Baby Monitor Security: New York's Law and Why 8 of 9 Got an F

Baby monitor security is now a legal requirement in New York. On October 28, 2026, Governor Kathy Hochul signed S.9508/A.5175A, which bars the sale of new internet-connected baby monitors unless they include security features that stop strangers from seeing or hearing into a child’s room, plus a clear warning label. To justify it, the state cited testing by the security firm Rapid7: nine monitors from eight companies, eight graded “F” and one “D.” Here is the detail most coverage skipped. Those grades match a Rapid7 study published in September 2015. The finding is old. The weaknesses it named are not, and the monitor in your nursery will not get any safer on its own when the law takes effect.

Key Takeaways

• New York’s baby monitor law (S.9508/A.5175A) takes effect 90 days after the October 28, 2026 signing, around January 26, 2027. It applies to new monitors sold in the state, not to ones already in homes.
• The “8 F’s and a D” statistic matches Rapid7’s 2015 study of nine monitors. It is a decade old, and the state’s release does not date it.
• Rapid7 found hardcoded passwords, unencrypted video and cloud flaws, including one that exposed recorded clips for every camera on a service.
• In 2013 the FTC settled with TRENDnet after hackers posted links to nearly 700 home camera feeds, some showing babies asleep in cribs.
• A 10-minute home routine (new password, two-factor login, firmware update, sharing check) closes the most common doors.

What New York’s Baby Monitor Law Requires

New York’s baby monitor law is a consumer-product rule that sets a minimum security bar for new monitors that send audio or video over the internet. According to the Governor’s announcement, the law “prohibits selling new baby monitors that transmit audio or video over the internet unless they include security features that prevent strangers from seeing or hearing the child’s room.” Monitors must also carry a clear, easy-to-read warning label saying the device connects to the internet and that families should use its security features.

Fortune’s report confirms the 90-day effective date and quotes Hochul: “No new parent should have to worry that predatory hackers are spying on their new family through their baby monitors.” State Senator Andrew Gounardes put it more plainly in the Governor’s release: baby monitors are meant to help parents watch a newborn, “not to let prying eyes into our homes.”

Three limits are worth knowing. The law covers new monitors sold in New York, so a monitor bought in 2024 is untouched. The public summaries do not list which specific security features count, so the details will depend on how the law is read and enforced. And monitors that use only a local radio link between camera and parent unit, with no internet connection, sit outside its stated scope.

Where “8 of 9 Monitors Failed” Comes From

The Rapid7 test the state cited matches a study by researcher Mark Stanislav that Rapid7 released in September 2015. The Register’s coverage at the time describes nine devices from eight vendors, with flaws including “hidden, hardcoded credentials, unencrypted video streaming, unencrypted web and mobile app functions.” Rapid7 reported ten vulnerabilities to vendors and to US-CERT in early July 2015, and many were still unpatched two months later.

Three of the flaws were rated critical. One let an attacker find an exposed camera and watch the live stream. Another gave access to every recorded clip for every registered camera across an entire service. A third let someone add their own email address to every camera on a service and then log in to watch any of them.

So read the headline number correctly. It is a 2015 snapshot of 2015 products, and some of those companies fixed their flaws or left the market. What it still shows is the pattern: the weak points were rarely the camera lens or the radio. They were passwords, encryption and the company’s cloud.

How Baby Monitors Actually Get Hacked

A Wi-Fi baby monitor is a small networked computer with a camera and microphone attached. Rapid7 noted that every device it tested ran “a fully-fledged operating system,” which means it can be attacked like any other computer. Video usually travels from the camera to your home router, out to the manufacturer’s servers, and then to the app on your phone. Each hop is a place where security can fail.

Default and reused passwords. Many devices ship with a factory username and password, and lists of those defaults circulate online. If you never changed it, anyone who reaches the device can log in. Reused passwords cause the same problem at the account level: if your monitor app shares a password with a shopping site that was breached, an attacker can simply try it. The FTC’s guidance on securing home cameras warns that “default choices and reused passwords can be easy for hackers to find online.”

Unencrypted streams and logins. If video or login details travel as plain readable data, anyone positioned on the network path can read them. In its 2013 case against TRENDnet, the FTC alleged the company sent login credentials “in clear, readable text over the Internet.”

