New York signs S.9508, requiring security safeguards on AI-enabled baby monitors

New York's S.9508/A.5175A requires internet-connected baby monitors sold in the state to include security features that block unauthorized remote access and to carry a clear warning label, alongside wifi-enabled devices that increasingly rely on AI-driven video and audio features. Governor Kathy Hochul signed the bill on October 28, 2026, the same day she signed a separate law restricting AI chatbot features for minors.

What it is

The law is a New York State consumer-safety statute, sponsored by State Senator Andrew Gounardes and Assemblymember Michaelle C. Solages, aimed at the cybersecurity of internet-connected baby monitors rather than at AI models themselves.

State officials pointed to testing by the cybersecurity firm Rapid7, which found that eight of nine internet-connected baby monitors it examined from eight companies received an F grade for security, and the ninth received a D.

What it requires

The law prohibits the sale of new internet-connected baby monitors that broadcast audio or video unless they include security features that prevent strangers from seeing or hearing what is happening in a child's room.

Covered devices must also carry a clear, easy-to-read warning label explaining that the device connects to the internet and that families should use its security features, and the law takes effect 90 days after signing.

According to press coverage, first offenses carry a $250 fine and repeat offenses a $500 fine, and multi-use devices such as smartphones and home security cameras are exempt.

What security leaders should do

Security and product teams at manufacturers of connected monitoring devices sold into New York should review whether their internet-connected baby monitors can broadcast audio or video and, if so, confirm they ship with security features that prevent unauthorized remote viewing or listening before the law's effective date 90 days after signing. Teams should also prepare the required warning label language and documentation now, since the statute's effective date leaves a limited compliance window. CISOs overseeing IoT and connected-device portfolios should treat this law as an early signal that state legislatures are extending AI- and internet-connectivity-era security expectations beyond chatbots to networked consumer hardware, and should track enforcement activity from the New York Attorney General's office, which the governor's announcement states will accompany the related chatbot law.