The FCC has extended a waiver permitting foreign-made routers and drones to receive security updates through 2029, delaying enforcement of its ban on Chinese networking equipment.

The agency initially prohibited the sale of new routers and drones from companies like Huawei and TP-Link, citing national security risks. However, the ban created a practical problem: millions of existing devices would become vulnerable if manufacturers stopped issuing patches.

The extended waiver addresses this gap. Existing routers sold before the ban can continue receiving firmware updates for two additional years. The same applies to consumer drones. This matters because routers sit at the network perimeter and handle sensitive data flows. Without updates, they become entry points for hackers.

The timeline reflects FCC concern about leaving devices in the field unpatched while owners transition to approved alternatives. Security researchers have repeatedly documented how outdated router firmware enables botnet recruitment and network compromise. The agency faced pressure from both cybersecurity advocates and consumer groups pointing out that abruptly cutting off updates would harm users.

The 2029 deadline gives manufacturers and consumers time to migrate. However, the approach reveals a tension in FCC policy. The agency banned these devices over espionage concerns, yet allows continued updates from the same manufacturers. The distinction hinges on whether new sales versus maintenance creates different risk profiles.

Industry observers note that many consumers will likely continue using existing routers beyond 2029 regardless of update availability. The FCC cannot force replacement, only block new sales and eventually cut off vendor support. This means some foreign-made routers will persist in American networks indefinitely, albeit without security patches.

The waiver extension applies specifically to equipment already in distribution channels or consumer hands. Manufacturers cannot use the waiver to sell new units. The FCC has not clarified enforcement mechanisms for devices still online after 2029 or how it will verify