What Is a No-Fly Zone? Rules, Geofencing and Enforcement

A no-fly zone (NFZ) is a rule set by a competent authority that prohibits or restricts aircraft from flying in a defined volume of airspace. It is not a feature built into a drone. The rules are established by national aviation authorities; in the United States, for example, only the FAA can restrict airspace. A vendor’s geofence is only a software-level advisory or restriction, and DJI has turned most of its hard no-fly restrictions into warnings over 2024 and 2025. What actually makes a no-fly zone work, therefore, is ground-side detection and mitigation, and only agencies holding a legal mandate can carry that out.

This article deals with no-fly zones in the drone context. Military no-fly zones over conflict areas, and the conflict airspace that airlines route around, are two separate concepts and are outside the scope of this article.

In a military context, a no-fly zone is usually established over the airspace of one party to a conflict; unauthorised flight may be intercepted by force, and enforcement is governed by the law of armed conflict (see Wikipedia: No-fly zone).

In the civil drone context, a no-fly zone is airspace that the competent authority has designated as off-limits to drones, or that requires prior authorisation to enter. It is commonly found around airports, military and government facilities, critical infrastructure, prisons, and large events.

Different countries use different drone terminology for the same thing:

Permanent. Airports and their surroundings, military and government facilities, critical infrastructure, and sites needing dedicated prison air defense, such as correctional facilities. The UK Civil Aviation Authority’s list of restricted sites includes prisons, military ranges, royal palaces, and government buildings (CAA Drone Code). Japan sets a red zone around important facilities and a yellow zone of about 300 m, and flying is likewise banned within about 300 m of Self-Defense Force and US military facilities (MLIT).

Temporary. TFRs in the United States are the classic example. The FAA explains that TFRs are used for major sporting events, space launches and re-entries, presidential travel, and security-sensitive areas designated by federal agencies (FAA No Drone Zone). According to AviNews, relaying notifications from the FBI and the FAA, Denver’s Empower Field at Mile High bans drone flights within three miles for one hour before and after each NFL game. The same source also reports that Pennsylvania State Police imposed a 3-nautical-mile, 3,000-foot TFR over Beaver Stadium on September 19, 2026, alongside counter-drone operations.

Local. US state and local governments can restrict only drone takeoff and landing; they cannot restrict flight overhead. The FAA’s No Drone Zone sign is provided for government agencies to use, and private property owners cannot use it to stop others from flying over their property (FAA).

The common thread across countries is this: the power to restrict airspace is concentrated in a single competent authority.

The US FAA makes clear that only the FAA can restrict airspace. Italy’s civil aviation authority ENAC is equally explicit that other bodies cannot issue overflight bans on their own, and that restrictive measures not taken by ENAC are invalid (ENAC). In China, flight in controlled airspace requires approval from the air traffic management body (full text of the regulation).

The direct consequence of this principle: individuals and companies cannot designate a no-fly zone themselves, not even over their own property.

These countries follow roughly three approaches:

Brazil and Mexico rely more on registration plus airspace applications. The legal concept behind a “no-fly zone” is not the same in every country, so it cannot simply be transplanted for cross-border operations.

Official tools first. In the United States, FAA-recognised B4UFLY service providers can be used to check restrictions, and the TFR list and UAS Facility Maps provide official data. The UK CAA points to NATS’s airspace restriction map, Italy uses the D-Flight map as authoritative, Canada has the NRC Drone Site Selection Tool, and China checks through the UOM platform.

Vendor maps are for reference only. DJI states plainly that FlySafe data provides reference-level advisories and cannot replace the official airspace data published by national aviation authorities (DJI announcement). The UK CAA likewise warns that restriction information inside drone software may not be up to date.

How data becomes a map. The EU requires member states to publish geographical zones in a common digital format. Guidance from EASA references the EUROCAE ED-269 data model, and ED-318, published in 2024, further standardises how the data is provided and exchanged. Around this data, a set of open-source tools has appeared in the community:

Most of these projects carry their own “not for actual flight decisions” disclaimer. They are data reference tools, not flight authorisation. A real-time answer to “is there a no-fly zone nearby” can come only from official channels or an authorised service.

