No, your TP-Link router is not banned. No state has ordered you to unplug it, and no federal agency has told Americans to stop using routers they already own. But five states are now suing TP-Link Systems over what they say the company told buyers about security and about its ties to China — and buried inside those lawsuits is a question every router owner should actually answer: is your specific model still getting security updates?
That question matters more than the courtroom drama, because it is the one thing you can check tonight. Here is what the five lawsuits allege, what TP-Link says in response, what federal regulators have and have not done, and a keep-or-replace checklist built around your model’s support status rather than headlines.
The lawsuits, in order
Texas filed first, in February 2026. Then, on October 6, 2026, four more states filed separate consumer-protection suits on the same day: Florida, Iowa, Montana, and Nebraska. That brings the total to five states suing the Irvine, California-based company.
The attorneys general behind the October filings are James Uthmeier of Florida, Brenna Bird of Iowa, Mike Hilgers of Nebraska, and Austin Knudsen of Montana. Each suit relies on its own state’s consumer-protection law and seeks injunctions, civil penalties, and restitution — Montana’s filing, for example, seeks an injunction plus $10,000 per violation, while Nebraska seeks civil penalties, fees, and other relief.
The day after the four suits landed, 21 state attorneys general wrote to the Federal Communications Commission about TP-Link’s bid for approval of new router models in the United States. That letter is a signal, not an enforcement action — it does not ban anything — but it shows the scrutiny is widening beyond the courtroom. TechRepublic’s explainer answers the “are routers banned” question the same way — no — while CyberInsider’s coverage details the penalties each state is seeking.
What the states actually allege
Strip away the politics and the five complaints make two core claims.
First, that TP-Link overstated how secure its routers are. The states contrast TP-Link’s promotion of its HomeShield protection service — which the company describes as covering “all security scenarios” — with routers that were hacked in real-world attacks and models that stopped receiving updates. Florida’s complaint names older models including the TL-WR940N, Archer C7, and Archer AX21, some of which no longer receive security updates or do not support automatic firmware updates. According to the complaints, two Archer AX21 versions reached end of life in May 2024.
The complaints also point to real incidents. Routers have been compromised in campaigns involving state-backed hackers, including a botnet used for password-spray attacks and Russian military intelligence hackers exploiting a known flaw (CVE-2023-50224) to alter DNS settings and collect credentials. Routers from other vendors have been targeted too, which is worth remembering before treating this as a one-brand problem.
Second, that TP-Link overstated its separation from China. TP-Link Systems separated from TP-Link Technologies, a Chinese company, in a 2024 restructuring. The states say the separation was smaller than advertised. They point to a reported workforce of about 11,000 people in China against roughly 305 in the United States, and a supply chain in which nearly all component value for the company’s Vietnam-assembled routers comes from or through China. The Department of Defense designated TP-Link Technologies a Chinese military company in June 2026.
One careful distinction matters here, and it is the most misreported part of the story: the complaints do not allege that the Chinese government actually accessed customer data through TP-Link routers. The claims are risk-based — that buyers were not told about risks that Chinese intelligence law could create. Iowa’s announcement frames it more strongly than the others, saying TP-Link firmware provides the Chinese government with access to Iowans’ devices and information, but even there the access is described as a possibility, not as something shown to have happened.
Nebraska’s complaint adds a market-share figure that explains why this fight is so big: TP-Link holds at least 60% of the US retail market for Wi-Fi systems and small-office routers, according to former National Security Agency cybersecurity director Rob Joyce’s March 2025 testimony before Congress. When one vendor’s firmware policy covers that much of the installed base, its support decisions become a national story.
What TP-Link says
TP-Link denies the claims and says it will fight them in court. In a statement issued the same day the four suits were filed, the company called the coordinated lawsuits “built on false premises.” Corporate affairs officer Steve Kovsky said the company had already provided regulators with documentation showing that devices sold in the US are manufactured in Vietnam and that it operates as an independent US company.
