Bill Requiring Security Features on Internet-Connected Baby Monitors Signed Into Law

TRENTON — Legislation sponsored by Senator Jeff Van Drew that requires internet-connected baby monitors to include security features was signed into law on Thurs. by the Governor.
“One of your first instincts as a parent is to do everything possible to ensure the safety of your child at all times,” said Senator Van Drew. “This law will address concerns that internet-connected baby monitors can be tampered with, by requiring that companies meet standards of safety and quality. This is critical to protecting families from danger associated with someone viewing or listening to activity in the home through these devices.”
The law (S-2582) would direct the Director of the Division of Consumer Affairs in the Department of Law and Public Safety, in consultation with the Commissioner of the Department of Children and Families, to adopt rules and regulations to implement the provisions of the bill. The law instructs that no baby monitor that broadcasts audio or video online shall be sold, or offered for sale in New Jersey, unless it includes security features to prevent unauthorized users from hearing or viewing activity, and a label or notice warning consumers of the risks associated with an unsecured baby monitor connection and the importance of accessing the baby monitor securely and using its security features.
Under the law, a baby monitor without these features would violate the consumer fraud act and be subject to a monetary penalty of not more than $10,000 for a first offense and not more than $20,000 for any subsequent offense.
The Office of Technology, Research and Investigation, in the Federal Trade Commission (FTC), studied five baby monitors that broadcast live audio and video feeds over the internet and found that some of them have minimal security protections. Only one required a complex password while the others allowed users access with simple passwords, such as “password,” making them vulnerable to hackers. Two of the five baby monitors the FTC studied did not encrypt the feed between the router and internet resulting in additional vulnerabilities.
This law shall take effect on the first day of the 19th month next following the date of enactment.