Whoa, that escalated quickly. This just got sent out by the press folks at the Federal Communications Commission (FCC). The FCC says it has decided that all foreign-made consumer-grade Internet routers are henceforth prohibited from receiving FCC authorization and are therefore prohibited from being imported for use or sale in the United States.

"Update Follows Determination by Executive Branch Agencies that Consumer-Grade Routers Produced in Foreign Countries Threaten National Security

WASHINGTON, March 23, 2026—Today, the Federal Communications Commission updated its Covered List to include all consumer-grade routers produced in foreign countries. Routers are the boxes in every home that connect computers, phones, and smart devices to the internet. This followed a determination by a White House-convened Executive Branch interagency body with appropriate national security expertise that such routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.”

"The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”

"This action does not affect any previously-purchased consumer-grade routers. Consumers can continue to use any router they have already lawfully purchased or acquired."

"Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations. Interested applicants are encouraged to submit applications to [email protected]."

Not sure how many consumer-grade routers will be left for sale if it really is a ban on approvals for any foreign-made consumer routers like they said, and not just a bunch of already restricted Chinese makers like Huawei and ZTE.

https://www.fcc.gov/document/fcc-updates-covered-list-include-foreign-made-consumer-routers

FCC's "covered list" of "thou shalt not entities": https://www.fcc.gov/supplychain/coveredlist

@briankrebs

This stinks of a precursor to something extremely sinister.

@IT_SME @briankrebs
they are definitely going after VPNs soon

@Sassinake @IT_SME @briankrebs

The issue is less so the fact that VPNs are going to be banned... There is an inflated idea of what VPNs accomplish in terms of actually protecting user #privacy

There are dozens of other vectors (JavaScript, Browser APIs, network telemetry clues, etc.) used to fingerprint your devices outside of cookies and VPNs. That #technology by no means stops a service such as fingerprintJS from building a device fingerprint, with or without a #VPN.

As someone else said, the real next steps are much more nefarious. And many are already happening. Such as the DHS buying location data that's intended use is advertising: https://www.aclu.org/news/privacy-technology/dhs-is-circumventing-constitution-by-buying-data-it-would-normally-need-a-warrant-to-access

DHS is Circumventing Constitution by Buying Data It Would Normally Need a Warrant to Access | ACLU

Self-serving legal justification for data purchases is among documents obtained via FOIA

American Civil Liberties Union