Key points
- Five US states have filed lawsuits against TP-Link alleging misleading security marketing and inadequate disclosure of Chinese ties.
- Federal restrictions on new foreign-produced routers apply, but previously authorised devices can generally still be sold and used.
- TP-Link denies the allegations, stating its US devices are manufactured in Vietnam and it operates as an independent US business.
Five US states have initiated legal action against TP-Link, accusing the networking equipment maker of misleading consumers regarding router security and failing to properly disclose its relationships with Chinese affiliates. The lawsuits, filed in October 2026, follow a similar complaint from Texas in February, creating a coordinated legal challenge across multiple jurisdictions.
The complaints from Florida, Iowa, Montana, and Nebraska were filed on 6 October 2026. These actions join the earlier suit from Texas, which was lodged on 17 February. The states allege that TP-Link Systems created false expectations about the protective capabilities of its routers, specifically questioning the efficacy of its HomeShield security service in light of known vulnerabilities and supply-chain concerns.
Context and Background
According to the Iowa Attorney General’s Office, the company’s marketing suggested its routers could shield users from unauthorised access despite existing security flaws. The legal complaints also scrutinise whether TP-Link adequately explained the implications of Chinese intelligence and cybersecurity laws for its customers. Importantly, these consumer protection claims do not assert that TP-Link deliberately granted foreign governments access to customer networks.
The litigation unfolds alongside federal restrictions on new router models produced by foreign entities. The Federal Communications Commission adopted these restrictions in March. However, the agency clarified that routers previously authorised for sale can generally continue to be sold and used by Americans, meaning the lawsuits do not prohibit current owners from keeping their existing TP-Link devices.
Who Is Affected
IT teams and consumers are advised to focus on identifying vulnerable devices and confirming firmware support status. The primary concern is understanding which equipment faces new purchasing restrictions versus what remains legally usable. The lawsuits raise questions about the validity of security claims made in advertising, but they do not immediately render existing hardware illegal or unsafe for continued operation under current FCC guidelines.
Our take on the response
TP-Link rejected the accusations in a statement issued on 6 October. Steve Kovsky, corporate affairs officer at TP-Link Systems, described the coordinated lawsuits as being built on false premises. The company maintains that it is an independent US business and that its devices for the US market are manufactured in Vietnam. TP-Link asserts that allegations of its products granting unauthorised network access to foreign governments are baseless.
That suggests the legal battle will focus on advertising standards and disclosure transparency rather than immediate product recalls or bans on existing inventory.
What to do and how to stay safe: TP-Link
- Inventory your network equipment to identify any TP-Link routers currently in use.
- Check the manufacturer’s website to confirm if your specific model still receives firmware updates and security patches.
- Review your router’s configuration settings to ensure default passwords have been changed and unnecessary remote management features are disabled.
- Monitor official communications from your state attorney general or the FCC for any updates on purchasing restrictions or safety advisories.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can I still use my TP-Link router after these lawsuits?
Yes, the lawsuits do not prohibit Americans from using routers they already own, and previously authorised models can generally still be sold and used.
What are the states accusing TP-Link of?
The states accuse TP-Link of misleading consumers about router security and failing to adequately disclose its relationships with Chinese affiliates.
Does this mean TP-Link routers are being banned?
No, the FCC restrictions apply to new foreign-produced models, but previously authorised routers can generally still be sold and used.