NY S09179

Requires manufacturers of connected devices sold in New York to equip devices with reasonable security features appropriate to the device's nature, function, and information it collects or transmits.

Deems a device to have reasonable security if it either has a unique preprogrammed password for each device or requires users to generate new authentication credentials before first use.

Exempts manufacturers from responsibility for third-party software, app store providers from enforcement duties, and prohibits restrictions on user control to modify device software or firmware.

Exempts connected devices subject to federal security requirements and devices covered under HIPAA from these requirements.

Grants exclusive enforcement authority to the New York Attorney General with no private right of action, effective January 1 following enactment.