New York is requiring security features and warnings on new internet-connected baby monitors under a law signed October 28. For buyers and current owners, checking a monitor also means examining access to its feed, software updates and health claims.
What New York requires
The enacted bill and signing record show Governor Kathy Hochul signed A5175A on October 28. Its 90-day effective period ends January 26, 2027.
Covered monitors must have features that prevent unauthorized listening or viewing, plus a conspicuous warning about an unsecured internet connection and using those features. The notice must accompany the product or appear on its packaging, in at least 12-point type.
The law covers a device marketed exclusively to broadcast an infant's or child's audio or video. Multifunction smartphones, digital video cameras and general security cameras are excluded. The requirement concerns new monitors broadcasting through an internet connection.
Local consumer-affairs officials and other authorized local-government officers enforce it. Maximum civil penalties are $250 for a first violation and $500 for subsequent violations.
Compare access controls before buying
The FTC's camera-security guidance recommends checking encryption for account information, live feeds and stored recordings. Ask whether remote viewing can be disabled and whether the product gives different people different permissions.
An administrator may be able to add accounts, change passwords or move the camera. A viewer may need only permission to watch. Check whether access can be limited to particular times, rather than giving everyone the same control. These are features to look for, not capabilities every model includes.
For an existing camera, consult its instructions or manufacturer to learn which protections it supports and how to enable them. A product having a security feature does not establish that it is switched on.
Before watching a feed away from home, secure the accounts and devices allowed to view it. The FTC recommends enabling two-factor authentication on the cloud account when available. A stolen password alone should then be insufficient to sign in.
Secure the device and its connection
The FTC's connected-device guidance starts with the router. Replace its default administrator credentials with unique ones, enable wireless encryption and keep its software updated. The router sits between connected household equipment and the internet, so camera settings are only part of the setup.
Give the monitor its own strong password instead of reusing one from another account. Reused credentials can let someone turn a breach elsewhere into access to another device. Enable the monitor's available security settings, including encryption or a passcode lockout where offered.
Check both the camera's firmware and the phone app used to operate it. Updating the app alone does not establish that the camera's software is current. Firmware updates may require a visit to the manufacturer's website.
Disable remote management you do not use and disconnect unused older devices. Where the camera provides access logs, review unexpected access times or unfamiliar addresses through its administrative settings.
The often-cited nine-monitor test is from 2015
Security concerns predate this law. Rapid7's original research FAQ describes tests of nine monitors from eight vendors, purchased in the first half of 2015. Researchers examined firmware, mobile apps, web services and network connections. Eight devices received an F and one a D under their scoring system.
That research found weaknesses including hardcoded credentials and unencrypted video. It cannot establish how often monitors sold in 2026 have those problems.
Health claims need a separate check
A secure video feed does not establish the accuracy of a device's health measurements. In its September 2025 safety notice, the FDA warns against unauthorized infant monitors claiming to measure vital signs. Inaccurate readings can cause unnecessary care or delay treatment.
If medical care depends on monitoring, ask your child's health care provider about an appropriate FDA-authorized device. The FDA says no infant monitor has been authorized to prevent SIDS or SUID.
