The future of DJI drones in the US is uncertain with the Countering CCP Drones Act, aka the DJI drone ban bil, passing in the US House of Representatives and moving to the Senate. However, one of the central allegations against DJI — that it shares user data with the Chinese government — remains speculative and unsupported by evidence. And now, a new independent audit has reaffirmed that DJI employs stringent data privacy measures for US operators, with no sign of data being transmitted to China.
DJI has voluntarily subjected its products to regular security audits by federal agencies and independent experts since 2017 to ensure transparency. These auditors purchase DJI products off-the-shelf, just like any customer would, and perform rigorous, independent investigations into the drones’ security features.
In its most recent audit, cybersecurity experts from FTI Consulting conducted an extensive review of DJI’s Mavic 3 Enterprise series’ thermal edition (DJI Mavic 3T), the DJI RC Pro controller, and the DJI Pilot 2 software.
New: DJI Air 3 drone falls below $900 as Air 3S price leaks
The results of this latest audit directly address the concerns of US lawmakers and critics who have argued that DJI could be transmitting sensitive data to China. FTI Consulting’s investigation found no evidence to support this claim. In fact, it reaffirmed that any data shared with DJI by US operators is stored on servers within the United States, under US jurisdiction, and is not transmitted overseas.
The audit’s key findings highlight several critical security features implemented by DJI. One such feature is Restricted Network Mode (RNM), which allows users to control what information is shared with both DJI and any third-party services integrated into their drones. This level of user control directly addresses concerns about unauthorized data collection, enabling operators to make informed decisions about their privacy while still benefiting from DJI’s technology.
Another significant finding was the effectiveness of Local Data Mode (LDM) in the DJI Pilot 2 application. According to FTI Consulting, the use of LDM resulted in no outbound traffic, meaning that no data was transmitted to either first-party or third-party services. This provides an added layer of assurance for operators who prefer to use their drones offline or with stricter data privacy controls.
Related: How a ban on DJI drones is crippling US government services
Moreover, FTI Consulting’s audit noted that DJI employs multiple industry best practices to protect data, such as certificate pinning and Transport Layer Security (TLS) encryption for network communications. These security measures are designed to safeguard data from interception and ensure that communications between the drone and DJI servers remain private and secure.
FTI’s assessment also clarified that all first-party data transmissions during the audit were conducted within the United States, and there were no transmissions to Chinese servers. The audit took place on the East Coast, adding further credibility to its findings in a jurisdiction relevant to US privacy concerns.
While the debate over DJI’s presence in the US market continues, these independent audits paint a different picture from what critics allege. DJI’s privacy controls and transparent security practices offer operators the ability to manage their data confidently. The company encourages its users to visit the DJI Trust Center, where they can explore a wide range of privacy controls and security information to stay informed about the latest developments.
Read more: DJI mulls US manufacturing amid drone ban threat, won’t exit market
FTC: We use income earning auto affiliate links. More.
Comments