Federal regulators are restricting foreign-made routers, drones, and robotic devices over national security concerns. Meanwhile, the FBI is warning that foreign-developed smartphone applications may expose Americans’ personal information to overseas governments.
by Dave Soulia, for FYIVT.com
The federal government is tightening restrictions on foreign-made electronics, citing cybersecurity threats, espionage concerns, and vulnerabilities in America’s communications infrastructure.
But another potential security risk remains in millions of American pockets: smartphone applications capable of collecting personal information and transmitting it to servers overseas, including those operated by Chinese companies.
The distinction raises an important question about Washington’s approach to cybersecurity: How much protection does restricting foreign-made hardware provide when software running through that hardware can still transmit sensitive information abroad?
FCC Expands Restrictions on Foreign Electronics
On March 23, 2026, the Federal Communications Commission added foreign-produced consumer routers to its Covered List, effectively preventing new models from receiving federal equipment authorization without special approval.
The FCC cited national security concerns, including vulnerabilities exploited in cyberattacks against American infrastructure.
The restrictions followed similar action against foreign-produced drones in December 2025. On July 28, 2026, the agency expanded its list to include foreign-produced advanced robotic devices, a category encompassing certain household robots.
The restrictions generally apply to newly authorized products. Previously approved equipment can continue to be sold and used.
Manufacturers may also obtain conditional exemptions. Companies including Netgear and Amazon’s Eero have received approvals covering certain products.
Importantly, the restrictions are not limited to Chinese manufacturers. They apply broadly to covered foreign-produced equipment, reflecting concerns about international supply chains as well as cybersecurity.
Sources: FCC Router Announcement | FCC Covered List and Exemptions
The FBI Warns About Smartphone Applications
Just eight days after the FCC announced its router restrictions, the FBI issued a separate warning addressing another avenue for foreign access to Americans’ information.
On March 31, the bureau published a public service announcement titled Data Security Risks of Using Foreign-Developed Mobile Apps in the United States.
The warning specifically identified applications developed by companies based in China.
According to the FBI, applications maintaining infrastructure in China may be subject to Chinese national security laws that enable government access to user information.
The bureau identified several categories of potentially exposed information, including names, email addresses, telephone numbers, physical addresses, and contact lists.
Some applications also disclose that information, including user-generated prompts, may be stored on servers in China.
The FBI cautioned that certain applications collect information beyond what users might reasonably expect, particularly when broad permissions are granted.
Its warning also addressed malicious software capable of exploiting operating-system vulnerabilities and obtaining unauthorized access to additional information.
The agency did not suggest that every foreign-developed application is malicious. Rather, it identified risks associated with data collection, storage practices, legal jurisdiction, and potentially compromised software.
Source: FBI Public Service Announcement — March 31, 2026
A Secure Router Cannot Control Every Application
The distinction between hardware security and software privacy is significant.
A home router directs internet traffic between connected devices and outside networks. A compromised router can potentially expose communications, redirect traffic, or provide attackers with access to other devices.
But even a properly secured router generally permits applications to communicate with their intended internet services.
For example, a smartphone application granted access to a user’s contacts may legitimately transmit that information to its developer’s servers.
The router does not ordinarily distinguish between information necessary for an application to function and personal information collected for unrelated purposes.
Encryption further complicates inspection. Secure connections protect information from interception but can also prevent network administrators from seeing precisely what an application transmits.
Consequently, replacing a foreign-manufactured router with an approved model does not automatically prevent applications from sending information to foreign-operated servers.
The Problem Extends Beyond Chinese Applications
The broader issue is not limited to applications developed in China.
The Federal Trade Commission has documented cases involving American companies collecting and distributing sensitive smartphone information.
In 2024, the FTC finalized restrictions against data aggregator InMarket over allegations involving the collection and use of precise location information.
The agency alleged that InMarket obtained information through its own applications and software incorporated into applications developed by other companies.
Such third-party software components, commonly called software development kits, can collect information without users necessarily recognizing which company ultimately receives it.
The FTC has also pursued enforcement actions involving other data brokers accused of improperly collecting or selling sensitive location information.
These cases demonstrate that personal information can travel through multiple commercial intermediaries, regardless of where an application’s original developer is headquartered.
Source: FTC Enforcement Action Against InMarket
Where Does the Information Actually Go?
Determining whether an application transmits information to China requires more than identifying its developer.
A Chinese-owned application might operate servers in the United States. An American-developed application might incorporate software supplied by foreign companies.
Server location, corporate ownership, data-sharing agreements, and legal obligations can all influence who ultimately gains access to collected information.
Network monitoring can identify many destinations contacted by applications, although encrypted communications may prevent investigators from determining exactly what information is transmitted.
Establishing whether sensitive information reaches a foreign government requires additional evidence.
Apple and Google maintain application security requirements, permission controls, and review processes. However, approval for distribution through an official application store does not guarantee that an application’s data collection practices eliminate every privacy or national security concern.
What Consumers Can Do
The FBI recommends downloading applications from official stores, reviewing permissions, disabling unnecessary data sharing, maintaining updated software, and examining privacy policies.
Consumers should also consider whether an application genuinely needs access to contacts, location, photographs, or other sensitive information.
The FCC’s restrictions address identifiable vulnerabilities in communications hardware and international supply chains.
The FBI’s warning addresses a different problem: information voluntarily or unknowingly provided to software companies operating across international borders.
Both concerns involve national security, but they require different safeguards.
The unresolved question is whether restricting the hardware entering American homes can adequately protect personal information when applications already operating inside those homes may continue transmitting data overseas.