22928.10.
As used in this chapter:
(a) “Connected consumer product” means a physical product, including a mobile application or cloud infrastructure related to the functioning of the physical product, that is intended for consumer use and depends for its functioning, in whole or in part, on a connection to the internet. internet for a consumer to make ordinary use of the product.
(b) “End of life” means the point after date on which the a manufacturer no longer provides necessary support or security patches for support, security patches, or updates that are necessary for a consumer to make ordinary use of a connected consumer product.
(c) “Manufacturer” means the manufacturer of a connected consumer product sold at retail in the state.
(d) “Minimum guaranteed support timeframe” means the minimum amount period of time for time, beginning when a manufacturer first makes a connected consumer product available for purchase in this state and ending on a specific date, during which a company manufacturer commits to providing all necessary support, security patches, or updates to a connected consumer product that includes a specific date at the end of the timeframe. that are necessary for a consumer to make ordinary use of a connected consumer product.
(e)“Necessary support” means all necessary support to enable product functionality.
(e) “Ordinary use” means use of a connected consumer product that is consistent with a consumer’s reasonable expectations based on how the connected consumer product was advertised, marketed, or otherwise described by the manufacturer at the time of purchase.
22928.11.
(a) A manufacturer shall clearly and
prominently establish and conspicuously disclose
a connected consumer product’s minimum guaranteed support timeframe to any prospective buyer of
a the connected consumer product
a minimum guaranteed support timeframe in
both all of the following
ways: ways to the extent each is technically feasible:(1) At the point of internet sale, if practicable. sale.
(2) In a clear and conspicuous manner on On the product packaging and on the manufacturer’s internet website or product-specific webpage. connected consumer product packaging.
(3) On the manufacturer’s internet website or product-specific webpage.
(b) A (1) Except as provided in paragraph (2), a manufacturer shall not reduce a minimum guaranteed support timeframe disclosed under this section.
(2) (A) A manufacturer may reduce a minimum guaranteed support timeframe disclosed under this section if the manufacturer demonstrates that providing support for the connected consumer product is not feasible due to unforeseeable circumstances beyond the manufacturer’s reasonable control, including any of the following:
(i) The manufacturer is subject to bankruptcy or another insolvency proceeding that materially impairs the manufacturer’s ability to provide support.
(ii) A third-party dependency, including, but not limited to, a service, platform, software or hardware component, security certificate, application programming interface, network, or other technology operated or controlled by an unaffiliated third party that is necessary to provide support, is discontinued, materially altered, or no longer made available to the manufacturer on commercially reasonable terms and cannot reasonably be replaced by the manufacturer.
(iii) Providing support is unlawful.
(iv) A vulnerability, defect, or other safety or security condition makes providing support materially likely to compromise the security, privacy, or safety of users or the public, and the issue cannot reasonably be remedied by the manufacturer.
(B) A manufacturer that reduces a minimum guaranteed support timeframe pursuant to this paragraph shall, as soon as is practicable, provide clear and conspicuous notice to any affected consumer pursuant to subdivision (d).
(c) (1)A manufacturer shall provide a ensure that the minimum guaranteed support timeframe of no less than five years. of a connected consumer product that it manufactured is consistent with the reasonable expectations of a consumer based on all of the following:
(2)The starting point for the minimum guaranteed support timeframe shall be calculated from the first month in which the manufacturer offers the product for sale to consumers.
(1) The nature of the connected consumer product, including the connected consumer product’s expected use, durability, and reliance on remote services.
(2) The price paid for the connected consumer product by consumers.
(3) How the connected consumer product is advertised, marketed, or otherwise described by the manufacturer at the time of purchase.
(4) The minimum guaranteed support timeframe of comparable connected consumer products.
(d) (1) A manufacturer shall provide a clear and conspicuous notice of a connected consumer product’s product reaching its end of life to the public and to any owner of the connected consumer product on both of the following dates:
(A) Six months before the connected consumer product reaches its end of life.
(B) The date on which the connected consumer product reaches its end of life.
(2) A notification provided pursuant to this subdivision shall include both of the following:
(A) Clear information about any action a consumer can take if the consumer wants to continue using the connected consumer product in a secure and effective manner.
(B) A list of features lost, security risks, reduced interoperability, or any other changes that are likely to result from the connected consumer product’s product reaching its end of life.
(3) A notification provided pursuant to this subdivision shall be delivered in each of the following ways:
(A) Through an interface on the connected consumer product or associated application, if practicable.
(B) Through an email to the owner of a connected consumer product, product if the manufacturer possesses knows the owner’s email address.
(C) On the connected consumer product’s manufacturer’s internet website or product-specific webpage.
(4) A manufacturer shall provide allow a consumer the means to opt in to receive a notification pursuant to this subdivision through the connected consumer product’s internet webpage.
(5) A notification provided pursuant to this subdivision shall be provided clearly and conspicuously as a standalone communication that contains no does not contain information unrelated to the notification.
(6)A manufacturer may request a connected consumer product owner’s contact information solely for the purpose of providing a notification pursuant to this subdivision.
(e) This section does not require a manufacturer to collect or retain contact information from the owner of a connected consumer product.
(e)
(f) A business that owns or controls a connected consumer product that it leases or otherwise provides to its customers a customer as part of a service shall do all both of the following:
(1) Ensure To the extent technically feasible, ensure that security patches provided made available by the manufacturer for the connected consumer product are promptly received and applied. applied to the connected consumer product.
(2) When If the connected consumer product has reached reaches its end of life, notify the customer and replace the connected consumer product, at no additional cost to the customer, with a comparable connected consumer product capable of receiving necessary security patches, updates, and support that has not reached its end of life if a comparable connected consumer product is reasonably available to the business.
(3)Notify a consumer when the leased connected consumer product has reached its end of life.