Florida TP-Link Lawsuit, Attorney General Accuses Router Maker of Misleading Consumers About Security and China Ties

Florida Attorney General James Uthmeier has sued TP-Link Systems Inc., alleging the Wi-Fi router maker misled Florida consumers about the security of its routers, its separation from China and how consumer data could be handled. TP-Link denies the allegations. This is a state enforcement action, so there is no settlement and no consumer claim form.

The lawsuit was filed on October 6, 2026, in the Circuit Court of the Tenth Judicial Circuit in and for Polk County, Florida. Florida’s 59-page complaint asserts five counts under the Florida Deceptive and Unfair Trade Practices Act (FDUTPA). Montana, Iowa and Nebraska filed parallel lawsuits against TP-Link around the same time.

TP-Link calls the coordinated suits “built on false premises” and says TP-Link Systems is an independent U.S. company, that products sold in the United States are manufactured in Vietnam, and that it does not share customer network data with foreign governments or unauthorized third parties.

Florida v. TP-Link Systems Inc.: Quick Facts

Detail	Information
Case	Florida v. TP-Link Systems Inc.
Plaintiff	State of Florida, Office of the Attorney General, Department of Legal Affairs
Attorney General	James Uthmeier
Defendant	TP-Link Systems Inc. (Irvine, California)
Court	Circuit Court of the Tenth Judicial Circuit in and for Polk County, Florida
Filed	October 6, 2026
Main law	Florida Deceptive and Unfair Trade Practices Act (FDUTPA), Fla. Stat. § 501.201 et seq.; central provision § 501.204
Claims	Five counts: deceptive security representations; deceptive corporate and manufacturing representations; deceptive data-practice omissions; unfair practices; unconscionable practices
Models discussed	TL-WR940N, Archer C7 (versions 2 and 3), Archer AX21 (versions 1 and 1.20), among others; HomeShield security service
Relief sought	Permanent injunction, restitution or disgorgement, civil penalties, attorneys’ fees and costs
Parallel suits	Iowa, Montana and Nebraska (filed around the same time); Texas (February 2026)
Case type	Government enforcement action. Not a class action
Settlement or claim form	None
TP-Link’s position	Denies the allegations; says it is an independent U.S. company

Why Did Florida Sue TP-Link Systems Over Router Security?

A home router sits between a household’s devices and the internet, so its security matters to everything connected through it. Florida alleges TP-Link marketed its routers and its HomeShield security service with strong protection claims while known vulnerabilities in some models were being exploited. The state says an archived TP-Link webpage described HomeShield as a “100% safeguard” for network security, and argues that language was misleading.

The lawsuit does not allege that every TP-Link router is insecure or that every customer was hacked. It points to particular products, vulnerabilities and company statements and argues consumers were not given enough information to understand the risks.

Which TP-Link Router Models Does Florida Name in the Lawsuit?

• TL-WR940N: Florida alleges it was affected by CVE-2023-50224 and exploited by the Quad7 botnet and Russian military intelligence (GRU) actors, and that it did not update its firmware automatically, leaving consumers dependent on obtaining and installing updates themselves.
• Archer C7 (versions 2 and 3): Discussed in the complaint and reporting.
• Archer AX21 (versions 1 and 1.20): Florida points to CVE-2023-1389, an unauthenticated command-injection vulnerability, alleges it was used in attacks and says certain versions reached end-of-life status.

The state’s broader point is that consumers keep using routers for years, so security-support decisions can matter long after a sale. Being named in the complaint does not itself establish that every unit of a model is compromised.

Did Hackers Actually Exploit TP-Link Routers, According to Florida?

Florida’s complaint relies on government and cybersecurity reports about exploitation of TP-Link equipment, including activity attributed to Chinese state-sponsored actors and the Russian GRU, and the Quad7 botnet, which researchers have linked to compromised small-office and home-office routers. The state argues these documented vulnerabilities show TP-Link’s consumer-facing security claims did not reflect the real risks. Whether TP-Link violated Florida law has not been decided.

Related article: Scout Motors Blythewood Plant Lawsuit, Elderly Couple Says Construction Forced Them From Their Home

What Does Florida Allege About TP-Link’s Ties to China and Vietnam Manufacturing?

TP-Link Systems says it is a U.S. company headquartered in Irvine, California, that it separated from the former Chinese TP-Link business and that it operates independently. Florida alleges TP-Link’s research, manufacturing and supply chain remain heavily tied to China despite presenting itself to consumers as separated from it.

The state specifically challenges statements about U.S.-sold products being built in Vietnam, alleging only about 0.5% of the value of components used at the Vietnam facility is purchased in Vietnam, with the rest coming from or through China. TP-Link disputes Florida’s characterization and says it is not owned or controlled by the Chinese government or the Chinese Communist Party.

The factual question for the court will be what TP-Link told Florida consumers about where its products came from and whether those statements were materially misleading.

Is TP-Link Systems Inc. the Same Company as TP-Link Technologies Co., Ltd.?

No, and the distinction matters. The defendant is TP-Link Systems Inc., the California-based company. The complaint discusses TP-Link Technologies Co., Ltd., a Chinese entity, when describing TP-Link’s history and corporate relationships, but that entity is not the named defendant. The court will have to consider the specific corporate relationships Florida alleges rather than treating every company using the TP-Link name as one legal entity.

What Does Florida Allege About TP-Link’s App and Data Practices?

Florida alleges TP-Link’s privacy disclosures reserved broad data-sharing rights while omitting risks related to potential access by foreign intelligence services under Chinese law. The theory is not simply that a privacy policy was poorly written, but that material information was omitted, leaving consumers with an incomplete picture of how their information could be handled. TP-Link denies improperly sharing customer network data and says it complies with U.S. privacy and data-protection laws.

Which Florida Law Does the TP-Link Lawsuit Rely On?

The case rests on FDUTPA, Fla. Stat. § 501.201 et seq., centered on § 501.204(1), which prohibits unfair methods of competition and unfair or deceptive acts or practices in trade or commerce. The Attorney General has authority to bring enforcement actions under the statute. The five counts are:

1. Deceptive security representations: Statements about the protection offered by TP-Link routers and HomeShield, allegedly misleading given known vulnerabilities and exploitation.
2. Deceptive corporate and manufacturing representations: Statements and omissions about separation from China, the supply chain and Vietnam manufacturing.
3. Deceptive data-practice omissions: Alleged failure to disclose information consumers would consider material.
4. Unfair practices: Including the continued presence of older routers in homes and the ending of security support for certain products.
5. Unconscionable practices: A separate theory about conduct Florida says is sufficiently abusive to violate the statute.

All five counts are the State’s allegations. No court has ruled that TP-Link violated FDUTPA.

How Much Is Florida Seeking From TP-Link?

Florida seeks a permanent injunction, restitution or disgorgement of ill-gotten gains, civil penalties, attorneys’ fees and costs, and other relief. It seeks civil penalties of up to $10,000 per willful violation (Fla. Stat. § 501.2075), with higher amounts available in certain cases involving seniors, persons with disabilities or military-related victims.

This is not a $10,000-per-customer payment. The total, if any, would depend on the court’s findings and how many legally actionable violations it finds.

Can Florida Consumers File a Claim or Get Money From the TP-Link Lawsuit?

Not at this time. The state seeks consumer-related relief, including restitution, but no restitution fund, settlement administrator or claim process exists. Consumers do not need to file anything because they own a TP-Link router. If Florida later obtains a settlement or judgment that includes consumer restitution, the Attorney General’s office would explain eligibility and how to participate. Be cautious of websites advertising a “TP-Link Florida settlement” unless the information comes from an official source. For how claims work in actual settlements, see How To Claim A Lawsuit Settlement?

Is the Florida TP-Link Case a Class Action?

No. The Attorney General filed it on behalf of the state under its consumer-protection enforcement authority. It is not a Rule 23 class action filed by private consumers, so there is no class certification, class notice or claim form.

Does the Florida Lawsuit Mean TP-Link Routers Are Unsafe?

No. The lawsuit does not establish that all TP-Link routers are unsafe. It identifies particular vulnerabilities and products and alleges TP-Link’s security representations were misleading. TP-Link disputes this and says it performs security testing, works with third-party security laboratories and supports customers when vulnerabilities are found. Nearly any internet-connected device can contain vulnerabilities. The legal question is whether TP-Link’s specific representations and omissions violated Florida’s consumer-protection law.

What Should Florida Consumers With TP-Link Routers Do?

The lawsuit does not require anyone to throw away a router. General cybersecurity precautions, which are not legal requirements created by the suit, include:

1. Identify your router model and hardware version.
2. Check TP-Link’s official security advisories for that model.
3. Install available firmware updates.
4. Consider replacing a router whose manufacturer has permanently ended security support.
5. Change default administrator credentials and use a strong, unique Wi-Fi password.
6. Disable remote-management features you do not need.

What Led Up to Florida’s TP-Link Lawsuit: The December 2025 Subpoena

Florida’s Attorney General issued an investigative subpoena to TP-Link Systems Inc. on December 2, 2025, seeking documents on corporate structure, manufacturing, software-development practices, consumer data and evidence supporting TP-Link’s cybersecurity claims. Florida said then that the subpoena was part of an ongoing investigation and was not a determination of wrongdoing. The lawsuit is the escalation from that investigation to formal litigation.

How Is the Florida TP-Link Lawsuit Related to Texas and the Other State Lawsuits?

Texas Attorney General Ken Paxton sued TP-Link in February 2026 alleging deceptive marketing, security problems and connections to China. Florida filed on October 6 alongside Montana, Iowa and Nebraska. Each state is using its own consumer-protection law, so one case does not automatically decide another, though they may share factual issues about TP-Link’s security claims, Chinese connections and data practices. TP-Link says it has given state regulators documentation supporting its position.

