Ever heard of SB 327 law? - It is California's new law, which will take effect in January 2020, requires all "connected devices" to have a "reasonable security feature." More important, default passwords are not allowed.

Connected Device includes IoT , reasonable security, that's a bit vague


More Here:

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180SB327