined by paragraph (g) of subdivision one of section three hundred
24 ninety-nine-nn of this article.
25 4. Enforcement. Any violation of the provisions of this section shall
26 constitute an unlawful practice under section three hundred forty-nine
27 of this chapter. All remedies, penalties, and authority granted to the
28 attorney general therein shall be available for the enforcement of this
29 section.
30 § 3. This act shall take effect immediately.
