SECTION 1. The General Laws, as appearing in the 2022 Official Edition, are hereby amended by inserting after chapter 93L the following chapter:-

 CHAPTER 93M 

 THE REGULATION OF INTERNET CONNECTED DEVICES 

 Section 1. As used in this chapter, the following terms shall have the following meanings unless the context clearly requires otherwise:

 “Connected consumer product”, any device or other physical object marketed whole or in part to consumers or small businesses and is capable of connecting to the Internet, either directly or indirectly, including the physical device, associated mobile application and necessary cloud infrastructure.

 “Consumer”, a person that owns or leases from a lessor a connected consumer product that the person or the lessor purchased or used in the commonwealth.

 “End of software support period”, the point at which the manufacturer ceases providing technical support, security updates, or bug fixes for the software, hardware, or firmware, necessary for the product to securely function, even if the product is still in use.

 “End of sale”, the point at which a manufacturer stops selling the product, which shall be no less than 1 year before the end of software support period. 

 “Firmware”, means low-level software that is embedded into hardware devices that provides the essential instructions needed for hardware operation, acting as a middle layer between the hardware and higher-level software such as device operating systems or applications.

 “Internet service provider” or “ISP”, a company or organization that provides individuals and businesses with access to the internet through infrastructure and networking technologies that connect to the global internet, such as broadband, fiber, DSL, and mobile data, often including electronic mail and web hosting.

 “Manufacturer” or “original equipment manufacturer” or “OEM”, a business engaged in the business of selling, leasing, or otherwise supplying new consumer electronic devices, or parts of equipment, manufactured by or on behalf of itself, to any individual or business.

 “Minimum guaranteed support time period”, means the minimum amount of time for which a company has publicly committed to providing technical support, security updates or bug fixes for the software, hardware, or firmware, expressed as continuing until a specific date or for a specified period of time that commences with the purchase of the device.

 “Point of sale” or “POS”, an electronic terminal used by merchant employees for consumer purchases or services.

 “Product web page”, a web page specific to the particular connected consumer product that contains features and information about the product.

 “Security updates”, updates released to address vulnerabilities in the software, hardware, or firmware used by a connected consumer product.

 ''Small business'', a business entity, including its affiliates, that: (i) is independently owned and operated; (ii) has a principal place of business in the commonwealth; and (iii) would be defined as a ''small business'' under applicable federal law, as established in the United States Code and promulgated from time to time by the United States Small Business Administration.

 “Technical support”, contractor- or manufacturer-provided assistance addressing technical issues for consumer electronic equipment, including but not limited to troubleshooting, repair, updates and usage guidance.

 “Vulnerability”, means a flaw in the software, hardware, or firmware running on a connected consumer product that lessens the security and integrity of the software, hardware or firmware needed to operate the product.

 Section 2. (a) For any connected consumer product sold on or after January 1, 2027, the manufacturer shall disclose a minimum guaranteed support period during which technical support, security updates and bug fixes shall be provided for the product's essential software, firmware, and hardware.

 (b) Disclosures required under subsection (a) shall: (i) be made at the point of sale, where practicable; (ii) be displayed in a clear and conspicuous manner on the product packaging and on the manufacturer's website or product-specific webpage; and (iii) specify the end of software support period date or the length of support from the date of sale.

 (c) A manufacturer shall not shorten the disclosed support period after the sale of a product but may extend the support period by issuing updated disclosures.

 (d) Not less than 6 months prior to the end of the minimum guaranteed support period, the manufacturer shall notify consumers of the forthcoming end of software support period, including a list of features that will no longer function and any cybersecurity risks; performance degradation; reduced interoperability; or other changes that may result from the discontinued product support.

 e) Manufacturers shall post the notification required under subsection d on the product-specific web page; provided, however, that manufacturers shall also deliver notifications required under subsection (d) by at least 1 of the following methods, if feasible: (i) in-product messaging through an associated application or user interface, where the manufacturer provides such application or interface to consumers; or (ii) email communications, where the manufacturer possesses consumer contact data.

 (f) Internet service providers that supply or lease connected consumer products shall be responsible for ensuring that such products:

 (i) continue to receive security updates if still in active deployment; or

 (ii) if declared end of software support period, are replaced, at no cost to the consumer, with comparable products capable of receiving security updates.

 Section 3. (a) A violation of any provision of this chapter shall constitute an unfair or deceptive act or practice under section 2 of chapter 93A.

 (b) Any person who suffers an ascertainable loss of money or property, real or personal, as a result of a manufacturer’s or service provider’s violation of this chapter may bring an action under chapter 93A, section 9, to recover actual damages, including but not limited to:

 (i) costs to repair or replace the affected product;

 (ii) costs of substitute or alternative products;

 (iii) shipping, installation and setup costs;

 (iv) consequential damages resulting from product failure;

 (v) lost income or wages from interruptions to use;

 (vi) other documented financial losses;

 (vii) reasonable attorney’s fees and costs; and

 (viii) injunctive or declaratory relief as appropriate.

 (c) The rights and remedies established by this chapter shall be in addition to any other rights or remedies available under state or federal law.