Florida Attorney General James Uthmeier Sues TP-Link, Saying Its Routers Left Florida Home Networks Exposed

Florida Attorney General James Uthmeier sued TP-Link Systems Inc. on Tuesday, Oct. 6, 2026, accusing the dominant seller of home Wi-Fi routers of misleading Florida consumers about how secure its devices are, how separate the company really is from China, and what could happen to their personal data. The complaint, filed in circuit court in Polk County, seeks a permanent injunction, disgorgement of profits and civil penalties of up to $10,000 for each willful violation of Florida's consumer protection law.

The case puts a Florida courtroom at the center of a national fight over the California-based company, whose routers sit in millions of American homes and small offices. Federal agencies have spent two years weighing restrictions on TP-Link, and Texas sued the company in February. Florida's complaint argues that the risk is not abstract: it says Florida households own TP-Link routers that have been exploited by Chinese and Russian state-backed hackers.

"TP-Link sold Floridians the digital front door to their home network while misrepresenting how secure it was, how separated the company was from China, and what could happen to their data," Uthmeier wrote on X when he announced the suit.

What Florida alleges

The 59-page complaint is brought under the Florida Deceptive and Unfair Trade Practices Act, known as FDUTPA, which the attorney general enforces. It makes three central accusations.

First, the state says TP-Link oversold its security. The complaint quotes the company's marketing for HomeShield, a built-in security service it says "covers all security scenarios," and an archived version of TP-Link's website from as recently as November 2025 that promised a "100% safeguard" for home networks. It also cites model-specific claims, such as advertising the Archer AX21 as offering a "New Level of Cyber Security."

Second, Florida says TP-Link misrepresents its independence from China. The company has said that, as a business headquartered in the United States, no government has access to or control over the design and production of its routers. The state counters that TP-Link was not separated from its Chinese parent, TP-Link Technologies Co., Ltd., until 2024; that much of its research, development and manufacturing remains in China; and that while TP-Link touts a company-owned factory in Vietnam, only 0.5% of the components used there by value are bought in Vietnam, with the rest imported from or through China.

Third, the complaint says TP-Link's privacy policies reserve the right to collect data such as email addresses, location and phone identifiers and share it with "affiliates," without disclosing that China's 2017 National Intelligence Law requires Chinese companies and citizens to cooperate with state intelligence work.

The five counts

The state lays out its claims in five counts, all under Section 501.204(1) of Florida Statutes:

Hackers and abandoned routers

The complaint leans heavily on federal findings about real attacks. It cites 2025 congressional testimony by Rob Joyce, former director of cybersecurity at the National Security Agency, that TP-Link routers were among the brands exploited by Chinese state-sponsored hackers in the Volt Typhoon and Flax Typhoon campaigns. It cites Microsoft's 2024 report that a covert network made up predominantly of compromised TP-Link routers was used by a Chinese threat actor, tracked as Storm-0940, for password-spraying attacks on American organizations. And it cites an April 2026 FBI and NSA advisory that Russia's GRU military intelligence agency exploited a flaw in TP-Link's TL-WR940N router to intercept traffic that users believed was encrypted.

That model, the complaint says, was sold through 2024, and many Floridians likely still use it. The state also argues that TP-Link has left consumers exposed by ending support for popular models. It says the Archer AX21 v1 and v1.20 do not support automatic firmware updates and that TP-Link stopped providing updates for them after declaring them end-of-life in May 2024. Because many people keep a router for years, the state says, the risk is ongoing.

Why Polk County, and the Florida connection

The attorney general filed in the Tenth Judicial Circuit in Polk County, saying the alleged violations occurred in and affected consumers in more than one judicial circuit and that the causes of action accrued there. The complaint stresses that the case is brought solely under Florida law and expressly disclaims any federal claims, a common step to keep a state consumer case in state court.

It also details how TP-Link products reach Florida buyers. The company sells directly through its own online stores, and it lists retailers including BrandsMart USA, headquartered in Opa-locka, and Office Depot, headquartered in Boca Raton, along with national chains such as Best Buy, Walmart, Target and Home Depot. The complaint names several internet providers that operate mainly or entirely in Florida, including Summit Broadband and Central Florida Broadband, as TP-Link customers. According to congressional testimony cited in the complaint, TP-Link controls at least 60% of the U.S. retail market for home and small-office routers.

WINK News in Fort Myers framed the suit around the risk to home networks in Southwest Florida, where, as across the state, TP-Link equipment is sold at major retailers.

The federal and multistate backdrop

Florida's suit follows a string of federal and state actions against the company:

• August 2024: The House Select Committee on the Chinese Communist Party asked the Commerce Department to investigate TP-Link.
• December 2024: Federal officials were reported to be weighing a ban on sales of TP-Link routers in the United States.
• February 2026: Texas Attorney General Ken Paxton sued TP-Link, alleging deceptive marketing and backdoor access for the Chinese government. A proposed federal ban was reported paused that month ahead of a planned summit between President Donald Trump and Chinese leader Xi Jinping.
• March 23, 2026: The Federal Communications Commission added routers produced in foreign countries to its Covered List, which restricts approval of new models.
• June 2026: The Defense Department designated TP-Link Technologies Co., Ltd., the Chinese entity, as a Chinese military company operating in the United States.

TP-Link has long said it is a U.S. company, based in Irvine, California, that completed its separation from the Chinese business in 2024 and is open to working with U.S. authorities to demonstrate its products' security. The company had not publicly responded to Florida's lawsuit in the coverage reviewed for this story.

The case also fits Uthmeier's pattern of using Florida's consumer protection law against major technology and health companies. In recent weeks his office has asked a Highlands County judge to bar OpenAI from offering ChatGPT to Florida minors and Pfizer over COVID-19 vaccine claims. He is on the Nov. 3 ballot seeking a full term as attorney general. Outside counsel from Culper Law, an Arizona firm, are listed on the complaint alongside state lawyers.

What it means for Florida router owners

The lawsuit does not order anyone to stop using TP-Link equipment, and no court has found that the company broke the law. But the complaint's account of exploited and unsupported models is a reminder for Florida households to check their router's model number, install available firmware updates, change default passwords and replace devices that no longer receive security updates. TP-Link publishes its end-of-life product list on its support website.

What's next

TP-Link will be served and will have an opportunity to respond in Polk County circuit court, where it can contest the claims or seek to dismiss them. If the state prevails, a judge could permanently bar the challenged marketing and data practices, order TP-Link to give up profits from the alleged violations, and impose civil penalties of $10,000 per willful violation, or $15,000 for violations aimed at seniors, people with disabilities, military service members or veterans. The state is also seeking its attorney's fees and costs.