Five States Sue TP-Link Over Router Security Claims and Chinese Ties

Key points

• Florida, Iowa, Montana, and Nebraska joined Texas in suing TP-Link Systems in October 2026, alleging the company deceived consumers regarding router security and its ties to China.
• The lawsuits claim TP-Link’s HomeShield service falsely promised comprehensive security coverage, even as some models reached end-of-life without updates and others were exploited by hackers.
• Complaints argue that despite a 2024 restructuring, TP-Link remains heavily dependent on Chinese components, with only 0.5% of parts sourced in Vietnam, and that its privacy policies fail to disclose risks under Chinese intelligence laws.
• TP-Link denies the allegations, stating its U.S. devices are made in Vietnam and that it is an independent company not controlled by any foreign government, while noting it is pursuing FCC approval for new products.
• The FCC has barred new foreign-made routers from sale in the U.S. since March 2026, and TP-Link has not yet received an exemption, preventing the sale of its latest Wi-Fi 8 routers.

Background

In March 2026, the FCC implemented a ban on consumer-grade routers produced outside the U.S., requiring foreign manufacturers to obtain conditional approval from the Department of Defense or Homeland Security. While competitors like Netgear and Asus received exemptions, TP-Link has not, leaving its new products unsellable in the U.S. This legal action follows a 2024 restructuring where TP-Link Systems separated from TP-Link Technologies, a Chinese entity listed by the U.S. Department of Defense as a military company. Previous coverage noted that TP-Link moved its headquarters to California in 2024 amid investigations into botnets linked to Chinese state hackers.

How outlets are covering it

The four new state lawsuits, along with Texas’s earlier suit, present a unified front in alleging deceptive trade practices, though Iowa’s complaint is notably stronger, claiming TP-Link firmware gives the Chinese government access to data. Florida’s Attorney General called TP-Link’s claims of separation from China a 'fiction,' while Nebraska highlighted ongoing ties to a Chinese military contractor. TP-Link, through corporate affairs officer Steve Kovsky, dismissed the suits as 'false premises' that unfairly penalize a U.S. company, emphasizing that it has provided regulators with documentation proving its independence and Vietnamese manufacturing. Ars Technica and Gizmodo highlighted the regulatory deadlock, noting that while TP-Link claims to be pursuing standard FCC approval, it has not secured the necessary exemptions to sell new routers, unlike its competitors. The Hacker News provided detailed technical context on the five critical flaws in ISP-supplied devices, noting that while fixes exist, they are delivered through ISPs and not directly to consumers.

Why it matters

This legal and regulatory standoff highlights the growing tension between U.S. consumer protection laws and national security concerns regarding Chinese technology. The inability of TP-Link to sell new routers in the U.S. due to the FCC ban, combined with the state lawsuits, could significantly impact its market share and force a shift in how consumers and ISPs source networking equipment. The case also sets a precedent for how U.S. regulators and states will handle claims of deceptive security practices by foreign-linked companies, potentially influencing future policies on data privacy and supply chain transparency.

What to watch

TP-Link is expected to fight the lawsuits in court, as stated by the company. The FCC will continue to review TP-Link’s application for conditional approval for new router models, a process that requires determinations from the Department of Defense or Homeland Security. Consumers with existing TP-Link routers should check for firmware updates through their ISPs, as fixes for the five critical flaws have been released but may not be publicly available for direct download. The outcome of the state lawsuits could lead to injunctions, restitution, or financial penalties for TP-Link, depending on the court's findings.