Foreign-made drones after the DJI restrictions
The legal and security architecture around foreign-made drones changed substantially in 2024 and 2025, and operators are still flying as if it did not.
Inexpensive drones quietly became infrastructure over the last decade. Real estate photographers, building inspectors, public safety agencies, agricultural operators, and film crews all rely on commercial off-the-shelf platforms that are dominated, globally, by a handful of manufacturers headquartered in China. The legal and security architecture around that market has shifted substantially in the last two years, and most operators are still flying as if it had not.
The federal posture began with executive orders restricting government use of drones from “covered foreign entities” and has since hardened into a series of agency-specific bans and broader legislative pushes. In late 2024, Congress passed the American Security Drone Act as part of the annual defense authorization, which phases in restrictions on federal procurement and federal-grant-funded procurement of drones from countries of concern, with China-headquartered manufacturers (DJI prominently among them) being the obvious target. Separate provisions in the 2024 and 2025 NDAA cycles directed federal agencies to evaluate whether DJI and Autel platforms should be added to the FCC’s Covered List, which would effectively cut off their ability to operate on US communications infrastructure. The FCC began that evaluation in 2024. As of 2026, the regulatory direction is unmistakable even where the final action has not landed.
State legislation has moved in parallel and faster. Florida adopted an “approved vendor” list for state and local government drone use that excluded most Chinese-made platforms, and forced Florida agencies to transition to qualifying alternatives by a hard deadline that has now passed. Other states (Tennessee, Mississippi, Arkansas, and others) have adopted similar restrictions or grant-funding limitations. The state map looks fragmented from the air, but the direction is consistent: public-sector drone use is moving away from Chinese-manufactured platforms regardless of whether the federal ban becomes total.
The substantive security concern underneath the regulatory action is twofold. First is the data path. Commercial drone platforms collect substantial telemetry, including high-resolution imagery, flight paths, and metadata that can be mapped against critical infrastructure. The concern is that the platform manufacturer, or the manufacturer’s home government, can compel disclosure of that data. Second is the control path. A drone whose firmware can be updated remotely by the manufacturer is, in principle, a drone whose flight behavior can be modified by the manufacturer. Whether or not those scenarios have happened in practice, the regulatory framework has decided to treat them as actionable risks rather than hypothetical ones.
For private-sector operators, the legal exposure is more nuanced than for government operators. There is no general federal ban on a commercial photographer using a DJI drone for a real estate listing. But there are several pinch points worth tracking. Operators who hold federal grants or work as contractors on federally funded projects often inherit the federal procurement restrictions through contract terms. Operators in regulated industries (utilities, telecom, oil and gas) are increasingly seeing customer and insurance requirements that mirror the federal restrictions. And operators who fly in airspace requiring Remote ID compliance (which became enforceable in March 2024) now broadcast their identity and location continuously, which has its own privacy and operational implications independent of where the drone was manufactured.
The practical takeaway for any operator with a fleet is to inventory it now, with manufacturer, model, firmware version, and intended use. Then map each use case against the customer contracts, grant terms, and state-law restrictions that apply to it. The companies that ran into trouble in 2024 and 2025 were not the ones who made the wrong choice on a single drone. They were the ones who had not realized that the same drone was on the wrong side of a contract that someone else had signed.