; (6) the minimum length of time during which a connected device will received security patches and software updates; (7) whether the connected device can be used without being connected to the internet; and (8) any other information as the Commission considers appropriate. (c) Regulations (1) In general Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations to implement this section. (2) Updates Not less frequently than once every 4 years after the date on which regulations are promulgated under paragraph (1), the Commission shall update those regulations as necessary. (d) Effective date Subsections (a) and (b) shall take effect on the date that is 180 days after the promulgation of regulations under subsection (c). 9. Prohibition on sale of connected devices for children and minors that fail to meet appropriate cybersecurity and data security standards (a) Prohibition Beginning 1 year after the date of enactment of this Act, no person may sell a connected device unless the connected device meets appropriate cybersecurity and data security standards established by the Commission. (b) Cybersecurity and data security standards (1) In general The Commission shall promulgate, under section 553 of title 5, United States Code, cybersecurity and data security standards described in subsection (a). (2) Considerations In promulgating cybersecurity and data security standards under paragraph (1), the Commission shall— (A) create cybersecurity and data security standards for different subsets of connected devices based on the varying degrees of— (i) cybersecurity and data security risk associated with each subset of connected device; (ii) sensitivity of information collected, stored, or transmitted by each subset of connected device; and (iii) functionality of each subset of connected device; (B) consider incorporating, to the extent practicable, existing cybersecurity and data security standards