What Is the Federal Government’s Role in the TP-Link Controversy?

The state suits come amid broader federal scrutiny of TP-Link, including Federal Communications Commission actions in 2026 affecting approval of certain foreign-produced consumer routers. Those developments are separate from Florida’s FDUTPA case, which does not assert a federal consumer-protection claim.

What Happens Next in Florida v. TP-Link Systems Inc.?

TP-Link will formally respond to the complaint under Florida’s court deadlines. The case could involve motions challenging the complaint, discovery on TP-Link’s corporate structure, supply chain, security-support practices, marketing statements and data practices, cybersecurity expert testimony, possible settlement talks and, if not resolved earlier, trial. The court has not found that TP-Link violated Florida law, and the state’s allegations must be proven or resolved by settlement or judgment.

Florida TP-Link Lawsuit Timeline

Date	Development
December 2, 2025	Florida Attorney General issues investigative subpoena to TP-Link Systems
February 2026	Texas Attorney General sues TP-Link
October 6, 2026	Florida files its five-count FDUTPA lawsuit in Polk County; Montana, Iowa and Nebraska file parallel suits
October 6, 2026	TP-Link issues a statement rejecting the allegations
Current	Florida case pending

Frequently Asked Questions About the Florida TP-Link Lawsuit

Why is Florida suing TP-Link?

Attorney General James Uthmeier alleges TP-Link misled consumers about router security, its ties to China and its data practices, in violation of FDUTPA.

Is TP-Link being sued because its routers were hacked?

Florida points to documented vulnerabilities and alleged exploitation of particular models and argues those made TP-Link’s security claims misleading. TP-Link disputes the allegations.

Which TP-Link routers are named?

The TL-WR940N, Archer C7 and Archer AX21, among others, plus the HomeShield service.

Did TP-Link lie about being a U.S. company?

Florida alleges TP-Link’s statements about separation from China were misleading. TP-Link says TP-Link Systems is an independent U.S. company headquartered in California.

Are TP-Link routers manufactured in Vietnam?

TP-Link says U.S.-sold devices are manufactured in Vietnam. Florida challenges how much of the Vietnam operation depends on Chinese-sourced components.

Can I get money from the Florida TP-Link lawsuit?

Not currently. There is no settlement, judgment or claim form.

Should I throw away my TP-Link router?

The lawsuit does not require it. Check your model and firmware status and follow TP-Link’s security guidance. Replacing a router whose security support has ended may be prudent regardless of the lawsuit.

Is the Florida TP-Link lawsuit a class action?

No. It is a government enforcement action by the Florida Attorney General.

Has a court ruled that TP-Link violated Florida law?

No. The lawsuit is new and the allegations have not been adjudicated.

What penalties is Florida seeking from TP-Link?

A permanent injunction, restitution or disgorgement, civil penalties of up to $10,000 per willful violation (higher in certain circumstances), and fees and costs.

What does TP-Link say about the lawsuit?

That the suits are based on false premises, that it is an independent U.S. company, that U.S.-sold devices are made in Vietnam and that it does not share customer network data with foreign governments or unauthorized third parties.

Bottom Line: Florida v. TP-Link Systems Inc.

This is a new state consumer-protection case about cybersecurity, corporate transparency and consumer data. Florida alleges TP-Link gave consumers an overly reassuring picture of its router security, did not fully disclose its Chinese supply-chain and corporate ties, and failed to disclose material data-access risks. TP-Link denies all of it.

For consumers, there is currently no TP-Link settlement, no claim form and no payment available. The next developments to watch are TP-Link’s formal response, any motion to dismiss, discovery on its security practices and corporate structure, and the court’s treatment of Florida’s requested remedies.

Sources and Legal Authorities

• Ars Technica: Florida sues TP-Link, claiming it hides router security risks and links to China
• TP-Link Systems Inc. statement in response to Attorney General lawsuits
• Florida Attorney General subpoena to TP-Link Systems Inc., December 2, 2025 (PDF)
• Florida Attorney General announcement (MyFloridaLegal)
• Texas Attorney General press release on TP-Link lawsuit
• Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. §§ 501.201 et seq., including §§ 501.204 and 501.2075
• Complaint filed by the Florida Office of the Attorney General in the Tenth Judicial Circuit, Polk County, October 6, 2026

Disclaimer: For informational purposes only; not legal advice. The allegations against TP-Link are claims in a newly filed lawsuit and have not been proven in court. Statements attributed to TP-Link reflect the company’s position, not findings by a court.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts checked against the Florida Attorney General’s subpoena and announcement, TP-Link’s published statement, the Texas Attorney General’s press release and Ars Technica’s reporting on the complaint, as of October 8, 2026. Last Updated: October 8, 2026.