Smart device update periods: what the FTC found, and the UK and FCC rules on disclosing them

Smart cameras, door locks, speakers and other connected devices rely on software, and once the updates stop, a device can lose features or stop working. Federal Trade Commission staff put it plainly in a November 2024 paper: without updates, a connected product “may lose its ‘smart’ functionality, become insecure, or completely cease to operate.” Their study found that most makers' product pages did not say how long the updates would last.

What FTC staff found

Staff from the FTC's East Central Regional Office looked at 184 connected products, including smartphones, home appliances, health monitors and fitness devices. On the maker's product page, 163 products, or 88.6%, had no support duration or end date; 21, or 11.4%, did. The FTC's press release gave the first figure as 161, but the paper's own numbers, 163 and 21, add up to the 184 products studied.

Where support periods were given, they were not in a consistent place. Most were in the tech specs or product information, others in an FAQ or a small-print footnote, and some used vague phrases such as “lifetime technical support,” “as long as your device is fully operational” and “continuous software updates.” Staff also had trouble finding products' release dates, which bear on how long updates can be expected when support is counted from release.

Searching did not fill the gap. Basic Google searches found no support information for 124 of the devices, or 67.4%. Where a search did turn something up, it did not always match the product page: two products promised “lifetime” support on their product pages, while the makers' own support pages gave an end date in 2028 for one and said security updates for the other had stopped in 2021. In one case, a Google AI Overviews answer gave “3-6 months” of software support; the maker's page used that figure for the device's battery life. The paper adds that its findings are consistent with a Consumer Reports study of 21 major appliance brands, in which only three said how long they guarantee software and app updates.

What US law says, according to FTC staff

The paper says manufacturers' failure to disclose their support commitments “warrants further consideration by policymakers and law enforcers.” Depending on the facts, staff wrote, not telling buyers how long updates will last for products sold with written warranties may violate the Magnuson-Moss Warranty Act, under which, the paper notes, written warranties on consumer products costing more than $15 must be available for buyers to review before purchase. And if a maker says or implies how long a product will work, failing to disclose how long it will provide the necessary updates may be deceptive under the FTC Act.

Samuel Levine, Director of the FTC's Bureau of Consumer Protection when the paper was released, said: “When shopping for smart devices, consumers should ask questions and consider how long their product will last.”

The voluntary US label, and the UK rule

The FCC's U.S. Cyber Trust Mark, a voluntary cybersecurity label for wireless consumer smart devices, builds a support date into its public registry. Under rules effective August 29, 2024, with registry duties applying from September 9, 2024, a company allowed to use the label must publish the date until which it promises to find critical vulnerabilities and issue fixes, which the rule calls the minimum support period, or else a statement that the device is unsupported. The same registry entry must say whether security updates install automatically and, if not, how to get them, and how to change the default password. The FCC decided against an expiration date on the label itself but found disclosure of the support period and its end date “appropriate,” and said makers will be able to extend the date in the registry. Our Matter guide covers where the program's administration stands.

The UK made disclosure mandatory. Since April 29, 2024, manufacturers of UK consumer connectable products have had to publish the minimum length of time they will provide security updates, with an end date, “in a clear accessible and transparent manner,” in English and free of charge, according to UK government guidance. The same regime requires passwords that are unique to each product or set by the user, and a published way to report security issues. The Office for Product Safety and Standards enforces it.