Flawed cloud services. This is the one parents cannot fix. When the company’s own servers check permissions badly, an attacker can reach other people’s cameras without touching any home network at all. Two of Rapid7’s three critical flaws were of this kind.

Old firmware. Firmware is the software inside the device. Security holes are fixed through updates, and a monitor that never updates keeps every hole it shipped with.

Exposed remote-access features. Some devices run maintenance services, such as Telnet, that should never face the internet. Rapid7 flagged these as risky depending on network exposure.

The real-world cost is not hypothetical. According to the FTC’s 2013 TRENDnet settlement, a software flaw left camera feeds open to anyone with a camera’s internet address, and hackers posted links to nearly 700 live feeds that “displayed babies asleep in their cribs, young children playing, and adults going about their daily lives.” TRENDnet had marketed the cameras for uses including baby monitoring and called them “secure.”

How to Teach Your Kid About Connected-Camera Security

Older siblings are often the household’s real tech support. This is a chance to teach them how networks work using a device they care about: the one watching their baby brother or sister.

Ages 5–8: Draw the Picture’s Journey

On a sheet of paper, draw four boxes: the camera in the nursery, the router (the “Wi-Fi box”), a cloud for “the company’s computers,” and a phone. Draw arrows between them. Explain that the baby’s picture travels along those arrows. Then give your child four paper “locks” to tape on: a secret password on the phone, a lock on the Wi-Fi box, a scrambled-message lock on the arrows, and a lock on the company cloud. Ask which lock your family controls and which one only the company controls.

Ages 9–12: Be the Password Inspector

Let your child help you change the monitor’s password. Together, look up the device’s model and check whether a default password appears in its manual. Then build a strong passphrase from four random words and count the characters. Show them the app’s two-factor setting and let them turn it on. A child who chose the lock tends to remember why it matters.

Ages 13+: Audit the Home Network

With you beside them, have your teen log into the router’s admin page and list every connected device. Can they identify the monitor? Next, find its firmware version in the app and compare it with the newest version on the manufacturer’s support site. If your router supports a guest network, have them plan which devices belong on it. The FTC suggests putting cameras on a separate network so a hacked computer does not give easy access to them.

The question to ask: “If a stranger wanted to watch our monitor, which arrow or box on our map would be easiest to break into, and what would stop them?”

Baby Monitor Security Weak Points and Fixes

Weak point	How it is exploited	Evidence	What you can do
Default or reused password	Attacker logs in with a factory or leaked password	FTC camera guidance; Rapid7 found hardcoded credentials (2015)	Unique passphrase plus two-factor login on the app account
Unencrypted stream or login	Data read in transit	FTC TRENDnet complaint (2013); Rapid7 (2015)	Check the box or manual for encryption and turn it on
Flawed cloud service	Company servers grant access to the wrong people	Rapid7 critical flaws, all clips across a service (2015)	Choose makers with a public security-update record; you cannot patch it yourself
Outdated firmware	Known holes stay open	FTC camera guidance	Turn on automatic updates for camera and app
Shared or forgotten accounts	Old babysitter or ex-partner keeps access	FTC guidance on permissions	Review the list of users who can view
Remote viewing not needed	Internet path exists for no reason	Rapid7 exposed remote access (2015)	Turn remote viewing off, or use a local-only monitor

Your 10-Minute Baby Monitor Security Fix

Minutes 1 to 3: Replace the password and add two-factor login

Change the camera’s password and the app account’s password to something you have never used elsewhere. The FTC recommends two-factor authentication for any cloud account that stores video. Turn it on.

Minutes 4 to 6: Update everything

Open the monitor app, find the firmware or device-software section, and install any update. Then set the phone app to update automatically. The FTC also says to check the maker’s website and sign up for update notices.

Minutes 7 to 8: Check who can watch

Look for a “shared users” or “family members” list. Remove anyone who no longer needs access: a former nanny, grandparents’ old phones, a device you sold. If the app supports different permission levels, give viewers watch-only access.

Minutes 9 to 10: Decide about remote viewing

If you only use the monitor inside the house, consider turning remote internet viewing off. Fewer paths in means fewer ways in.

