Connected consumer products., the official text

An act to add Chapter 28.6 (commencing with Section 22928.10) to Division 8 of the Business and Professions Code, relating to consumer protection.

LEGISLATIVE COUNSEL'S DIGEST

The Unfair Competition Law (UCL) prohibits a person from engaging in unfair competition, including any unlawful, unfair, or fraudulent business act or practice.
This bill would require a manufacturer of a connected consumer product sold at retail to clearly and conspicuously disclose a connected consumer product’s minimum guaranteed support timeframe to any prospective buyer of a connected consumer product, as prescribed, and would, except as specified, prohibit a manufacturer from reducing that timeframe. The bill would further require that a minimum guaranteed support timeframe be consistent with the reasonable expectations of a consumer, as specified.
This bill would also require a manufacturer to provide a clear and conspicuous notice of a connected consumer product reaching its end of life to the public and to any owner of the product, including, among other notice requirements, that the notice be delivered on specified dates and by specified means. The bill would require a manufacturer to allow a consumer to opt in to the product’s end-of-life notifications.
This bill would require a business that owns or controls a connected consumer product that it leases or otherwise provides to its customers as part of a service to ensure that updates provided by the manufacturer for the connected consumer product are promptly received and applied and, when the connected consumer product has reached its end of life, replace the connected consumer product, at no additional cost to the customer, with a comparable product capable of receiving necessary updates and support if a comparable product is reasonably available to the business. The bill would further require a business to notify a consumer when the leased connected consumer product has reached its end of life.
This bill would define “connected consumer product” to mean a physical product, as specified, that is intended for consumer use and depends on a connection to the internet for a consumer to make ordinary use, as defined, of the product. The bill would also define “end of life” to mean the date on which a manufacturer no longer provides support, security patches, or updates that are necessary for a consumer to make ordinary use of a connected consumer product.
This bill would specify that a violation of its provisions constitutes a deceptive act or practice under the UCL.

The people of the State of California do enact as follows:

SECTION 1.
Chapter 28.6 (commencing with Section 22928.10) is added to Division 8 of the Business and Professions Code, to read:
28.6.
Connected Consumer Products22928.10.
As used in this chapter:
(a) “Connected consumer product” means a physical product, including a mobile application or cloud infrastructure related to the functioning of the physical product, that is intended for consumer use and depends on a connection to the internet for a consumer to make ordinary use of the product.
(b) “End of life” means the date on which a manufacturer no longer provides support, security patches, or updates that are necessary for a consumer to make ordinary use of a connected consumer product.
(c) “Manufacturer” means the manufacturer of a connected consumer product sold at retail in the state.
(d) “Minimum guaranteed support timeframe” means the period of time, beginning when a manufacturer first makes a connected consumer product available for purchase in this state and ending on a specific date, during which a manufacturer commits to providing all necessary support, security patches, or updates that are necessary for a consumer to make ordinary use of a connected consumer product.
(e) “Ordinary use” means use of a connected consumer product that is consistent with a consumer’s reasonable expectations based on how the connected consumer product was advertised, marketed, or otherwise described by the manufacturer at the time of purchase.

22928.11.
(a) A manufacturer shall clearly and conspicuously disclose a connected consumer product’s minimum guaranteed support timeframe to any prospective buyer of the connected consumer product in all of the following ways to the extent each is technically feasible:
(1) At the point of internet sale.
(2) On the connected consumer product packaging.
(3) On the manufacturer’s internet website or product-specific webpage.
(b) (1) Except as provided in paragraph (2), a manufacturer shall not reduce a minimum guaranteed support timeframe disclosed under this section.
(2) (A) A manufacturer may reduce a minimum guaranteed support timeframe disclosed under this section if the manufacturer demonstrates that providing support for the connected consumer product is not feasible due to unforeseeable circumstances beyond the manufacturer’s reasonable control, including any of the following:
(i) The manufacturer is subject to bankruptcy or another insolvency proceeding that materially impairs the manufacturer’s ability to provide support.
(ii) A third-party dependency, including, but not limited to, a service, platform, software or hardware component, security certificate, application programming interface, network, or other technology operated or controlled by an unaffiliated third party that is necessary to provide support, is discontinued, materially altered, or no longer made available to the manufacturer on commercially reasonable terms and cannot reasonably be replaced by the manufacturer.
(iii) Providing support is unlawful.
(iv) A vulnerability, defect, or other safety or security condition makes providing support materially likely to compromise the security, privacy, or safety of users or the public, and the issue cannot reasonably be remedied by the manufacturer.
(B) A manufacturer that reduces a minimum guaranteed support timeframe pursuant to this paragraph shall, as soon as is practicable, provide clear and conspicuous notice to any affected consumer pursuant to subdivision (d).
(c) A manufacturer shall ensure that the minimum guaranteed support timeframe of a connected consumer product that it manufactured is consistent with the reasonable expectations of a consumer based on all of the following:
(1) The nature of the connected consumer product, including the connected consumer product’s expected use, durability, and reliance on remote services.
(2) The price paid for the connected consumer product by consumers.
(3) How the connected consumer product is advertised, marketed, or otherwise described by the manufacturer at the time of purchase.
(4) The minimum guaranteed support timeframe of comparable connected consumer products.
(d) (1) A manufacturer shall provide a clear and conspicuous notice of a connected consumer product reaching its end of life to the public and to any owner of the connected consumer product on both of the following dates:
(A) Six months before the connected consumer product reaches its end of life.
(B) The date on which the connected consumer product reaches its end of life.
(2) A notification provided pursuant to this subdivision shall include both of the following:
(A) Clear information about any action a consumer can take to continue using the connected consumer product in a secure and effective manner.
(B) A list of features lost, security risks, reduced interoperability, or any other changes likely to result from the connected consumer product reaching its end of life.
(3) A notification provided pursuant to this subdivision shall be delivered in each of the following ways:
(A) Through an interface on the connected consumer product or associated application, if practicable.
(B) Through an email to the owner of a connected consumer product if the manufacturer knows the owner’s email address.
(C) On the manufacturer’s internet website or product-specific webpage.
(4) A manufacturer shall allow a consumer to opt in to receive a notification pursuant to this subdivision through the connected consumer product’s internet webpage.
(5) A notification provided pursuant to this subdivision shall be provided clearly and conspicuously as a standalone communication that does not contain information unrelated to the notification.
(e) This section does not require a manufacturer to collect or retain contact information from the owner of a connected consumer product.
(f) A business that owns or controls a connected consumer product that it leases or otherwise provides to a customer as part of a service shall do both of the following:
(1) To the extent technically feasible, ensure that security patches made available by the manufacturer for the connected consumer product are promptly applied to the connected consumer product.
(2) If the connected consumer product reaches its end of life, notify the customer and replace the connected consumer product, at no additional cost to the customer, with a comparable connected consumer product that has not reached its end of life if a comparable connected consumer product is reasonably available to the business.

22928.12.
A violation of this chapter constitutes a deceptive act or practice under the Unfair Competition Law (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7).