FCC bans new foreign routers

In March, the Federal Communications Commission banned new consumer internet routers manufactured outside the US, citing national security concerns. Existing routers already in homes are unaffected.

Why the ban exists

Malicious actors have exploited security gaps in foreign-made routers to attack American households, disrupt networks, enable espionage, and facilitate intellectual property theft. Foreign routers were involved in Volt, Flax, and Salt Typhoon cyberattacks on US infrastructure.

“Malicious actors have exploited security gaps in foreign-made routers to attack American households, disrupt networks, enable espionage, and facilitate intellectual property theft.”

Routers are strategic targets

Consumer routers sit at the edge of every home network, making them attractive targets if compromised at scale. Internet of Things devices, including routers, are a weak point across the internet.

“Consumer routers sit at the edge of every home network, which makes them an attractive target and a strategic risk if compromised at scale.”

What the ban actually covers

The ban only affects new Wi-Fi routers and mobile hotspot devices aimed at consumer households. Existing FCC-approved routers on sale in the US and previously purchased routers already in use are fine and can be updated until at least January 1, 2029.

Foreign-made definition is murky

The ban covers any router designed or manufactured outside the US or made by companies that are not completely US-owned and operated. All major players including Netgear, TP-Link, Asus, Eero, Google Nest, and Synology fall under this definition.

Conditional approval is the loophole

Manufacturers can apply for Conditional Approval from the Department of Defense and Department of Homeland Security to continue selling routers for 18 months while they establish US manufacturing plans.

Three requirements for approval

Companies must disclose corporate ownership and any foreign government ties, submit detailed supply chain reports showing where every component comes from, and provide a time-bound plan to establish or expand US manufacturing.

Netgear gets conditional approval

Netgear, a US-founded company that manufactures routers in Vietnam, Thailand, Indonesia, and Taiwan, was granted Conditional Approval until October 1, 2027. Its stock rose on news of the ban.

Eero and Asus also approved

Amazon's Eero mesh router brand received Conditional Approval until October 31, 2027. Asus, a popular router maker, was granted Conditional Approval until March 6, 2028.

Other companies approved so far

Arcadyan (which makes routers for AT&T, Verizon, and T-Mobile), Zyxel, Gryphon, SpaceX, Adtran, Calix, Nokia, and Sagemcom have also been granted Conditional Approvals. The government has not explained why certain companies were chosen.

TP-Link's uncertain status

TP-Link, which controls about 35 percent of the US consumer router market, manufactures all routers overseas and must apply for Conditional Approval or start US manufacturing. The company has been under investigation for over a year over China ties.

TP-Link denies wrongdoing

TP-Link claims it has divested from its Chinese roots and is now headquartered in the US with bulk manufacturing in Vietnam. CEO Jeffrey Chao recently applied for permanent US residency through Trump's Gold Card program.

Software updates extended

The FCC extended its waiver for software and firmware updates until at least January 1, 2029. The original concern was that routers unable to receive updates would become security vulnerabilities with known exploits.

“The biggest practical security risk with routers is not only who made them, but whether they remain patched.”

Component substitution unclear

Router manufacturers routinely substitute components due to supply chain issues. It's unclear how this fits with the ban, but companies worry enough that the Consumer Technology Association asked for waivers on routine parts substitutions.

US-assembled routers may be OK

The FCC clarified that routers produced in the US are not considered banned equipment solely because they contain foreign-made components. Manufacturers importing components from China but assembling in the US will presumably be allowed.

Few routers made in America

The only routers known to be manufactured in the US are some Starlink Wi-Fi routers made in Texas, though many components come from East Asia. What matters more than geography is the security model and long-term firmware support.

Prices likely to rise

The ban probably won't have huge immediate impact since many Wi-Fi 7 routers are already on sale. But when stocks run low, higher compliance costs and US manufacturing requirements will likely increase consumer prices and limit choice.

Supply delays could constrain market

Much depends on how quickly conditional waivers are processed. Any delays could constrain supply and create upward pressure on pricing. Smaller companies may struggle with compliance burden and deprioritize the US market.

“This ruling has the potential to significantly disrupt the US consumer router market.”

Big questions remain unanswered

The FCC has not explained why the ban applies only to consumer routers, why some manufacturers get approval and others don't, or why existing foreign-made routers are deemed safe. What happens after the software update waiver expires is also unclear.