First, separate two words that are often conflated. “Geofence” can mean either a restriction a vendor builds in for compliance, or a work boundary a pilot draws for a single mission; the latter is common on mission platforms and open-source flight controllers. The table below covers the former, while noting the latter where relevant.

DJI’s timeline of change:

DJI’s own position is that the GEO system has always been an educational tool, not an enforcement tool.

First, it is a voluntary software restriction. A geofence depends on the drone’s own satellite positioning and built-in database, so it works only on aircraft whose operators are willing to comply and whose software has not been modified. DJI itself frames it as an educational tool. Security-industry analysis also notes that no other vendor has implemented geofencing as widely as DJI, so DJI’s change has a large impact on airspace safety.

Second, many aircraft simply do not have the restriction. Fences on open-source flight controllers are drawn by the user, and self-assembled airframes do not ship with an official no-fly zone database. Searches for “drones without geofencing” are not uncommon online, and some vendors even treat this as a selling point. Aircraft with modified firmware can also bypass built-in restrictions.

Third, Remote ID solves only the problem of identifying “cooperative” parties. The US requires most drones to broadcast Remote ID, but according to notifications from the FBI and the FAA relayed by AviNews, switching it off or failing to comply is itself a separate violation, and authorities also detect drones when Remote ID is not enabled. Broadcasting has meaning only for flights that are willing to comply.

Fourth, existing airport detection means are not aimed at small drones. According to AirSight’s explanation, an airport’s conventional air traffic control radar usually cannot detect small drones, and consumer drones do not appear in public flight-tracking services.

The conclusion: a vendor geofence hands compliance responsibility back to the pilot, whereas making a no-fly zone actually work requires a layer of enforcement that does not depend on pilot cooperation.

Ground-side enforcement breaks down into roughly four steps:

The US Federal Aviation Administration receives more than 100 drone sighting reports near airports every month (FAA). The FAA has already tested drone detection technology at airports and extended testing beyond airports, including one test conducted with US Customs and Border Protection. The purpose of these tests is to evaluate the effectiveness of the technology and to confirm whether it interferes with FAA or aircraft navigation systems.

The use of mitigation tools is subject to strict legal thresholds:

Whether the means is jamming, spoofing, or something else, it should only be used by agencies holding a legal mandate. That is also why this article does not discuss how individuals might “deal with” the drone overhead.

Most drones rely on GNSS (GPS, BeiDou, and similar) to determine their own position, and use that to trigger protective logic such as geofencing, return-to-home, and landing. Satellite-navigation spoofing builds on this: inside a protected area, an authorised party supplies controlled navigation information to the drone’s receiver, so that its position fix drifts or fails, which triggers the drone’s own protective behaviour, such as refusing to take off, hovering, landing, or returning home.

From an engineering standpoint, compared with detection schemes that rely on multiple sensors, this approach has several characteristics:

But it has several limitations that must be stated clearly:

AE Defense has products in this area. If your organisation holds the authorisation required in your country and would like to understand a scheme suited to an event site, our team is happy to talk.

Penalties vary widely from country to country. Examples that can be cited from official or authoritative sources are as follows:

Penalties in other countries are governed by the official publications of the relevant authorities.

Individuals cannot designate a no-fly zone themselves, nor can they shoot down or jam a drone overhead. The FAA is explicit that the No Drone Zone sign is not for use by private property owners, and that owners do not own the airspace above their property.

The lawful course is to document the situation and report it to the competent authority:

A no-fly zone is a system built from three layers: rules, data, and enforcement. The rules are set by the competent authority, the data makes them queryable, and enforcement depends on means that do not rely on pilot cooperation. As vendors hand responsibility back to pilots, ground-side detection and mitigation become more important, and they require both strict legal authorisation and an assessment of side effects.