More developments have arisen in the U.S. campaign for internet device security as five states are now in the process of suing router maker TP-Link. Texas was the first to file suit in February while Florida, Iowa, Montana and Nebraska joined the fray on October 6, 2026. In broad strokes, the suits allege the company misled buyers about how secure its routers were in addition to how separate the company truly was from China.
TP-Link Systems has already denied the claims and says it will fight them in court.
Since these suits were brought forward, 21 state attorneys general have also sent a letter to the Federal Communications Commission (FCC) about TP-Link’s effort to win approval for new router models in the U.S.
The lawsuits follow a long line of U.S. action against TP-Link starting in December 2024, when the U.S. federal government first floated the idea of banning TP-Link products outright.
To note: the target of this lawsuit and all scrutiny up until this point (TP-Link Systems) is based in Irvine, California and was separated from TP-Link Technologies (a Chinese company that the suits do not name as a defendant) during a restructuring in 2024. The TP-Link that this article will primarily refer to is TP-Link Systems unless otherwise specified.
What the states allege against TP-Link
While language differs across each state, the main allegations remain largely consistent. First, the states allege that TP-Link advertised security it did not deliver, quoting TP-Link’s web page for HomeShield, saying it “covers all security scenarios.” The complaints allege that this does not apply for products that have either reached the end of life or have been hacked.
The second claim is that TP-Link overstated its split from China. The complaints quote the company as saying that the restructuring left it with “entirely different ownership, management, and operations” from those of TP-Link Technologies,” and note that in June, the U.S. Department of War (DOW)(formerly the Department of Defense) listed TP-Link Technologies as a Chinese military company (which, again, is not named as a defendant in the suit).
The third claim is that TP-Link’s privacy policies omit the fact that its Tether, Tapo, Deco and Kasa Smart apps collect email addresses, location and phone identifiers, and that, under a 2017 Chinese intelligence law, that practice could expose the data to Chinese intelligence agencies. These suits do not allege that the Chinese government obtained customer data through TP-Link; they only describe it as a risk due to Chinese law.
In their letter to the FCC, the state attorneys general echoed these same concerns, while also raising doubt over TP-Link’s statement that it is now building its routers in Vietnam in compliance with the recent FCC router ruling.
Attacks cited in the states’ lawsuits
Alongside the allegations, the lawsuit points to real attacks in which hackers took over TP-Link routers:
- A Microsoft report in 2024 stated a hacking group believed to be China-based built a network of hacked small-office and home routers to initiate coordinated attacks. Microsoft noted TP-Link routers “make up most of this network,” counting an average of 8,000 hacked devices active at any time, though other devices were found on the network.
- In 2025, a single testimonial was given that Chinese state hackers used TP-Link routers in the Volt Typhoon and Flax Typhoon campaigns. Rob Joyce, a former National Security Agency cybersecurity director, told a House committee that TP-Link routers “were among the various brands” exploited, though no evidence has been given regarding this claim.
- In April 2026, the FBI stated Russian military intelligence hackers had compromised TP-Link routers through a flaw tracked as CVE-2023-50224. In May, following this report, TP-Link said that, with one exception, the products affected by that flaw had reached end of life.
TP-Link’s situation with the FCC
Back in March 2026, the FCC barred new foreign-made consumer routers from being sold in the United States. The only exception is when a router wins a “Conditional Approval,” which is ultimately decided by the Department of Homeland Security (DHS) or DOW.
The rule covers routers made in any foreign country and applies by place of production, not by company. Routers authorized before the rule can continue to receive software and firmware updates “that mitigate harm to U.S. consumers” until at least March 1, 2027, under an FCC waiver.
As of this ruling, TP-Link has declared that its existing routers “remain fully authorized” while it was pursuing Conditional Approval for new products.
Prior to this, TP-Link had been under investigation from the U.S. government, which had floated the idea of banning TP-Link products outright. No further action was ever taken by the U.S. government, though TP-Link did join the Common Vulnerability and Exposures (CVE) program as a Numbering Authority (CNA) to “better respond to security threats and ensure greater transparency.” This designation would allow TP-Link to publicly disclose and assign vulnerabilities as they were discovered.
TP-Link’s Response
“The coordinated lawsuits are built on false premises. They do nothing to advance national security while unfairly penalizing an industry-leading U.S. company,” Steve Kovsky, the company’s corporate affairs officer, said in a statement issued the day the suits were filed.
“We do not, and will not, share customer network data with foreign governments or unauthorized third parties,” it said.
TP-Link also disputed the 2025 testimony the same day it was given, saying those campaigns “have no discernible preference for using TP-Link routers as a vector.”
Why integrators should take note
This development is part of an ongoing period of heightened scrutiny regarding the security of internet-connected devices, though the targets of scrutiny and associated policy pushes have only added confusion in certain areas, while obscuring the larger issues at play.
TP-Link has been at the center of this public scrutiny for over two years at this point with much of the criticism tied to the seeming insecurity of its products as well as supposed ties to China. What’s noteworthy regarding this is that, in many ways, TP-Link, now, is doing more work to promote transparency of its vulnerabilities than most companies.
As a CNA, TP-Link publicly discloses and assigns vulnerabilities to its products as they are discovered, which most IoT or internet device manufacturers found in the smart home do not need to do. In the CEDIA channel, Crestron, Samsung, LG, Google and Amazon are the only major brands that do this on a regular basis.
Additionally, it can be said this continued focus on routers in particular misses the plot, as it’s not just routers that are uniquely vulnerable to these types of attacks. In a list of the most used vectors to carry out cyberattacks, smart plugs, surveillance systems, smart TVs and TV set top boxes are among the most targeted devices. Smart TVs and TV set top boxes are notorious for being hacked and co-opted into botnets.
While applying policy on a product level is ultimately a better approach for the average consumer, integrators would do better to learn cybersecurity best practices for home networks because of these developments. The truth is that while TP-Link routers continue to make headlines, it is not just one brand nor is it just one product hackers are going after. They are opportunists, and integrators need to be building systems that limit those opportunities, no matter what products or brands are being used.