The company also says it does not, and will not, share customer network data with foreign governments or unauthorized third parties, that it complies with US privacy laws, performs comprehensive security testing, uses independent security laboratories, and helps customers address vulnerabilities. Announcing the Florida suit, Attorney General Uthmeier put the state’s case bluntly: “Today, we sued TP-Link for lying about the safety of its routers and its ties to the CCP,” and he described “Chinese state-sponsored hackers exploited TP-Link routers sitting in American living rooms.” Both sides have now stated their positions in public. The allegations are unproven, and a court will decide them — which is exactly why your decision should rest on facts you can verify yourself, not on either side’s press release.
What federal regulators have actually done
This is where most social-media versions of the story go wrong. Here is the federal timeline, separated from the state lawsuits:
- December 2024: the federal government first floated the idea of banning TP-Link products outright.
- February 2026: a proposed Commerce Department sales ban was put on hold.
- March 2026: the FCC adopted a rule barring approval of new foreign-made consumer router models without a Conditional Approval. The rule covers routers produced in any foreign country — not just Chinese brands — which in practice includes most routers sold in the US, since design, manufacturing, or assembly abroad is the norm.
- May 8, 2026: the FCC extended a waiver (Order DA 26-454) letting routers approved before the rule keep receiving software and security updates until at least January 1, 2029.
The net effect for your living room: previously authorized models remain legal to buy, sell, and use. The FCC rule restricts approval of new models, not the routers already in homes. And the update waiver means the FCC is not cutting off security patches for existing models — whether your model actually gets patches still depends on TP-Link’s own support policy, which brings us to the part that matters.
Separately, researchers disclosed five high-impact flaws in TP-Link devices supplied by internet providers (the Aginet line: HB, HX, HC, EB, EC, EX, XC, XX, and VX series). Those flaws could let an unauthenticated attacker on the same network compromise a device and run commands as root. Fixes exist, but updates for ISP-customized devices are delivered through the ISP, not by direct download — so if your router came from your internet provider, your provider is the one who has to push the patch. Neither the lawsuits nor the flaw advisories link those five flaws to the state-backed attacks or to the China allegations, and conflating them would be a mistake.
The keep-or-replace checklist
Forget the brand for a minute. The rule that security professionals keep repeating — and that the lawsuits accidentally highlight — is simple: replace any router, from any brand, once its maker stops sending security updates for your model. The headlines are about brands. The risk is a router that stopped getting fixes.
Run through this checklist for each router in your home or office:
1. Identify the exact model and hardware revision. The label on the bottom of the router lists both. The revision matters: two Archer AX21 versions reached end of life in May 2024 while other versions of the same model name may still be supported. Searching by model name alone can give you the wrong answer.
2. Check the support page and the last firmware date. Look up your exact model on TP-Link’s support site and note the date of the latest firmware release. If there has been no release in over a year, or the page lists the model as end of life, that is your answer regardless of what any lawsuit says. If your router came from your ISP, check with the provider instead — Aginet firmware comes through them.
3. Turn on automatic updates if your model supports them. Some of the models named in the complaints do not support automatic firmware updates at all. If yours is one of them, you are relying on yourself to check manually, which almost nobody does consistently. That alone is a reason to weigh replacement.
4. Change the admin password and disable remote administration. Default credentials are still one of the most common ways routers get compromised. Log into the admin panel, set a strong unique password, and turn off remote management unless you genuinely use it. If the admin panel is reachable from the internet, that is a problem to fix today, not at your next upgrade.
5. Check your DNS settings. Unexpected changes to a router’s DNS settings are a known sign of compromise — it is exactly what the CVE-2023-50224 exploitation did. If your DNS points somewhere you did not set, treat the device as compromised: reset it, update it, and change every password that crossed it.
6. Segment what you can. Put guest devices and smart-home gadgets on a separate network or VLAN from the computers that hold your work and banking. Segmentation does not fix an unpatched router, but it shrinks what an attacker can reach through it.
Attorney General Hilgers gave Nebraskans the same advice in plain terms: check whether your router is “past the time where it’s being supported, where there’s not new updates, or they can’t get new firmware,” install any available updates, and replace default passwords. That advice holds up regardless of how the lawsuits end.
If you do replace it, what to buy
You do not need to pay a premium for a “secure” brand, and you do not need to avoid any particular country of manufacture — the FCC’s own rule covers foreign production broadly, and most routers are made abroad. What actually protects you is boring and checkable:
- A current Wi-Fi generation (Wi-Fi 6 or Wi-Fi 7) from a vendor with a published support lifecycle, so you can see how long updates are promised before you buy.
- Automatic firmware updates that are on by default, not buried three menus deep.
- A vendor that still publishes firmware for models at least three to four years old — check the support page for a model from 2022 and see whether it got an update this year. That tells you more than any marketing claim.
- Separate guest-network and IoT-network options if you run smart-home gear.
- No ISP lock-in unless you are happy waiting on your provider for patches. A router you own outright gets updates from the vendor directly.
For a small business, the same logic applies at a slightly bigger scale, and it connects to the site-security basics we covered in our WordPress site-owner security checklist — the router is the front door of the network, and an unpatched one undermines everything behind it, including the website you host or manage from that office. If you have ever dealt with a breach notification, our breach victim checklist covers the same discipline on the personal-data side: find out what was exposed, change what was crossed, and document it.
What to watch next
Three things will move this story, and none of them is a court verdict arriving soon:
- More states joining. Four more states filed on a single day, and the pattern of coordinated filings suggests others may follow. Each new filing adds pressure but changes nothing about your router tonight.
- The FCC’s decision on TP-Link’s Conditional Approval applications. The 21-attorney-general letter asked the FCC to address the China-ties question before ruling. If new models are denied approval, TP-Link’s US lineup will age in place — which makes the support status of existing models matter even more.
- TP-Link’s support behavior. The most telling signal will not be a press release but a firmware page: whether older models keep getting patches, and whether the company publishes clearer end-of-life dates. Watch the support page, not the headlines.
Until then, the sensible position is the unglamorous one: your router is legal, it is probably fine if it is still supported and updated, and it should be replaced the day it stops being either. Lawsuits decide who misled whom. Firmware dates decide whether your network is safe.
Frequently Asked Questions
Is TP-Link banned in the United States?
No. As of October 2026 you can legally own, use, and buy TP-Link routers that the FCC approved before its March 2026 rule. The FCC rule blocks approval of new foreign-made models without a Conditional Approval; it does not ban existing devices.
Will my TP-Link router stop getting updates?
Not because of the FCC. A May 2026 FCC waiver lets routers approved before the rule keep receiving software and security updates until at least January 1, 2029. Whether your model actually gets updates depends on TP-Link’s support policy and whether your model is still supported.
Which TP-Link models lost support?
Florida’s complaint names older models including the TL-WR940N, Archer C7, and Archer AX21, some of which no longer receive security updates or lack automatic updates. Two Archer AX21 versions reached end of life in May 2024. Always check your exact model and hardware revision on the support page.
Do the lawsuits claim China stole customer data through TP-Link routers?
No. The complaints do not allege that the Chinese government actually accessed customer data. The claims are risk-based — that buyers were not told about risks under Chinese intelligence law. Iowa’s announcement frames access as a possibility, not as a proven event.
Should I replace my TP-Link router because of the lawsuits?
Replace any router — any brand — once its maker stops sending security updates for your model. If yours is still supported, updated, and has a strong admin password with remote management off, the lawsuits alone are not a reason to replace it.
What if my router came from my internet provider?
ISP-supplied TP-Link Aginet devices get firmware through your provider, not by direct download. If no update is offered, open a ticket with your provider and ask for the patched version in writing.