Florida filed a five-count consumer-protection lawsuit against TP-Link Systems Inc. in Polk County on October 6, 2026. The complaint alleges misleading claims about router security, corporate separation, manufacturing and app data practices. TP-Link denies the allegations. Florida’s complaint and filing announcement describe the action.

What Florida alleges in the complaint

Florida brought the case under the Florida Deceptive and Unfair Trade Practices Act, or FDUTPA, a state law addressing deceptive and unfair business practices. The five counts concern security representations; claims or omissions about corporate separation, supply chains and manufacturing; omissions about data practices; unfair practices; and unconscionable practices.

The complaint alleges that TP-Link’s security marketing, including claims about HomeShield, was misleading in light of vulnerabilities and exploitation associated with certain router models. It also challenges representations about the company’s separation from Chinese operations and its manufacturing and supply chain. On data practices, Florida alleges that TP-Link’s app privacy policies reserve rights to share personal data in certain circumstances but omit the risk of potential access by Chinese intelligence agencies.

Florida asks the court for a permanent injunction, disgorgement, attorneys’ fees and costs, and civil penalties. The requested penalties are $10,000 per willful violation, or $15,000 for specified willful violations involving seniors, people with disabilities, servicemembers and their families, or veterans.

Router models named in the filing

Florida’s complaint identifies particular models and versions in its security allegations:

  • TL-WR940N: The complaint alleges a vulnerability identified as CVE-2023-50224 and exploitation associated with the model.
  • Archer C7 versions 2 and 3: Florida links these versions to alleged compromise in Quad7 botnet operations and alleges they did not support automatic firmware updates.
  • Archer AX21 versions 1 and 1.20: The complaint alleges these versions did not support automatic updates and no longer received updates.

These allegations concern the named models and versions; they do not apply as a finding about every TP-Link router. TP-Link Systems Inc. rejects Florida’s claims and says it stands behind the security of its products.

TP-Link’s response

TP-Link Systems Inc. says it is an independent U.S. company, is not owned or controlled by a foreign government, and does not share customer network data with foreign governments. The company also says that devices sold in the United States are manufactured in Vietnam. Its October 6 response rejects the lawsuits’ premises and says it intends to contest the allegations in court.

The complaint discusses TP-Link Technologies Co., Ltd. as a separate Chinese entity. That company is not the defendant in Florida’s case; the named defendant is TP-Link Systems Inc.

What the Vietnam component figure means

Florida alleges that 0.5% by value of the components used at TP-Link’s Vietnam factory were purchased in Vietnam, with other inputs imported from or through China. TP-Link’s statement that U.S.-sold devices are manufactured in Vietnam concerns where those devices are made; Florida’s percentage concerns where components used at the factory were purchased.

Other state lawsuits mentioned by TP-Link

In its October 6 statement, TP-Link referred to lawsuits brought by the attorneys general of Florida, Montana, Iowa and Nebraska.