I wholeheartedly disagree about letting regulators have anything to do with technology. It moves too fast and has too many interpretations to be codified into common sense law, leaving just the big pocket corps to write the regulations just like they&#x27;ve already done everywhere else.<p>How do you define reasonable security practices? If there&#x27;s PII, what&#x27;s reasonable then? What&#x27;s reasonable today OAuth, tokens, 2FA was over the top crazy&#x2F;impractical&#x2F;expensive&#x2F;impossible in 2001. You think there&#x27;s going to be a committee evolving this crap every month in perpetuity?<p>On top of that, if actual harm comes to users of these devices as a result of these devices then we already have plenty of consumer laws protecting them. Granted, they&#x27;re going to have to come up with ways to apply it sometimes and you&#x27;re going to have to prove it was that device that allowed the harm, but we have it.<p>I will say this though: I&#x27;m mostly okay with laws (whether they exist or not yet) that say that if your negligence or stupidity was the root cause, as a manufacturer of these goods, you are on the hook for a multiplier of damages. There are a lot of companies out there that know they are pushing shit to market in a race to the bottom and then just claim security is hard and they tried their best when clearly, they knew about an 8 year old bug and shipped anyway. I&#x27;m that case, I&#x27;m okay with hitting them hard.