Is TP-Link (Tapo, Kasa) safe? Privacy, police requests & security record

Facts last verified · Every claim is linked to its source · Methodology

Answer: TP-Link (Tapo, Kasa): 1 qualifying incident in our tracker since Oct 2021; police requests: discretionary; privacy policy: ad sharing disclosed. Highest-scoring device we track: TP-Link (Tapo, Kasa) C210 (68/100).

TP-Link (Tapo, Kasa) devices we track

DeviceScoreOfflineLocal storageHome AssistantRTSP/ONVIFSubscriptionAccount
TP-Link (Tapo, Kasa) C210Camera · Plug-in, Wi-Fi (2.4 GHz)68YesYesLocal pollingYesNot neededRequired
TP-Link (Tapo, Kasa) C120Camera · Plug-in, Wi-Fi68YesYesLocal pollingYesNot neededRequired
TP-Link (Tapo, Kasa) Kasa KD110Doorbell · Wired, 2.4 GHz Wi-Fi23UnverifiedYesNoneNoNot neededRequired

Police & law-enforcement requests

Discretionary Tapo privacy policy: shares information on a "good faith belief" that disclosure is needed to comply with law or legal process, or to respond to legal claims "like search warrants, court orders, production orders, or subpoenas" from parties including law enforcement. No warrant requirement stated. The Kasa app privacy policy uses the same language.12 Compare companies

Privacy policy: selling or sharing data

Ad sharing disclosed Tapo policy offers an opt-out of "processing or sharing of your personal data for online targeted advertising", i.e. it does this by default. The Kasa app policy has the same opt-out.12

Security incidents, vulnerabilities & regulator actions

What counts is set by our incident inclusion rule; entries before Oct 2021 are listed but not scored.

DateCompanyWhat happenedType
Mar 2022TP-Link (Tapo, Kasa)CVE-2021-4045: unauthenticated remote code execution (CVSS 9.8) in the Tapo C200 camera (firmware 1.1.15 and below); the researcher published a write-up and exploit code. Fixed in later firmware.34Serious vulnerability

Informational only, not legal advice. Found an error? Tell us.

Sources

  1. TP-Link Tapo Privacy Policy · checked Oct 22, 2026
  2. TP-Link: Kasa app privacy policy (updated Jan 29, 2024) · checked Oct 22, 2026
  3. NVD: CVE-2021-4045 (Tapo C200 unauthenticated RCE) · checked Oct 22, 2026
  4. hacefresko: Finding an RCE in the Tapo C200 (CVE-2021-4045) · checked Oct 22, 2026