IL HB3536

Creates the Security of Connected Devices Act requiring manufacturers of internet-connected devices to equip them with reasonable security features appropriate to the device's nature and function.

Security features must be designed to protect the device and any information it contains from unauthorized access, destruction, use, modification, or disclosure.

Devices with external authentication must either have unique preprogrammed passwords for each device or require users to generate new authentication credentials before first access.

Exempts devices subject to federal security requirements, unaffiliated third-party software or applications, app store providers, and entities covered under the Health Insurance Portability and Accountability Act.

Enforcement is limited to the Illinois Attorney General, who may pursue violations as unlawful practices under the Consumer Fraud and Deceptive Business Practices Act; no private right of action is created.