What Washington Has Actually Done About Wyze and TP-Link, and What It Has Not

A camera and a four-pack of plugs are not rival purchases. They share one 2026 question: which brand is in trouble with a regulator, and which is only in trouble with its own customers.

Nobody chooses between a budget indoor camera and a four-pack of smart plugs; they do different jobs, and lining up their specifications would waste your afternoon. They ended up on the same page because buyers keep asking one thing about both: is this brand about to be banned, and has it leaked video out of people’s houses. For TP-Link, which makes the Kasa plugs, the answer runs through three federal departments, a ban that was shelved, and an FCC order that does not mention plugs. For Wyze there is no regulator involved at all, and a worse record.

The FCC order names routers, and stops there for now

On 23 March 2026 the FCC added consumer-grade routers produced in a foreign country to its Covered List, closing them out of new equipment authorisation. The scope is deliberately wide. As the law firm Crowell set out in its client alert, it reaches any major stage of the manufacturing process outside the United States, including manufacturing, assembly, design and development, which captures American-branded hardware built abroad. The justification cited Chinese-linked actors in the Salt, Flax and Volt Typhoon campaigns.

What the order does not do matters more to anyone who already bought something. It is not retroactive. Routers already on the US market or already authorised are unaffected, and previously authorised models keep receiving software and firmware updates through 1 March 2027. Manufacturers can also apply for an 18 month Conditional Approval through the Department of Homeland Security or the Department of War.

And it is about routers. Crowell states plainly that it is unclear whether the FCC will act on further categories such as internet-connected cameras, video recorders and storage. So, as of 1 September 2026, no Kasa smart plug is banned, restricted or barred from sale in the United States. If a buying guide tells you otherwise, it is guessing.

Commerce proposed a ban, the White House shelved it, Texas carried on

The federal push was real. Tom’s Hardware reported that on 30 October 2025 the Commerce Department proposed banning TP-Link routers on national security grounds, backed by the Justice, Defense and Homeland Security departments, citing the company’s ties to China and the risk of spyware delivered through mandatory firmware updates. The process ran in two 30 day phases, one for TP-Link to respond and one for Commerce to decide.

It did not conclude. 9to5Mac reported that on 18 February 2026 the White House shelved the federal ban ahead of a Trump and Xi summit, after three separate investigations had made a ban look likely. The company’s exposure moved to the states instead: Texas Attorney General Ken Paxton sued TP-Link on 17 February 2026 over alleged deceptive marketing about privacy and security, and Governor Abbott had already barred state employees from using TP-Link products in January 2026.

None of that is a recall, and none of it stops a plug you own from working. It is worth knowing because it shapes the odds on firmware updates and app support several years out, which is the part of a cheap device that actually fails first.

TP-Link’s answer, and the routers Microsoft found in a botnet

The company disputes the premise vigorously. Tom’s Hardware quotes TP-Link’s position that its products present no national security risk, and its distinction between TP-Link Technologies, the Chinese parent, and TP-Link Systems, a separate United States entity established in 2022, with manufacturing in Vietnam since 2018. TP-Link puts its share of the North American residential router market below 10 percent, against other estimates of roughly 65 percent overall. Both numbers cannot describe the same thing, which tells you how contested the basic facts are.

Against that, 9to5Mac reports Microsoft’s finding that compromised TP-Link devices were used in operations against Western think tanks, government bodies, non-governmental organisations and defence suppliers. Read the scope carefully: those were routers, the device that carries every other device’s traffic. A plug sitting behind a router is a far smaller prize.

One practical note from TP-Link’s own product pages rather than from any regulator. The four-pack most guides recommend, the EP25, is not Matter certified. The KP125M, sold in the same two and four packs, is, and can be set up and controlled through the Alexa, Google Home or Apple Home app without the Kasa app in the loop. If the vendor’s cloud is what worries you, that model number is the cheapest available answer.

Wyze has no federal case and a worse record with its own customers

In February 2024, The Register reported that roughly 13,000 Wyze users could reach other users’ camera feeds, and that 1,504 of them actually viewed footage belonging to strangers, about 0.25 percent of the user base. The exposed material came from the Events tab. Wyze traced it to a recently integrated third-party caching client library that failed when devices reconnected en masse, mixing up the mapping between device IDs and user IDs. The company revoked Events access, forced token resets, added a verification layer and pulled the library out; co-founder David Crosby said Wyze would not use caching again until it found a new client library.

The explanation did not survive scrutiny. Dark Reading noted that Wyze attributed the failure to an AWS outage, and that AWS reported no outage in the relevant window. Affected users described watching strangers’ porches and living rooms, and footage from other time zones. Dark Reading also placed the episode in sequence: a smaller cross-account exposure in September 2023, which Wyze blamed on a web caching problem, came only five months earlier, raising the question of what the company learned in between.

Set the two brands side by side and the asymmetry is the story. TP-Link faces a national security argument about a category of product that is not the one you are buying. Wyze faces no such argument, and produced two incidents in five months in which customers saw inside other customers’ homes.

Where that leaves a shopper in September 2026

1. No Kasa smart plug is banned or barred from sale. The FCC’s March 2026 order is about routers, and the agency has not said whether it will go further.
2. If the TP-Link hardware in your house is a router rather than a plug, note 1 March 2027, the date through which already-authorised units keep getting firmware.
3. The Texas lawsuit is a state consumer-protection action. It changes nothing about a device you already own, whatever it eventually decides.
4. Between Kasa plugs at similar money, prefer the Matter-certified model, because it can be commissioned and run without the manufacturer’s own app.
5. For Wyze, the relevant history is not government pressure. It is two cross-account exposures in five months, and a contradicted explanation for the larger one.

Sources: Crowell · Tom’s Hardware · 9to5Mac · The Register · Dark Reading