Same Password Advice, Different State Rules. What Actually Applies to You
Password guidance sounds universal, but what your device ships with, what your employer must enforce, and whether your fingerprint can be used at all are all set locally.
Most people carry one mental model of password security, assembled from workplace training, a bank's sign-up page and whatever a relative said after getting locked out, and they assume it applies everywhere. It does not. The technical advice has converged, and the National Institute of Standards and Technology, which is responsible for the federal digital identity guidelines, moved the consensus toward length and screening against breached lists rather than symbol quotas. What has not converged is the layer underneath: what your devices ship with, what your employer is legally obliged to enforce, and whether your fingerprint may lawfully be used as a credential at all. Those three vary by state.
The assumption that guidance and obligation are the same thing
Guidance is a recommendation, and an obligation is something a regulator can act on. When a help desk tells you a fourteen-character minimum is required, it is worth knowing which of the two is speaking, because the answer changes who you appeal to when the rule is wrong. A recommendation can be argued with on the merits. An obligation attached to a license, a contract or a state statute cannot be, and asking about it is not pedantry: it tells you whether the person across the table is applying a considered policy or repeating a habit that nobody has revisited since roughly 2010.
Your devices already differ, and California is the reason
California's connected device law, signed in 2018 and effective January 1, 2020, required manufacturers to equip internet-connected devices sold in the state with a unique preprogrammed password, or else to force a new credential from the user before first access. Oregon enacted a comparable requirement that took effect the same day. Because manufacturers rarely build separate hardware for separate states, the practical effect spread nationally, which is why a camera or router bought recently is likelier to arrive with a label bearing a unique code than with the shared default that anyone could look up. Older equipment in your house predates all of it.
So the question for a security installer, an internet provider's technician or the person who set up your thermostat is narrow and answerable. Did this unit ship with a unique password, or a model-wide default, and was it changed at install. A good answer names the device and says where the credential is now stored. A poor answer is a reassurance about encryption, which addresses a different problem entirely, or an offer to write the password on the inside of the panel door.
Your employer's rule may come from a regulator you have never heard of
If you work in financial services in New York, the Department of Financial Services cybersecurity regulation, effective March 1, 2017 and amended in November 2023, sits behind the multifactor prompt you meet every morning. Insurance licensees in a large number of states operate under versions of the model data security law that the state insurance commissioners published in 2017 and legislatures adopted piecemeal thereafter, which is why two agencies doing identical work in neighboring states can have genuinely different login requirements. Health care organizations answer to a federal rule instead. Anyone handling card payments answers to a contract with the card networks rather than to a statute.
The useful question at a job interview, or at the point where an employer asks to enroll your personal phone in a login system, is which regime the policy comes from and who audits it. A strong answer names the source and the auditor. A weak one describes the tool the company bought, since the vendor is never the reason the rule exists, and a policy that cannot cite its own authority tends to be the kind that gets loosened quietly the moment it becomes inconvenient.
Biometrics are the sharpest regional split
Illinois passed its biometric privacy act in 2008, Texas followed with its own statute in 2009, and Washington added one in 2017. Illinois is the outlier that matters most, because it gives individuals a private right of action, which means an employer that scans fingerprints for timekeeping or login without written consent and a published retention schedule faces exposure that has no equivalent in most other states. The result is that a face or fingerprint unlock treated as routine in one office is handled with signed paperwork in another, and the paperwork is the sign that someone read the law carefully.
Ask what happens to the template, where it is stored, and how long after you leave it is destroyed. A clear answer describes on-device storage and a deletion timeline in months. A vague one talks about the vendor's security posture without ever saying who holds the data.
The rules you live under were written by particular legislatures in particular years, mostly in response to a specific failure, and knowing which ones reach you turns a vague sense of caution into three or four questions you can actually put to someone.