Unmanned Aerial Systems (UAS), commonly referred to as drones, are increasingly used in Canada for commercial purposes such as infrastructure inspection, real estate photography, agriculture, filmmaking, mapping and resource exploration. Their advantages are clear: they are flexible, relatively inexpensive and capable of collecting information from angles and locations that would otherwise be difficult to access.
However, drone operations raise legal risks that go beyond aviation compliance. A commercial operator must consider not only Transport Canada’s rules, but also privacy obligations, civil liability, insurance coverage and potential criminal exposure.
Canada's Regulatory Framework
General Rules and Baseline Restrictions
Drone operations in Canada are governed primarily by Part IX of the Canadian Aviation Regulations (CARs), [1] administered by Transport Canada.
The regime is risk-based. Drones weighing less than 250 grams (microdrones) are exempt from registration and pilot certification, though general safety rules still apply. Drones weighing 250 grams or more must be registered with Transport Canada, marked with their registration number, and flown only by a certified pilot.
Regardless of category, baseline restrictions apply across the board: drones may not be flown above 400 feet, near emergency operations or special events, or within prescribed distances of airports and heliports, absent specific authorization.
Categories of Operations
Operations are classified into three main categories: [2]
Basic operations require the drone to remain within visual line of sight, at least 30 metres horizontally from bystanders, in uncontrolled airspace, and with a maximum weight of 25 kilograms. Pilots must hold a Pilot Certificate for Basic Operations.
Advanced operations include any operation that does not meet all the criteria for basic operations, such as flights conducted closer to bystanders or within controlled airspace. Pilots must hold a Pilot Certificate for Advanced Operations and complete a flight review. Operators must also conduct a site survey and maintain records identifying potential hazards and obstacles.
Level 1 complex operations represent the most significant recent regulatory development. This category establishes a structured framework for certain beyond visual line of sight (BVLOS) operations carried out over unpopulated or sparsely populated areas. These operations are subject to strict conditions, including limits on altitude, operation in uncontrolled airspace, and minimum distances from aerodromes.Pilots conducting Level 1 complex operations must hold a Pilot Certificate for Level 1 Complex Operations, which requires additional training, an examination, and a flight review. They must also operate under a Remotely Piloted Aircraft System (RPAS) Operator Certificate, a new organizational credential that requires an accountable executive, a designated maintenance lead, formal training programs, operational documentation, and a safety risk management process.
Operations that do not fall within these three categories generally require a Special Flight Operations Certificate (SFOC) issued on a case-by-case basis. This includes, for example, operations involving large drones, foreign operators, multiple drones, or BVLOS conducted in controlled airspace or populated areas.
What This Means for Commercial Operators
While the rules are not formally divided between recreational and commercial use, most commercial activities naturally fall into the more regulated categories. Operations such as inspections, surveying, filming, or delivery are more likely to occur near people, in controlled airspace, or BVLOS, placing operators within the advanced or Level 1 complex categories.
Routine, lower‑risk activities may qualify as basic operations, but moving into more complex environments brings added approvals, documentation, oversight, and potentially an SFOC. Properly classifying each activity within the appropriate category is therefore essential.
Seeing Without Intruding
While compliance with the CARs is essential, it represents only one dimension of the broader legal framework. One of the principal legal concerns with drones is privacy. Drones can capture high-resolution images, video, location information, and other data that may identify individuals, vehicles, or private property. Even where a person is captured incidentally, the information collected may constitute personal information once combined with other data, therefore triggering statutory obligations regardless of the operator’s intent.
Federal Baseline
At the federal level, the Personal Information Protection and Electronic Documents Act (PIPEDA) [3] regulates the collection, use, and disclosure of personal information in the course of commercial activity. It generally requires meaningful consent and limits collection to what is necessary for identified purposes, guided by principles including accountability, limiting collection, safeguarding personal information, and providing individuals a means of recourse.
In practice, obtaining advance consent from individuals captured incidentally during drone operations is often not feasible. Operators must instead carefully limit the scope of collection and adopt practical safeguards, including advance notice where possible, blurring of faces or licence plates, and employee training on privacy obligations.
Provincial Regimes
Provincial privacy legislation may also apply. Québec, British Columbia, and Alberta each have private-sector privacy statutes deemed substantially similar to PIPEDA,[4] meaning they generally apply instead of the federal statute to provincially regulated companies operating wholly within those provinces. These regimes impose broadly similar obligations around consent, collection limits, safeguarding, and accountability.
Québec’s regime, however, is notably more stringent following Law 25, which imposes enhanced governance obligations, mandates privacy impact assessments in certain circumstances (squarely applicable to camera-equipped commercial drones) and provides for potentially significant penalties for non-compliance, up to the greater of 4% of worldwide turnover or CAD $25 million.
Ontario does not have a comparable private-sector privacy statute (although PIPEDA applies), but operators may still face civil liability through the common law tort of intrusion upon seclusion, which applies where an intentional or reckless invasion of a person’s private affairs would be considered highly offensive to a reasonable person.
As a result, drone operators should treat privacy compliance as a front-end operational requirement, particularly in Québec.
When Flights Go Sideways
Drone operations may give rise to civil liability where they cause injury, property damage or interference with the use and enjoyment of property. In common law provinces, claims may be framed in negligence, nuisance, trespass or privacy torts. In Québec, liability may arise under article 1457 of the Civil Code of Québec, which requires individuals and organizations to act prudently and diligently. Article 976 may also be relevant where drone activity causes abnormal neighbourhood annoyances. In this context, low-altitude, repeated or intrusive flights over private property are especially risky.
Drone Insurance
Transport Canada recommends obtaining public liability insurance for drone operations, although it is not legally required. Operators should not assume that standard commercial general liability policies will respond to drone-related losses, as many policies exclude losses connected to aircraft operations. Dedicated drone insurance should therefore be considered.
A well-constructed drone insurance program should ideally address the following:
- third-party bodily injury and property damage;
- hull and equipment coverage for the drone itself;
- payload coverage where sensors, cameras, or cargo are carried;
- cyber liability for data collected, stored, or transmitted by the drone; and
- legal defence costs in the event of regulatory proceedings or civil claims.
Regulatory and Criminal Exposure
Non-compliance with the CARs exposes operators to administrative monetary penalties of up to CAD $5,000 for individuals and up to CAD $25,000 for corporations, depending on the nature of the violation, with higher penalties available for serious airspace violations. Transport Canada also publicly names corporate offenders when penalties are levied, a meaningful reputational consideration for commercial operators.
Finally, the Criminal Code may also apply where a drone operator creates mischief, flies while impaired, or endangers the safety of persons or other aircraft.
The Sky Is Not the Limit
Canada’s drone regulatory framework is among the most structured in the world, but compliance with Transport Canada’s rules is only the beginning. Commercial operators face a converging set of obligations under aviation law, federal and provincial privacy legislation, and civil liability.
The key takeaways: (i) registration and certification satisfy the regulator, but they do not satisfy the plaintiff or the privacy commissioner; (ii) operators in Québec face the most onerous obligations in the country, primarily because of enhanced privacy requirements; and (iii) insurance programs should be reviewed for gaps that standard products leave unaddressed.
