Florida has filed a consumer protection lawsuit against TP-Link, accusing the popular Wi-Fi router manufacturer of misleading customers about cybersecurity protections, manufacturing operations and its connections to China. The lawsuit was filed on October 6, 2026, by Florida Attorney General James Uthmeier in Polk County Circuit Court.
The 59-page complaint alleges that TP-Link promoted its routers as secure despite known vulnerabilities that could expose consumers to cyberattacks. It also challenges the company’s claims about its separation from Chinese operations and the security of its supply chain.
Florida is seeking a court injunction, financial penalties and restitution for affected consumers under the Florida Deceptive and Unfair Trade Practices Act (FDUTPA).
TP-Link strongly denies the allegations. The California-based company maintains that it operates independently of the Chinese government, manufactures devices sold in the United States in Vietnam and follows established cybersecurity practices. The lawsuit is one of several state-level legal actions filed against the company in 2026.
Why Did Florida File a Lawsuit Against TP-Link?
The legal action follows an investigation by the Florida Attorney General’s Office into TP-Link’s cybersecurity practices, corporate structure and handling of American consumer data. In December 2025, the state issued an investigative subpoena seeking documents related to the company’s security measures and supply-chain operations.
Following that investigation, Florida filed five consumer protection claims challenging the company’s representations about router security, corporate independence, manufacturing, privacy disclosures and allegedly unfair business practices.
According to the complaint, TP-Link marketed certain networking products as providing extensive protection against online threats while failing to adequately disclose important vulnerabilities. The state argues that these representations could influence consumers purchasing routers for their homes and businesses. TP-Link disputes that characterization.
What Does the Lawsuit Say About TP-Link Router Security?
Florida alleges that advertising for TP-Link’s HomeShield security service gave consumers an exaggerated impression of protection. The complaint points to promotional language describing broad security coverage, including an archived claim that the service offered a “100% safeguard” for network security.
The state identifies specific router models, including the TL-WR940N, certain Archer C7 versions and older versions of the Archer AX21. It cites publicly documented vulnerabilities and reports that attackers exploited some TP-Link equipment. The complaint also questions whether users were adequately warned when particular products stopped receiving security updates.
A known vulnerability does not establish that every router using the same brand was compromised. The legal issue is whether the company made deceptive representations or omitted information that reasonable buyers needed when assessing security risks.
Why Are TP-Link’s Connections to China Being Questioned?
TP-Link Systems Inc. is headquartered in Irvine, California. The brand originated in China and later underwent a corporate restructuring. The company says its U.S. business is independent and that products sold in the American market are manufactured in Vietnam.
Florida challenges whether those statements fully describe the company’s operational and supply-chain relationships. The complaint alleges continuing dependence on Chinese research, components and manufacturing infrastructure. Citing previously reported trade information, it states that only a small portion of the value of components used at a Vietnamese factory was purchased in Vietnam.
The state argues that these circumstances should have been explained more clearly to customers. TP-Link counters that its U.S. entity is not owned or controlled by the Chinese government or the Chinese Communist Party and says its U.S.-market devices are manufactured in Vietnam.
What Consumer Data Concerns Are Raised?
The complaint also examines privacy practices associated with TP-Link applications, including Tether, Deco, Tapo and Kasa Smart. These applications can collect account information, device identifiers and location-related data, depending on the service and settings involved.
Florida alleges that privacy disclosures do not adequately explain possible legal obligations involving operations or personnel in China. The state refers to Chinese national intelligence and cybersecurity rules in arguing that customers may not have been given a full picture of possible data-access risks.
The allegations do not establish that TP-Link handed American customers’ data to Chinese authorities. TP-Link expressly rejects that implication and says it does not share customer network data with foreign governments or unauthorized parties.
How Has TP-Link Responded to the Florida Lawsuit?
TP-Link issued a statement on October 6, 2026, disputing the coordinated state lawsuits. Corporate affairs officer Steve Kovsky said the cases were based on false premises and unfairly targeted an American company.
The company says it complies with U.S. privacy and data-protection laws, conducts extensive cybersecurity testing and works with third-party security laboratories. It also says it monitors emerging vulnerabilities and provides support to customers when problems are identified.
TP-Link has pledged to defend its products and corporate practices in court. Its statements are the company’s response to the allegations, not a court finding that the state’s claims are incorrect.
What Penalties and Court Orders Is Florida Seeking?
The Attorney General is asking for a permanent injunction to stop conduct that a court finds unlawful, together with restitution or disgorgement and legal costs. The complaint requests civil penalties of up to $10,000 for each willful violation under Florida law. It also cites higher penalties of up to $15,000 for certain violations involving protected consumers, including seniors and people with disabilities, subject to the applicable statutory requirements.
The potential total is not fixed. The state would need to establish its claims, and the court would determine any appropriate remedies. There is no announced TP-Link settlement fund or consumer claim form arising from the Florida action.
Are Other States Suing TP-Link?
Yes. Iowa, Montana and Nebraska filed separate lawsuits on October 6, 2026, raising similar questions about cybersecurity claims and connections to China. Texas had also filed a lawsuit against TP-Link earlier in 2026. These are separate enforcement proceedings; the Florida case should not be mistaken for a nationwide consumer class action.
The disputes come amid a broader federal debate about the security of consumer routers. A March 2026 Federal Communications Commission policy restricted authorization of newly introduced foreign-produced consumer router models without an applicable exemption. That separate policy does not require owners to discard already authorized routers or mean that every TP-Link device is prohibited from sale.
What Should TP-Link Router Owners Do?
The lawsuit does not mean every TP-Link router has been hacked. Owners can check the exact model and hardware version shown on their devices, review the manufacturer’s support notices, and install available firmware updates. Devices that no longer receive security updates deserve particular attention, especially when they handle home or workplace internet access.
Changing default administrative credentials, using a strong Wi-Fi password and disabling remote management when unnecessary are sensible precautions for routers of any brand. Consumers should rely on model-specific security notices rather than assuming a company-wide allegation proves that their own device is unsafe.
Latest Status of the Florida TP-Link Lawsuit
As of October 10, 2026, Florida’s lawsuit is at an early stage. The state has filed its complaint, TP-Link has publicly denied the accusations, and no final judgment or approved settlement has been reported.
The central question is whether TP-Link’s marketing and disclosures violated Florida consumer protection law. The proceedings may also influence how networking companies describe cybersecurity safeguards, manufacturing relationships and data practices to American buyers. For now, the claims remain allegations that must be tested in court.