What not to do

Do not treat a new label as proof of safety. New York’s law sets a floor, and the details of which features satisfy it are not yet public. Do not throw away a monitor in a panic, either: a well-configured, updated device is far safer than an unconfigured new one.

Looking further ahead, the FCC’s voluntary U.S. Cyber Trust Mark lists baby monitors among eligible products and plans a QR code showing details such as the product’s support period. As of the FCC’s page, ioXt Alliance became lead administrator on April 13, 2026, and the FCC will announce when products can start carrying the label. The UK went further in 2024: under its PSTI product security regime, connectable products must have passwords that are unique per product or set by the user.

For more on connected devices in kids’ rooms, see our guides on smart toys and kids’ privacy and how a talking AI toy works from microphone to cloud.

What to Watch For Over the Next 3 Months

• Week 4: Open the monitor app again. Did a firmware update arrive? Is two-factor login still on? Check the shared-users list once more.
• Month 2 red flags: The camera moves or the light turns on when nobody is using it, you hear sounds from the speaker you did not trigger, you get login alerts you do not recognize, or the app shows sessions from unknown devices. Change passwords immediately and contact the maker.
• Month 3 self-check: Do you know whether your monitor still receives updates? If the maker has stopped supporting it, plan a replacement. Around late January 2027, check whether new monitors sold in New York carry the required label.

Frequently Asked Questions

Are non-Wi-Fi baby monitors safer?

They remove the internet path, which removes most of the attacks described here, including cloud flaws. A local-only monitor can still be overheard by nearby equipment if its radio link is not encrypted, but that requires someone physically close. The trade-off is that you cannot check in from work.

Does New York’s law affect monitors I already own?

No. The law covers new internet-connected monitors sold in New York starting 90 days after the October 28, 2026 signing. Existing monitors are not recalled or required to change. Your own setup steps are what protect a monitor you already have.

How do I know if my baby monitor has been hacked?

Warning signs include the camera panning on its own, the status light turning on unexpectedly, unfamiliar voices or sounds, login alerts you did not trigger, and unknown devices listed in the app. None proves a hack alone, but any of them is a reason to change passwords and update firmware at once.

Is the Rapid7 study still relevant if it is from 2015?

As a product ranking, no; those exact models are old. As a list of failure types, yes. Default passwords, missing encryption, cloud permission bugs and unpatched firmware remain the main ways connected cameras are compromised, which is why the FTC’s current guidance targets the same issues.

Should I put the monitor on a separate Wi-Fi network?

If your router offers a guest network, it is a reasonable step. The FTC suggests keeping cameras on a separate network from computers, so that if one device is compromised, the attacker does not get easy access to the others.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Office of the Governor of New York. (2026). “Governor Hochul Signs Nation-Leading Legislation to Protect Kids from AI Chatbots and Ensure Baby Monitors Are Secure.” governor.ny.gov. https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-protect-kids-ai-chatbots-and-ensure-baby
2. Fortune. (2026, October 28). “‘As New York’s mom Governor, I’m taking action’: Kathy Hochul bans bots from cozying up to kids, cracks down on baby monitors.” Fortune. https://fortune.com/2026/10/28/new-york-state-kathy-hochul-bans-ai-chatbots-romantic-baby-monitors/
3. The Register. (2015, September 3). “IoT baby monitors STILL revealing live streams of sleeping kids.” The Register (reporting Rapid7 research by Mark Stanislav). https://www.theregister.co.uk/2015/09/03/baby_monitors_insecure_internet_things/
4. Federal Trade Commission. (2013, updated). “How To Secure Your Home Security Cameras.” FTC Consumer Advice. https://consumer.ftc.gov/articles/how-secure-your-home-security-cameras
5. Federal Trade Commission. (2013). “Marketer of Internet-Connected Home Security Video Cameras Settles FTC Charges It Failed to Protect Consumers’ Privacy.” FTC. https://www.ftc.gov/news-events/news/press-releases/2013/09/marketer-internet-connected-home-security-video-cameras-settles-ftc-charges-it-failed-protect
6. Federal Communications Commission. (2026). “U.S. Cyber Trust Mark.” FCC. https://www.fcc.gov/CyberTrustMark
7. UK Department for Science, Innovation and Technology. (2023, updated). “The UK Product Security and Telecommunications Infrastructure (Product Security) regime.” GOV.UK. https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime