Since March 23, 2026, TP-Link has not been able to sell a single new router model in the United States. That is the date the FCC added “routers produced in foreign countries” to its Covered List, the administrative mechanism it has used since 2021 to keep Huawei and ZTE equipment out of the country. Every router needs an FCC equipment-authorization grant before it can be imported or marketed; the Covered List update means no new foreign-made consumer router gets one unless its maker wins a case-by-case waiver. More than two dozen manufacturers and trade groups have already gotten one, Light Reading reported, including Netgear, Asus, Amazon’s Eero, Nokia, Verizon, AT&T and SpaceX’s Starlink unit. TP-Link, the brand most of the political pressure was aimed at, is not one of them.
The rule’s language is broad enough to catch almost the whole industry: TP-Link, Netgear, Asus, D-Link, Linksys and Google’s Nest Wifi all build their hardware overseas, mostly in China, Vietnam, Taiwan and Thailand. Routers already granted authorization before March 2026 are unaffected and can still be sold; enterprise-class gear is excluded entirely. That leaves a narrow but commercially important gap: new consumer models from the country’s best-selling router brand on Amazon, locked out while competitors’ new models ship.
| From | To | How |
|---|---|---|
| New foreign-made router model | FCC equipment authorization required by law | |
| FCC equipment authorization required by law | Blocked: Covered List, Mar 23, 2026 | foreign-made |
| Blocked: Covered List, Mar 23, 2026 | Conditional-approval petition filed | must apply for waiver |
| Conditional-approval petition filed | Granted: ~28 firms incl. Netgear, Asus, Eero… | |
| Conditional-approval petition filed | Still pending: TP-Link |
A pledge timed to a petition
TP-Link’s pending petition, filed with the FCC, asks for conditional approval of two specific Wi-Fi 8 models, the Archer 8 Ultra and Deco 8 Ultra — the company had to exclude the US from its regional preorder for the Archer 8 Ultra because of the ban. Attached to that petition is a commitment to invest close to $1 billion in US manufacturing and R&D, on top of an existing US staff of more than 700, with “hundreds” of new jobs promised and domestic assembly of the new routers not starting until 2027, per Light Reading’s account of the filing. That is at least a full year after the freeze that the investment is meant to lift, and the pledge is tied to these two models, not a blanket commitment covering TP-Link’s broader catalog.
TP-Link’s own framing of the ask, in a letter to the FCC last week reported by Ars Technica, is about consistency rather than exemption from scrutiny: it wants “reviewers [to] fairly apply the same consistent review standards to TP-Link as have been applied to all other applicants.”
TP-Link prioritizes the security of US consumer networking data; user data processed by TP-Link’s US products is encrypted and housed on Amazon Web Services infrastructure in Virginia. And of course, TP-Link does not, and will not, share customer network data with foreign governments or unauthorized third parties.
Why TP-Link, specifically
The security record behind the political pressure is not hypothetical. On April 7, 2026, the FBI, NSA and intelligence agencies from Canada, Czech Republic, Denmark, Estonia, Finland, Germany and Italy issued a joint advisory attributing a campaign to Russia’s GRU Military Unit 26165 — APT28, also known as Fancy Bear or Forest Blizzard. Since at least 2024, the group used a known, already-patched router vulnerability to steal login credentials, then changed one setting: the DNS server, enabling adversary-in-the-middle attacks against users of Microsoft Outlook Web Access who clicked past a certificate warning. The DOJ said targeting was indiscriminate, which is how routers in ordinary homes across more than 23 states ended up in the network; the FBI’s same-day “Operation Masquerade” cleared the US portion of it.
Separately, Microsoft has tracked a botnet of hijacked small-office and home routers it calls CovertNetwork-1658, also known as Quad7 — “predominantly TP-Link devices,” per Microsoft, in use since at least 2023 for password-spray attacks on Microsoft 365 accounts. TP-Link says the exploit chain only works when remote administration is left open to the internet, which is off by default. In June 2026 the Defense Department added TP-Link Technologies — the Shenzhen-based entity TP-Link Systems says it split from in 2022 — to its list of Chinese military companies, according to Florida’s lawsuit against TP-Link.
