A 10132: Enacts the "connected consumer product end of life disclosure act", relating to requiring manufacturers of connected consumer products to disclose for how long they will provide technical support, security updates, or bug fixes for the software, hardware, or firmware necessary for the product to securely function.

  
  STATE OF NEW YORK ________________________________________________________________________ 10132  IN ASSEMBLY February 3, 2026 ___________ Introduced by M. of A. OTIS -- read once and referred to the Committee on Science and Technology AN ACT to amend the general business law, in relation to enacting the "connected consumer product end of life disclosure act" The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Short title. This act shall be known and may be cited as 2 the "connected consumer product end of life disclosure act". 3 § 2. The general business law is amended by adding a new section 399- 4 mm to read as follows: 5 § 399-mm. Connected consumer product end of life disclosure. 1. Defi- 6 nitions. As used in this section, the following terms shall have the 7 following meanings: 8 (a) "Connected consumer product" means any product that is intended 9 for consumer use and depends for its functioning, in whole or in part, 10 on connection to the internet. The term includes the product, the mobile 11 application, and necessary cloud infrastructure. 12 (b) "End of life" means the point at which the manufacturer ceases 13 providing technical support, security updates, or bug fixes for the 14 software, hardware, or firmware necessary for the connected consumer 15 product to securely function, even if the product is still in use. 16 (c) "Firmware" means low-level software that is embedded into hardware 17 devices, where such software provides the essential instructions needed 18 for hardware to operate properly, acting as a middle layer between the 19 hardware and higher-level software such as device operating systems or 20 applications. 21 (d) "Minimum guaranteed support time frame" means the minimum amount 22 of time for which a company has publicly committed to providing techni- 23 cal support, security updates, or bug fixes for the software, hardware, 24 or firmware, expressed as continuing until a specific date. 25 (e) "Product web page" means a web page specific to the particular 26 connected consumer product that contains information about such product 27 and its features. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD13518-03-6 
 A. 10132 2 1 (f) "Security updates" means updates released to address vulnerabili- 2 ties in the software, hardware, or firmware used by a connected consumer 3 product. 4 (g) "Support" means service to ensure that a connected consumer prod- 5 uct continues to fully function and to provide information and guidance 6 to consumers regarding proper use of the product. 7 (h) "Update" means a security update, or an update released for a 8 connected consumer product to address effectively a flaw in the soft- 9 ware, hardware, or firmware running on the product that interferes with 10 the full functioning of the product. 11 (i) "Vulnerability" means a flaw in the software, hardware, or firm- 12 ware running on a connected consumer product that lessens the security 13 and integrity of the software, hardware, or firmware needed to operate 14 such product. 15 2. Requirements. The following requirements shall apply to any 16 connected consumer product manufactured or sold after January first, two 17 thousand twenty-seven: 18 (a) The manufacturer shall clearly and conspicuously disclose a mini- 19 mum guaranteed support time frame on the product webpage. 20 (b) The seller shall clearly and conspicuously disclose at the point 21 of sale instructions on how to find the information outlined in para- 22 graph (a) of this subdivision. 23 (c) The minimum guaranteed support time frame shall not be inconsist- 24 ent with reasonable consumer expectations about how long a connected 25 consumer product's features that depend upon internet connectivity will 26 continue to function safely and effectively. 27 (d) The minimum guaranteed support time frame for a connected consumer 28 product shall not be reduced after it is disclosed pursuant to this 29 subdivision. A manufacturer may extend the minimum guaranteed support 30 time frame at any time by making a new disclosure pursuant to this 31 subdivision. 32 (e) The disclosures described in paragraph (a) of this subdivision 33 shall also include a detailed account of the features and functionality 34 that will be lost when the connected consumer product reaches its end of 35 life. 36 (f) The manufacturer shall provide advance notice of the decision to 37 cease providing technical support, security updates, or bug fixes for 38 the software, hardware, or firmware on the product webpage. Such notice 39 shall: 40 (i) be posted six months before the product reaches end of life; and 41 (ii) disclose the date on which the product reaches end of life. 42 (g) The disclosure outlined in paragraph (a) of this subdivision and 43 the notification outlined in paragraph (f) of this subdivision shall 44 include clear information about actions the user can take if they want 45 to continue using the connected consumer product in a secure and effec- 46 tive manner, disconnecting such product from the internet and shall 47 provide a list of features lost, and vulnerabilities and security risks 48 that are likely to result from the end of life. 49 (h) A business that owns or controls a connected consumer product and 50 leases or otherwise provides such connected consumer product to their 51 customers shall: 52 (i) ensure that updates associated with the minimum guaranteed support 53 time frame associated with such connected consumer product are promptly 54 received by the customer; and 55 (ii) when the product has reached end of life: 56 (A) promptly notify customers; and 
 A. 10132 3 1 (B) replace the product, at no additional cost to customers, with a 2 comparable product capable of receiving necessary updates and support, 3 when such comparable product is reasonably available to the business, 4 and notify customers of such replacement product. 5 3. Enforcement. Any retailer that violates this section shall be 6 subject to a civil penalty of not more than one hundred dollars for the 7 first violation, not more than two hundred fifty dollars for the 8 second violation, and not more than five hundred dollars for each 9 violation thereafter. The provisions of subdivision one of this 10 section may be enforced concurrently by the director of a municipal 11 consumer affairs office, or by the town attorney, city corporation coun- 12 sel, or other lawful designee of a municipality or local govern- 13 ment, and all moneys collected thereunder shall be retained by such 14 municipality or local government. 15 § 3. This act shall take effect immediately.