New York law requires security features on baby monitors

New York has passed what its governor calls nation-leading rules for one of the most sensitive cameras in the home. On 28 October 2026, Gov. Kathy Hochul signed S.9508/A.5175A, which bans the sale of internet-connected baby monitors without built-in security protections.

What the law requires

According to the bill text and the governor's announcement, no retailer or second-hand dealer in New York may sell, lease or otherwise offer a baby monitor that broadcasts audio or video over an internet connection unless it includes:

• security features that prevent unauthorised users from hearing or viewing activity, and
• a conspicuous warning label on the box or with the device, substantially similar to: "WARNING! This baby monitor allows internet users to hear or view activity. Use the security features included with this device to restrict internet viewership."

Selling a monitor without them counts as a deceptive act under New York's consumer protection law. The rules take effect 90 days after signing, so in late January 2027.

The definition is narrow: a baby monitor is a device marketed exclusively to broadcast audio or video of an infant or child. Multi-purpose devices such as smartphones, digital video cameras and security cameras are excluded, and non-internet monitors are not covered.

Why lawmakers acted

The governor's office cites security researchers at Rapid7, who tested nine internet-connected baby monitors from eight companies: eight received an "F" for security and one a "D". Hochul also said that earlier this year feeds from more than one million internet-connected baby monitors were viewable simply by visiting a website, and described a Colorado mother who heard a stranger speaking to her child through a monitor.

Hochul signed a second bill at the same time, S.9051B/A.10379C, which bans unsafe AI chatbot features for minors, such as bots that pretend to be human.

The catch

The bill text shown by the state does not list specific technical requirements such as encryption or mandatory password changes. It only requires "security features" plus a label, so how strict this is in practice will depend on enforcement. The label also asks parents to use those features, which means setup still matters.

What parents can do now

You don't need to wait for the law. Change any default password, turn on two-factor authentication in the app, keep the monitor's firmware and your router's firmware up to date, and switch off remote viewing if you only watch from inside the house. If you are shopping, our new baby monitor buying guide compares Wi‑Fi and non‑Wi‑Fi monitors and lists the security checks to make before you buy. Many of the same rules apply to any indoor camera, as our home security camera guide explains.