Text settings Story text Size Small Standard Large Width * Standard Wide Links Standard Orange * Subscribers only Learn more Minimize to nav TP-Link is facing more legal troubles in the US as Florida and three other states filed lawsuits alleging that it lied to consumers about its connections to China and the risks of its routers being exploited by Chinese state hackers. The lawsuits were filed yesterday, about six months after the Federal Communications Commission announced a sweeping ban on consumer-grade routers produced wholly or partly outside of the US. Numerous router makers have obtained exemptions to the ban, but the Trump administration so far has not granted one to TP-Link. Router makers that received exemptions include Netgear, Asus, Adtran, Amazon and its Eero subsidiary, Calix, Nokia, SpaceX’s Starlink division, and others.
For now, TP-Link is unable to sell its latest Wi-Fi 8 routers in the US, though models approved before the ban can still be sold. The state lawsuits claim that TP-Link misled US consumers by telling them its routers are safe. The suits allege that TP-Link committed unfair and deceptive trade acts in violation of the states’ consumer protection laws. “Chinese state-sponsored hackers exploited TP-Link routers sitting in American living rooms,” Florida Attorney General James Uthmeier said while announcing his lawsuit filed in a Florida county court. Uthmeier said Florida “will not allow families to be misled into handing their personal data to the Chinese Communist Party.
We are seeking an injunction, restitution for Florida consumers, and [financial] penalties under Florida law.” TP-Link criticizes coordinated lawsuits TP-Link was founded in China but moved its headquarters to California in October 2024 amid investigations into high-profile attacks linked to the Chinese government, including a botnet composed mostly of TP-Link routers. The Florida lawsuit accuses TP-Link of “lying about the safety of its routers and its ties to the CCP,” Uthmeier said. Uthmeier was one of four Republican state attorneys general to sue TP-Link yesterday. Lawsuits were also filed against TP-Link by Montana, Iowa, and Nebraska. “The coordinated lawsuits are built on false premises,” said Steve Kovsky, TP-Link’s corporate affairs officer. “They do nothing to advance national security while unfairly penalizing an industry-leading US company.” TP-Link said that for the past few months it has “provided state regulators with clear, verifiable documentation demonstrating two fundamental facts: TP-Link Systems devices sold in the US are manufactured in Vietnam and TP-Link Systems is an independent, US company that is not owned or controlled by any foreign government.” The four state lawsuits use virtually identical language, starting with this statement explaining the function of routers in simplified fashion: A router serves as a consumer’s virtual mouth and ears to the Internet.
What the consumer says to the Internet comes out of the router’s mouth, and what the Internet says back goes through the router’s ears. If compromised, it can whisper lies in both directions, impersonating the consumer and creating a foothold in the consumer’s own home for state-sponsored cyberattacks. Florida AG says TP-Link defense is “fiction” Uthmeier said TP-Link’s claim of splitting from China and building products in Vietnam is “fiction” and that “research and manufacturing remain rooted in China.” The Florida lawsuit said that “final assembly of components sourced from or through China in Vietnam does not cure the company’s deceptive statements and material omissions regarding its Chinese dependence and affiliations.” The lawsuit cites an April 2025 Bloomberg article that said, “TP-Link confirmed that, aside from components bought in Vietnam that account for 0.5 percent of the total value of inputs to the plant there, all other components are imported from China.” The lawsuits note that even before the FCC’s general router ban, US government officials “weighed banning the sale of TP-Link routers in the United States as an ‘unacceptable risk’ to national security.” They also point to US government statements about Russian intelligence agency GRU exploiting vulnerabilities in TP-Link routers, and TP-Link’s reported use of a Chinese construction contractor to expand the Vietnam plant. “TP-Link does not disclose to consumers that it has ongoing ties to a Chinese military contractor, and that its products are vulnerable to exploitation by Russian intelligence and state-affiliated Chinese hackers,” Nebraska Attorney General Mike Hilgers’ office said. TP-Link’s response to the state lawsuits said the company “complies with US privacy and data protection laws.
We perform comprehensive security testing and rely on trusted third-party security labs for additional scrutiny to ensure our products meet the highest security standards and are recognized as among the most secure on the market… We do not, and will not, share customer network data with foreign governments or unauthorized third parties.” Router ban weighs on TP-Link Meanwhile, there has been little news on TP-Link’s attempt to secure an FCC exemption from the foreign router ban. In April, TP-Link met with officials in FCC Chairman Brendan Carr’s office. The company told Carr’s staff that it “is investing hundreds of millions of dollars to bring manufacturing and research and development of its consumer routers to the US, in alignment with the FCC’s policy goals,” and “already employs over 550 employees in the United States, including hundreds of engineers working at its California headquarters.” The FCC process requires each router maker to obtain a determination from the Department of Defense or Department of Homeland Security that its devices do not pose national security risks. Router makers must also submit a “justification on why any foreign manufactured router is not currently manufactured in the United States, including why these foreign sources were selected and whether alternatives exist,” and a “detailed, time-bound plan to establish or expand manufacturing in the United States.” We asked TP-Link today if there is any update on its application to the FCC.
The company responded that its “existing products remain available for sale in the US. For new products, we’re going through the FCC’s standard approval process like other router makers.” TP-Link separately told PCMag last week that “we’re particularly excited to bring our next-gen Wi-Fi 8 portfolio to American consumers” and are “working with regulators to bring these products to users worldwide, so keep an eye on our website for more updates.” US-based broadband providers are also seeking changes to the router ban so they can more easily upgrade consumer equipment. Cable industry lobby group NCTA petitioned the FCC for a waiver letting Internet providers swap in different components because of supply chain shortages, saying it is needed “to prevent disruptions in the availability of broadband for NCTA members’ customers.” Jon Brodkin Senior IT Reporter Jon Brodkin Senior IT Reporter 12 Comments
Leave a Reply