H5114

	SECTION 1. The General Laws, as appearing in the 2022 Official Edition, are hereby amended by inserting after chapter 93L the following chapter:-
	CHAPTER 93M 
	THE REGULATION OF INTERNET CONNECTED DEVICES 
	Section 1. As used in this chapter, the following terms shall have the following meanings unless the context clearly requires otherwise:
	“Connected consumer product”, any device or other physical object that is intended for consumer use and is capable of connecting to the Internet, either directly or indirectly, including the physical device, associated mobile application and necessary cloud infrastructure.
	“Consumer”, a person that owns or leases from a lessor consumer electronic equipment that the person or the lessor purchased or used in the commonwealth.
	“End of life”, the point at which the manufacturer ceases providing technical support, security updates, or bug fixes for the software, hardware, or firmware, necessary for the product to securely function, even if the product is still in use.
	“End of sale”, the point at which a manufacturer stops selling the product, which shall be no less than 1 year before the end of life. 
	“Firmware”, means low-level software that is embedded into hardware devices that provides the essential instructions needed for hardware operation, acting as a middle layer between the hardware and higher-level software such as device operating systems or applications.
	“Internet service provider” or “ISP”, a company or organization that provides individuals and businesses with access to the internet through infrastructure and networking technologies that connect to the global internet, such as broadband, fiber, DSL, and mobile data, often including electronic mail and web hosting.
	“Manufacturer” or “original equipment manufacturer” or “OEM”, a business engaged in the business of selling, leasing, or otherwise supplying new consumer electronic devices, or parts of equipment, manufactured by or on behalf of itself, to any individual or business.
	“Minimum guaranteed support time frame”, means the minimum amount of time for which a company has publicly committed to providing technical support, security updates or bug fixes for the software, hardware, or firmware, expressed as continuing until a specific date or for a specified period of time that commences with the purchase of the device.
	“Point of sale” or “POS”, an electronic terminal used by merchant employees for consumer purchases or services.
	“Product web page”, a web page specific to the particular connected consumer product that contains features and information about the product.
	“Security updates”, updates released to address vulnerabilities in the software, hardware, or firmware used by a connected consumer product.
	“Technical support”, contractor- or manufacturer-provided assistance addressing technical issues for consumer electronic equipment, including but not limited to troubleshooting, repair, updates and usage guidance.
	“Vulnerability”, means a flaw in the software, hardware, or firmware running on a connected consumer product that lessens the security and integrity of the software, hardware or firmware needed to operate the product.
	Section 2. (a) For any connected consumer product manufactured on or after January 1, 2026, the manufacturer shall disclose a minimum guaranteed support period during which technical support, security updates and bug fixes shall be provided for the product's essential software, firmware, and hardware.
	(b) Disclosures required under subsection (a) shall: (i) be made at the point of sale, where practicable; (ii) be displayed in a clear and conspicuous manner on the product packaging and on the manufacturer's website or product-specific webpage; and (iii) specify the end-of-life date or the length of support from the date of sale.
	(c) A manufacturer shall not shorten the disclosed support period after the sale of a product but may extend the support period by issuing updated disclosures.
	(d) Not less than 6 months prior to the end of the minimum guaranteed support period, the manufacturer shall notify consumers of the forthcoming end-of-life, including a list of features that will no longer function and any cybersecurity risks; performance degradation; reduced interoperability; or other changes that may result from the discontinued product support.
	(e) Manufacturers shall deliver notifications required under subsection (d) by one or more of the following methods:
	(i) in-product messaging through an associated application or user interface;
	(ii) email communications, where the manufacturer possesses consumer contact data; or
	(iii) posting on the product-specific webpage.
	(f) Internet service providers that supply or lease connected consumer products shall be responsible for ensuring that such products: (i) continue to receive security updates if still in active deployment; or
	 (ii) if declared end-of-life, are replaced, at no cost to the consumer, with comparable products capable of receiving security updates.
	Section 3. (a) A violation of any provision of this chapter shall constitute an unfair or deceptive act or practice under section 2 of chapter 93A. The attorney general shall have all the powers and duties under chapter 93A for the enforcement of this chapter, including the authority to promulgate rules and regulations necessary to carry out its provisions.
	(b) Any person who suffers an ascertainable loss of money or property, real or personal, as a result of a manufacturer’s or service provider’s violation of this chapter may bring an action under chapter 93A, section 9, to recover actual damages, including but not limited to:
	(i) costs to repair or replace the affected product;
	(ii) costs of substitute or alternative products;
	(iii) shipping, installation and setup costs;
	(iv) consequential damages resulting from product failure;
	(v) lost income or wages from interruptions to use;
	(vi) other documented financial losses;
	(vii) reasonable attorney’s fees and costs; and
	(viii) injunctive or declaratory relief as appropriate.
	(c) The rights and remedies established by this chapter shall be in addition to any other rights or remedies available under state or federal law.