DJI Responds To Ontario Ban, Calls Decision Country-Of-Origin Move Without Proven Evidence

DJI is pushing back on Ontario’s May 20 decision to ban Chinese-made drones for sensitive Ontario Provincial Police operations and to phase out broader provincial government use, calling the move a country-of-origin decision unsupported by published evidence. In a statement, DJI said its drones have undergone multiple independent and government security evaluations, and pointed to disclosure controls that keep flight logs, photos, and videos off DJI servers by default.

The response is the standard DJI line of 2026: cite the audit record, dispute the absence of a published vulnerability finding, and warn of operational costs to public safety agencies. Ontario’s announcement, presented in its May 20 release, did not name DJI directly but is widely understood to affect the company’s hardware, which dominates Canadian municipal police drone fleets.

The Statement, In DJI’s Own Words

The DJI spokesperson framed the Ontario decision as a policy choice that overrides documented technical assessments in favor of geographic risk attribution, and warned that no closely comparable Western platform delivers the same combination of payload capability, thermal performance, and price for municipal public safety work.

The full statement is brief. “DJI is disappointed to learn of the Government of Ontario’s decision to restrict the use and purchase of life-saving drone technology based solely on the manufacturer’s country of origin,” the spokesperson said. The company described “the most robust privacy control features in the industry,” a self-superlative that is unverifiable by definition but is grounded in documented technical controls including Local Data Mode and U.S.-based AWS server storage for U.S. users. The spokesperson said “users are not required to share photos, videos, or flight logs with DJI, and by default, none of this data is synced with DJI,” framed the concerns Ontario raised as “simply not supported by any proven evidence,” and urged provincial authorities to weigh “the substantial impact this decision may have on public safety agencies.”

The Audit Record DJI Is Pointing To

The company’s audit-record claim is grounded in seven years of documented third-party work. Booz Allen Hamilton tested the DJI Government Edition Mavic Pro, Matrice 600 Pro, and Mavic 2 Enterprise in 2020 and found no evidence of data transmission to DJI, China, or any unexpected party. FTI Consulting audited the Mavic 3T, Pilot 2 app, and RC Pro controller in 2024 and again found no unexpected data transmission, with zero outbound traffic in Local Data Mode. Kivu Consulting reviewed DJI drones, mobile apps, and servers and found users control what data is collected and transmitted. TÜV SÜD has audited DJI consumer products. Government bodies that have evaluated DJI include the U.S. Department of the Interior, Idaho National Laboratory at DHS direction, and NOAA. DJI products have also received ISO 27001, ISO 27701, NIST FIPS 140-2 CMVP Level 1, and AICPA SOC2 certifications, as DroneXL has documented across DJI’s federal appeals.

Where The Audit Record Stops

The audit record covers drone hardware, mobile applications, and server data flows for specific tested models. It does not directly address the structural concern Ontario cited, which is the disclosure obligations Chinese companies face under the PRC National Intelligence Law of 2017 and the Data Security Law of 2021. A hardware audit can show no data is leaving the drone today, and the legal disclosure obligation would still exist tomorrow. The most direct test of that risk is a published vulnerability finding from the Canadian Centre for Cyber Security, the federal authority that issues technical assessments on foreign-manufactured equipment risk. Ontario has not produced one in its May 20 release.

The audit record also has an exception worth naming. In February 2026 a researcher remotely accessed live audio and video feeds from approximately 7,000 DJI ROMO robot vacuums through a server-side vulnerability that DroneXL covered at the time. The breach was unrelated to drones, but it showed that DJI’s cloud infrastructure can fail in ways that individual hardware audits do not catch. The Foundation for Defense of Democracies, a Washington-based advocacy organization that has lobbied for restrictions on Chinese technology, cited the ROMO incident in its March 2026 FCC filing arguing that DJI’s broader product surface raises concerns that drone-only audits miss.

DroneXL’s Take

DJI’s statement is the same playbook the company has run since the 2020 Booz Allen audit, and the audit record it cites is real and well-documented. Every published hardware audit has found no exfiltration to China for the specific models tested. The company is also broadly correct on the operational point, though “no comparable” is too absolute. The Skydio X10 has an autonomous-dock and Axon-integrated software stack DJI does not match, and Brinc Lemur has indoor-tactical strengths DJI does not match. On payload capacity, thermal sensor performance, and per-unit price for outdoor patrol and search work, the DJI Matrice 4T and Matrice 30T remain the harder targets to replace, and the Florida and RCMP track records support the warning DJI is raising.

What is missing from the DJI response is direct engagement with the part of Ontario’s argument that no hardware audit can resolve: China’s disclosure-law framework. The cleanest answer to that concern would be DJI’s explicit offer to submit to a specific Canadian government audit conducted by the Canadian Centre for Cyber Security, with results published. DJI requested exactly that kind of review from U.S. federal agencies in 2024 and 2025, and no federal agency completed it. Ontario has not asked. If DJI proactively offers a Canadian technical review and Ontario declines to commission one, the asymmetry will land squarely in the province’s column.

Watch whether the consultation period the ministry described as opening “in the coming weeks” produces a per-model security finding from a Canadian technical authority. If a Canadian cybersecurity body publishes a specific vulnerability assessment, the policy moves from country-of-origin framing into evidence-based regulation. If the consultation closes without one, the country-of-origin objection in DJI’s statement holds.

Sources: DJI PR Team statement provided directly to DroneXL, Government of Ontario News Release.

DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo.