US States Sue TP-Link Over Alleged Deceptive Marketing and China Ties
Four US states are suing networking giant TP-Link, alleging deceptive marketing practices regarding router security and undisclosed ties to China, citing national security risks.
Attorneys general from Florida, Iowa, Montana, and Nebraska have initiated legal action against TP-Link Systems, a prominent manufacturer of networking equipment and smart home devices. The lawsuit, filed in US District Court, accuses the company of engaging in deceptive and unfair marketing practices, particularly concerning the security of its routers and its persistent connections to China. TP-Link, which holds a significant share of the US consumer router market, is alleged to have misled consumers about the security capabilities of its products and its operational ties to the People's Republic of China.
The complaint highlights concerns that TP-Link's supply chain and data handling practices pose national security risks due to potential influence from the Chinese government and its laws. The states' legal filing points to evidence suggesting that TP-Link devices have been exploited by state-backed hacking groups, including those linked to China and Russia. Furthermore, the lawsuit claims that TP-Link has not been fully transparent about its ongoing relationships with Chinese entities, despite previous assurances of severing ties and shifting manufacturing operations to Vietnam.
According to the filing, TP-Link's reliance on Chinese companies for research and development and manufacturing persists. The complaint details that a mere 0.5 percent of components used at TP-Link's Vietnamese plant are sourced locally, with the vast majority of other inputs imported from or through China. The suit also raises alarm bells over construction work at the Vietnamese factory allegedly carried out by a US-designated Chinese military company, casting doubt on TP-Link's assurances regarding the security and integrity of its supply chain.
Attorneys for the states cited marketing claims made by TP-Link, such as its HomeShield product covering "all security scenarios" and providing a "100 percent safeguard" for network security. These assertions are contested by the lawsuit, which argues that TP-Link's routers have been found to contain critical vulnerabilities. The complaint references testimony from former NSA cybersecurity director Rob Joyce, indicating that TP-Link routers were among those exploited in sophisticated campaigns like Volt Typhoon and Flax Typhoon, attributed to China-linked actors.
Beyond hardware vulnerabilities, the lawsuit also scrutinizes TP-Link's privacy policies. It alleges that the company's terms permit the collection and sharing of customer data with affiliates without adequate disclosure of how Chinese intelligence laws might expose this information to Chinese intelligence agencies. Iowa Attorney General Brenna Bird stated, "Iowans' sensitive data and our national security is at risk because of TP-Link and their connection to the communist Chinese government." Montana Attorney General Austin Knudsen added, "TP-Link's false statements and deceptive advertising are a violation of Montana law."
In response, TP-Link Systems Inc. has vehemently denied the allegations, labeling the lawsuits as baseless and unfairly penalizing a US company. Steve Kovsky, corporate affairs officer for TP-Link Systems, asserted that the company has provided documentation proving it is not owned or controlled by any foreign government and that its US-sold devices are manufactured in Vietnam. "Any claims that our products present a threat to user security or grant unauthorized network access to foreign governments are baseless," Kovsky stated, emphasizing TP-Link's compliance with US privacy laws and its commitment to security testing.
This legal action echoes similar concerns previously raised by Texas Attorney General Ken Paxton, whose office also sued TP-Link earlier this year over its Chinese ties and router security. The allegations come at a time when US officials have been scrutinizing TP-Link's operations, with the Federal Communications Commission (FCC) imposing broader restrictions on new foreign-produced router models in March 2026, further highlighting the ongoing regulatory and national security scrutiny surrounding the company's products and affiliations.