Florida, Iowa, Nebraska and Montana accuse TP-Link of overstating the security of its routers and obscuring manufacturing, privacy and operational links to China. The company denies the allegations and says it will contest the lawsuits.
Florida, Iowa, Nebraska and Montana have launched co-ordinated legal action against TP-Link Systems, accusing the router maker of overstating the security of its products and of misleading consumers about its operational separation from China. The complaints, filed under state consumer protection laws, say the company marketed its home and small-office networking equipment as safe while failing to disclose known weaknesses, supply-chain dependencies and privacy risks. TP-Link has rejected the allegations and said it will fight them in court.
The case comes at a sensitive moment for a company that, according to the states’ filings and congressional testimony cited in the reporting, has a large share of the US retail market for Wi-Fi systems and consumer routers. The legal pressure also follows earlier federal scrutiny of TP-Link, with reporting in Tom’s Hardware and Ars Technica noting investigations by the Commerce, Defence and Justice departments, as well as separate questions around import restrictions and possible exemptions. That wider backdrop has turned a consumer-router dispute into a broader argument about cybersecurity, trade and national security.
Florida’s 59-page complaint is the most detailed of the four, according to the reporting, and alleges that TP-Link’s claims about relocating production to Vietnam obscured the continued role of China in manufacturing and sourcing. The state says only a tiny fraction of the components used at the Vietnamese factory are bought locally by value, with the rest imported from or through China. Nebraska’s filing also points to a contractor with links to the Chinese military, while the complaints argue that TP-Link’s public messaging about independence from Chinese operations does not match the reality described in the filings.
The security allegations are equally pointed. Florida says TP-Link’s marketing concealed vulnerabilities in specific router models, including the TL-WR940N, Archer C7 versions 2 and 3, and Archer AX21 versions 1 and 1.20, which it claims were left without adequate security support or automatic update protection. Reporting from TrestleWire says the Florida suit also names several Common Vulnerabilities and Exposures, while the complaints cite exploitation of TP-Link hardware by Chinese and Russian state-backed hackers. The states argue that those incidents show the gap between the company’s assurances and the risks faced by customers.
The privacy claims focus on TP-Link’s Tether, Deco, Tapo and Kasa Smart apps. Florida alleges that they collect information such as email addresses, precise location data and mobile device identifiers, and that they can share information with affiliates without fully explaining the legal exposure created by possible access from jurisdictions subject to Chinese intelligence laws. The complaints do not claim that customer data has been handed to China, but rather that the company failed to disclose the risk clearly enough.
Florida is seeking an injunction, disgorgement of profits and civil penalties of up to $10,000 per willful violation, rising to $15,000 in certain cases involving protected consumers. Montana and Nebraska are also seeking injunctive relief and penalties. TP-Link, through corporate affairs officer Steve Kovsky, has said it already supplied regulators with documentation showing that US-market devices are made in Vietnam and that it operates as an independent American company. The company says it complies with US privacy laws, uses independent laboratories for security testing and does not share customer network data with foreign governments or unauthorised third parties. The lawsuits follow a separate action by Texas Attorney General Ken Paxton over similar allegations.
For router owners, the practical advice remains unchanged: check the exact model and hardware revision, confirm whether security support is still active, install updates promptly and enable automatic updates where available. Users should also change default administrator passwords, switch off remote management unless it is needed and review settings regularly for unfamiliar changes.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
