Market entry

IoT certification requirements in United States

Radio approval, safety listing, children's data and state privacy rules all apply to connected products sold in the United States.

10 certification records apply · last reviewed 2026-10-14

Certifications that apply

FCC

FCC equipment authorization

U.S. equipment authorization rules for radio transmitters, intentional radiators and certain electronic products placed on the American market.

Open the certification page →
UL / ETL

North American safety listing

Third-party product safety certification for the North American market, issued by a Nationally Recognized Testing Laboratory.

Open the certification page →
CSA

CSA Group certification

Canadian safety certification that is also accepted as an NRTL listing for the United States market.

Open the certification page →
Prop 65

California Proposition 65

California law that requires a clear warning when a product exposes users to chemicals on the state list above safe harbour levels.

Open the certification page →
CCPA / CPRA

California consumer privacy rights

California privacy law giving consumers rights over personal information, including the right to know, delete, correct and opt out of sale or sharing.

Open the certification page →
COPPA

Children’s online privacy (COPPA)

US rule that restricts collecting personal information from children under thirteen without verifiable parental consent.

Open the certification page →
Energy Star

Energy Star efficiency programme

Voluntary efficiency labelling for products that meet Energy Star specifications in an eligible category.

Open the certification page →
NIST 8259

NIST IR 8259 IoT cybersecurity baseline

A voluntary baseline of six foundational cybersecurity activities for connected devices, used widely in procurement and product planning.

Open the certification page →
SOC 2

SOC 2 trust services report

An independent attestation report on controls covering security and, optionally, availability, processing integrity, confidentiality and privacy.

Open the certification page →
US Cyber Trust Mark

US Cyber Trust Mark

A voluntary US labelling programme for consumer IoT cybersecurity, developed from the FCC cyber labelling initiative.

Open the certification page →

What to prepare

  • Identify the correct authorization route for each radio
  • Test to the applicable FCC rule part at an accredited lab
  • Keep the FCC ID label and user manual statements accurate
  • Complete the supplier’s declaration or certification filing
  • List the module grant conditions when using a pre-certified module
  • Identify the correct UL or CSA standard for the product
  • Submit samples and critical components to the NRTL
  • Accept the factory inspection programme for listed products

Frequently asked questions

Which certifications are mandatory to sell an IoT device in United States?

FCC (FCC equipment authorization), UL / ETL (North American safety listing), Prop 65 (California Proposition 65), CCPA / CPRA (California consumer privacy rights), COPPA (Children’s online privacy (COPPA)). Each record lists the issuing body, what it covers and what it does not cover.

Are voluntary marks needed as well?

Energy Star - Energy Star efficiency programme; NIST 8259 - NIST IR 8259 IoT cybersecurity baseline; SOC 2 - SOC 2 trust services report; US Cyber Trust Mark - US Cyber Trust Mark

Where can I read the official requirement?

Every certification record links to the issuing body or the regulation text. Start from this page, open the record and follow its source links.

Does a certificate for a module cover the finished product?

No. A module certificate covers the module; the finished device usually needs its own approval or a documented module grant reference. Confirm with the issuing body or your test laboratory.