The attorneys general of Florida, Iowa, Montana and Nebraska have sued TP-Link Systems, accusing the router maker of misleading consumers about the security of its products and its links to China, The Register reported Wednesday. TP-Link, which accounted for more than a third of U.S. router unit sales in 2024, rejected the allegations.

What Happened

The suit targets California-based TP-Link Systems, whose brand began in Shenzhen, China. The states allege deceptive marketing on two fronts: claims about how well TP-Link products protect users, and claims about how far the company has separated from China.

On security, the complaint points to TP-Link's HomeShield service. A November 2025 version of the company's website said HomeShield "covers all security scenarios" and offered a "100 percent safeguard" for home networks, according to The Register. The states argue those promises were misleading because TP-Link routers contained repeated, critical firmware vulnerabilities, and because the devices were exploited in Volt Typhoon and Flax Typhoon, campaigns attributed to Chinese state-backed hackers.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

On China, the states challenge TP-Link's statements that it moved its operations to Vietnam. The complaint alleges that only 0.5% of the components used at the Vietnamese plant are sourced in Vietnam, with the rest imported from or through China, and that research and development still depend on Chinese operations. It also claims a Chinese company that the U.S. has designated as linked to China's military carried out construction work at the Vietnam factory.

The Register did not report what damages or other relief the states are seeking.

TP-Link's Response

Steve Kovsky, TP-Link's corporate affairs officer, called the allegations baseless. He disputed claims that its products threaten users' security or give any foreign government access to their networks, said TP-Link makes its products for the U.S. market in Vietnam and said those products meet security standards.

Why It Matters

TP-Link's reach makes the case significant. Market researcher Circana put its 2024 share of U.S. router sales at 36.6% by units and 31% by dollars, and former National Security Agency cybersecurity director Rob Joyce has testified that the company holds at least 60% of the U.S. retail Wi-Fi and small office and home office router market.

Consumer routers are a common foothold for state-backed hackers because they sit at the edge of home and small business networks, are rarely monitored and often run outdated firmware. Volt Typhoon used botnets of hijacked small office and home office routers to disguise intrusions into U.S. critical infrastructure.

Context

The four states are not the first to sue. Texas Attorney General Ken Paxton filed a similar suit earlier in 2026, and Florida Attorney General James Uthmeier subpoenaed TP-Link in December 2025 as part of a consumer protection investigation into its cybersecurity practices, supply chain and data handling. At the federal level, the Federal Communications Commission in March 2026 restricted new equipment authorizations for foreign-made routers unless they qualify for an exemption, while models already authorized can still be sold.

What to Watch

The next steps are TP-Link's formal answer in court and whether more states file their own cases. The case also adds state-level pressure on top of the FCC's restrictions on new foreign-made routers, which limit what new models TP-Link can bring to U.S. shelves without an exemption.