Five states, one letter
Florida filed suit in Polk County Circuit Court on October 6, alleging five counts under the state’s Deceptive and Unfair Trade Practices Act: false security marketing (its HomeShield service claims to cover “all security scenarios”), misrepresenting the China split, omissions in privacy disclosures, dropping security support for still-used router models, and unconscionable business practices. Florida wants $10,000 per willful violation, rising to $15,000 if the violation targeted seniors, people with disabilities, servicemembers or veterans, plus disgorgement of profits — and because the complaint treats each individual ad or sale as its own violation, the exposure compounds fast. That makes five states suing TP-Link in total, after Iowa, Montana, Nebraska and Texas filed earlier. A separate coalition of 21 state attorneys general sent the FCC a letter on October 7 urging it to withhold the exemption and address “past and ongoing state-law violations” first.
Whose numbers
Florida’s complaint, citing Bloomberg, puts TP-Link Technologies’ headcount in China at roughly 11,000 against about 305 US employees at TP-Link Systems, the Irvine, California entity wholly owned by Jeffrey (Jianjun) Chao and his wife, formed in October 2024. On the Vietnam assembly line TP-Link points to as evidence of independence, Florida’s complaint puts Vietnamese-sourced component value at about 0.5%, with the remainder tied to Chinese suppliers — close to the 99.5%-from-China figure the 21-state letter to the FCC cites for the same facility.
None of those three figures is measuring the same thing. Dell’Oro’s denominator counts routers that internet providers lease directly to customers — a channel TP-Link doesn’t sell into at retail at all — which dilutes its share once that larger pool is added. The 60%-plus figure that shows up in state lawsuits and congressional testimony appears to track the retail and online channel specifically, where TP-Link is reportedly the single best-selling router brand on Amazon. A company can be the dominant seller in the aisle shoppers actually browse and still a minority player across the full installed base of routers in US homes, most of which arrived bundled with a broadband subscription and were never bought as a separate product.
The vulnerability no country-of-origin rule fixes
The Covered List screens for where a router is made, not for what is wrong with it, and the security research published this year suggests that is a mismatch. On February 25, researchers Xin’an Zhou of UC Riverside and Mathy Vanhoef of KU Leuven presented AirSnitch at the NDSS Symposium in San Diego: a set of attacks that bypass Wi-Fi client isolation — the feature guest networks and public hotspots rely on to stop one connected device from snooping on another — without breaking WPA2 or WPA3 encryption at all. They tested 11 platforms from ten vendors, including Netgear’s Nighthawk X6 R8000, D-Link’s DIR-3040, TP-Link’s own Archer AXE75, Asus’s RT-AX57, Ubiquiti’s AmpliFi Alien, Cisco’s Catalyst 9130 and OpenWrt 24.10. Every single one was vulnerable to at least one of three attack variants, which the published paper attributes to an architectural gap: the 802.11 Wi-Fi standard never specified cryptographic binding between a device’s identity and its encryption state, so no vendor’s implementation — regardless of where it was manufactured — can enforce isolation that the standard itself doesn’t define.
That finding does not clear TP-Link of the specific allegations against it — the GRU campaign, the Quad7 botnet and the Pentagon’s military-company designation are claims about TP-Link’s own supply chain and patching record, not about an industry-wide standards gap. But it does mean the FCC’s test for what gets a new router onto US shelves — where the factory sits — catches none of the eleven vulnerable platforms AirSnitch tested, nine months after the Covered List took effect.
The FCC’s conditional-approvals office has now ruled on enough petitions to produce a list of who asked and who was answered, running past two dozen names. It has not published a technical standard that explains why those petitions were granted and TP-Link’s was not. TP-Link’s letter asks for “the same consistent review standards” applied to Netgear and Eero. Whether such standards exist anywhere outside each individual approval order is the question the agency’s public docket does not yet answer.