TP-Link Tapo

Is TP-Link Tapo safe?

Tapo is fine for a hallway or a garden if you treat it as cheap hardware that needs looking after. The cameras are popular because they cost little and record to a microSD card without a subscription, which is better for privacy than cloud-only rivals. The trouble is volume. The US National Vulnerability Database lists 41 Tapo flaws published in 2026 alone, and five US states are suing TP-Link Systems over its security claims, its ties to China and what its apps collect. We score Tapo 57/100, level with Ring and well behind SmartThings at 68.

How many security flaws have Tapo cameras had?

A lot, and the pace has picked up. A keyword search of the NIST database returns 65 Tapo CVEs, 41 of them published between January and October 2026. Many share a pattern: a web or video service on the camera that does not check who is asking.

• CVE-2026-15315 (August 2026, severity 8.7) let an attacker on the local network bypass login on the Tapo C120 and C200 and get admin session tokens.
• CVE-2026-105672 and CVE-2026-105674 (October 2026) hit the C325WB: one allowed an unauthenticated bypass on port 443, the other came from a streaming key generated from a predictable, time-seeded number.
• CVE-2025-14553 (December 2025) was in the Tapo app itself, which returned password hashes through an API that needed no login.

Almost all of these need the attacker to be on your Wi-Fi or to hold the camera, not to reach it from the internet. The advisories we checked point to firmware fixes, and TP-Link's product security page promises a first reply to researchers within five working days and fixes that "typically" take up to 90 days or longer. We found no public bug bounty on its site, HackerOne or Bugcrowd.

TP-Link says Tapo uses AES-128 and TLS 1.2 to protect footage, holds ISO 27001 and 27701 certificates and uses AWS for DDoS protection. It does not claim end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, and two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary is available but off unless you turn it on.

Why are US states suing TP-Link?

Texas Attorney General Ken Paxton sued TP-Link Systems on 17 February 2026, saying its ties to China make it subject to Chinese data laws. According to The Register, the suit says TP-Link marketed devices as made in Vietnam when most parts and development came from China, sold them as secure despite firmware flaws used by Chinese state hackers, and collected app data without informed consent. It asks for an injunction and a jury trial. TP-Link has called the claims without merit.

Four more states followed on 6 October 2026: Florida, Iowa, Montana and Nebraska, all under consumer protection laws. Florida's attorney general had subpoenaed TP-Link in December 2025. The Florida, Montana and Nebraska complaints share much of their text, and one count names the Tapo, Kasa, Deco and Tether apps, saying they collect email addresses, location and phone identifiers while their privacy policies leave out that Chinese affiliates are subject to China's intelligence law. Florida seeks up to $10,000 per wilful violation. TP-Link denies the claims, and no court has ruled on any of the five cases.

Behind these sits a federal review. Commerce Department officials proposed banning sales of TP-Link Systems devices, citing the US data it handles and possible Chinese influence, but Reuters reported in February 2026 that the administration had paused the plan. In June 2026 the Defense Department added TP-Link Technologies, the Chinese company TP-Link Systems says it split from, to its list of Chinese military companies. That listing does not name TP-Link Systems or the Tapo app, and Tapo cameras remain on sale.

What data does the Tapo app collect?

Apple's label for the app lists email, user and device IDs, usage data, diagnostics, purchases and support messages, all marked as not linked to you, and no tracking. TP-Link's privacy policy, last updated in September 2024, is broader: camera images and video, voice input, location, device logs and Wi-Fi passwords if you choose to sync them. Data may be processed in the US, Ireland, Singapore "among other countries". The policy uses interest-based ads that it says do not use information identifying you, but admits its ad partners' cookies may count as "selling" or "sharing" under some state laws. The terms of use let TP-Link keep copies of your content indefinitely.

How to use Tapo cameras more safely

1. Record to a microSD card and skip Tapo Care cloud storage unless you need off-site backup.
2. Update camera firmware in the app as soon as it is offered, and replace models that no longer get updates.
3. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for your TP-Link ID and use a unique password.
4. Put cameras on a guest or separate network, since most 2026 flaws need local network access.
5. Use privacy mode and privacy zones, and never point indoor cameras at bedrooms or bathrooms. Delete your account at TP-Link's account deletion page if you stop using the cameras.

How we scored it

Scams and harmful content (75) is Tapo's strongest factor: there is no social feed, only the camera. Security (48) is its weakest, after more than 40 flaws in 2026, optional two-step login and no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary. Privacy (55) follows TP-Link's policy rather than the cleaner App Store label, and the regulatory record (60) reflects five pending state lawsuits, three of which name the app, with no fine yet.