Connected consumer products.

The flat requirement that a minimum guaranteed support timeframe be 'no less than five years' was replaced with a requirement that the timeframe be 'consistent with the reasonable expectations of a consumer' based on four factors: the nature of the product, the price paid, how it is advertised or marketed, and comparable products' timeframes. This removes the hard five-year floor and substitutes a flexible, context-dependent standard.

Disclosure requirements were changed from 'clearly and prominently' to 'clearly and conspicuously,' and a qualifier was added: disclosures must be made 'to the extent each is technically feasible.' The disclosure methods were reorganized into three separate items (internet sale point, product packaging, and manufacturer website) rather than two.

A new provision states that the section does not require a manufacturer to collect or retain contact information from the owner of a connected consumer product. This is a privacy protection limiting data collection obligations.

For businesses leasing connected consumer products, the obligation to ensure security patches are applied was qualified with 'to the extent technically feasible.' The replacement requirement now specifies that the comparable replacement product must be one 'that has not reached its end of life.'

A new exception was added allowing a manufacturer to reduce its minimum guaranteed support timeframe if it demonstrates that providing support is not feasible due to unforeseeable circumstances beyond its reasonable control. Covered circumstances include: bankruptcy or insolvency, discontinuation or material alteration of a third-party dependency (such as a service, platform, API, or security certificate), illegality of providing support, or a vulnerability that makes support likely to compromise user security, privacy, or safety. The manufacturer must provide clear and conspicuous notice to affected consumers.

The definition of 'connected consumer product' was narrowed from depending 'for its functioning, in whole or in part, on a connection to the internet' to depending 'on a connection to the internet for a consumer to make ordinary use of the product.' A new definition of 'ordinary use' was added, meaning use consistent with a consumer's reasonable expectations based on how the product was advertised, marketed, or described at the time of purchase.

The definition of 'end of life' was changed from the point after which a manufacturer no longer provides 'necessary support or security patches' to the date on which it no longer provides 'support, security patches, or updates that are necessary for a consumer to make ordinary use of a connected consumer product.' This ties end of life to the new 'ordinary use' standard rather than any support at all.

The definition of 'minimum guaranteed support timeframe' was expanded to explicitly state it begins when a manufacturer first makes the product available for purchase in the state and ends on a specific date, and that the support provided must be 'necessary for a consumer to make ordinary use of a connected consumer product.'

The definition of 'end of life' now explicitly includes 'security patches' alongside support and updates, making it clear that stopping security patching constitutes end of life.

A new definition of 'necessary support' is added, defined as 'all necessary support to enable product functionality.'

The definition of 'minimum guaranteed support timeframe' now explicitly references 'security patches, or updates' in addition to general support.

New subdivision (d)(3) requires end-of-life notifications to be delivered through specific channels: the product's interface or associated app, email to the owner (if the manufacturer has the address), and on the product's internet webpage.

New subdivision (d)(4) requires manufacturers to provide consumers a means to opt in to end-of-life notifications through the product's internet webpage.

The standalone notification requirement is revised from 'a separate document that contains no other information or notification' to 'clearly and conspicuously as a standalone communication that contains no information unrelated to the notification.'

The business/lessor obligation in section 22928.11(e) is expanded from 'do both of the following' to 'do all of the following,' and item (1) now specifically requires applying 'security patches' rather than just 'updates.'

The replacement product requirement in section 22928.11(e)(2) now specifies the comparable product must be capable of receiving 'security patches, updates, and support' rather than just 'necessary updates and support.'

New item (e)(3) requires a business that leases or provides a connected consumer product as part of a service to notify the consumer when that product has reached its end of life.

New subdivision (d)(6) authorizes manufacturers to request a product owner's contact information solely for the purpose of providing end-of-life notifications.

The definition of 'connected consumer product' was narrowed. Previously it covered any physical product 'capable of connecting to the internet, either directly or indirectly.' Now it requires that the product 'depends for its functioning, in whole or in part, on a connection to the internet.' Additionally, mobile applications and cloud infrastructure are now limited to those 'related to the functioning of the physical product' rather than being included broadly.

The disclosure requirement for the minimum guaranteed support timeframe was changed from 'at the point of sale, if practicable' to 'at the point of internet sale, if practicable,' limiting the obligation to online transactions and removing it from in-person retail sales.

Manufacturers must now provide a minimum guaranteed support timeframe of no less than five years, calculated from the first month the product is offered for sale to consumers.

End-of-life notifications must now be provided in a separate document containing no other information or notification, preventing manufacturers from burying the notice among other content.

The definition of 'connected consumer product' was revised to explicitly include mobile applications and cloud infrastructure related to the functioning of a physical product that depends on an internet connection, in addition to the physical device itself.

The bill's stated legislative intent to enact legislation relating to 'software tethering' was removed from both the digest and the operative text (former Section 1).

Fiscal committee review changed from 'no' to 'yes,' indicating the amendments created a new state fiscal impact requiring committee approval.

The bill now adds an entirely new Chapter 28.6 (Sections 22928.10-22928.12) to Division 8 of the Business and Professions Code, moving from a non-binding intent statement to enforceable statutory requirements.

New definitions for 'connected consumer product' (any consumer product capable of connecting to the internet, including devices, apps, and cloud infrastructure), 'end of life,' 'manufacturer,' and 'minimum guaranteed support timeframe.'

Manufacturers must clearly disclose a minimum guaranteed support timeframe at point of sale and on product packaging and their website, and are prohibited from reducing that timeframe after disclosure.

Manufacturers must provide end-of-life notice to the public and to product owners both six months before and on the date the product reaches end of life, including information about consumer options, features lost, security risks, and reduced interoperability.

Businesses that lease or provide connected consumer products to customers as part of a service must promptly apply manufacturer updates and, when a product reaches end of life, replace it at no additional cost to the customer with a comparable product if reasonably available.

Violations of the new chapter are designated as deceptive acts or practices under the Unfair Competition Law (Section 17200 et seq.), giving consumers and regulators a legal basis for enforcement.

The fiscal committee answer changed from 'no' to 'yes,' indicating the bill now has state fiscal implications due to its substantive regulatory requirements.