Flying a package a few miles and lowering it into a garden is the easy part. Drone delivery has been slow to spread because the hard problems are regulatory and logistical: who may fly beyond the pilot’s sight, how an aircraft stays clear of crewed traffic without an air traffic controller, what happens over a crowd, and what paperwork a site needs before the first flight. This explains how the current approvals work in the United States, the five limits that shape every service, and what the proposed new rulebook would change.
Updated October 2026. Aviation rules change and differ by country; check the current guidance from your own regulator before flying anything. This is general information, not operational advice.
How a delivery is authorised today
The Federal Aviation Administration’s own page on package delivery by drone describes the route operators use now: commercial deliveries are conducted under 14 CFR Part 135, the air carrier rules, and the FAA issues certificates, exemptions, waivers and operations specifications for them. Flight paths must stay under 400 feet. Commercial delivery drones have an average wingspan of about five feet and may be fixed wing, multi-rotor or hybrid vertical take-off and landing designs.
There is a second gate most coverage omits. Because these are federal actions, each proposal needs review under the National Environmental Policy Act. The FAA states it has completed more than 20 environmental assessments for individual drone package delivery proposals plus one programmatic assessment, each resulting in a finding of no significant impact, across states including Arizona, Arkansas, California, Florida, Missouri, North Carolina, Ohio, Oregon, Texas, Utah and Virginia. Operators also have to comply with state and local requirements, inform the local community, obtain airspace authorisation, build hub and delivery infrastructure and respond to public inquiries. Mitigations can include reducing daily flights to limit noise or siting a hub away from homes, schools and bald eagle nests.
5 hard limits on drone delivery
- Altitude. Operations stay at or below 400 feet above ground level. That is the shared low-altitude shelf, and it is also where helicopters, crop sprayers and other drones are.
- Weight and therefore payload. Batteries are heavy and lift costs energy, so useful payloads stay small. The regulatory ceiling matters too: the FAA’s proposal would allow certain aircraft to weigh up to 1,320 pounds including everything carried, against the much lower limits of today’s small drone rules.
- Line of sight. Economical delivery needs flight beyond the pilot’s visual range. The FAA notes that operators previously had to obtain individual waivers or exemptions for that, approved case by case, in a process it describes as cumbersome.
- People on the ground. The proposed rule would permit operations over people but not over large open-air gatherings such as concerts, sporting events or crowded parks, with five categories based on population density and restrictions tightening as density rises.
- Separation from crewed aircraft. There is no air traffic controller sequencing these flights. Separation has to come from onboard detect-and-avoid plus third party data services, and from rules that make the drone give way.
What the FAA Part 108 proposal would change
On 6 August 2025 the FAA announced a proposed rule to normalise operations beyond visual line of sight, with the airworthiness and operating requirements placed in a new Part 108. The FAA’s own fact sheet sets out the structure, and it is worth reading because it shows how much of drone delivery is administration rather than aviation.
Operations would run at or below 400 feet from pre-designated, access controlled locations, and every operator would need FAA approval for the area they intend to fly in, identifying boundaries, the approximate number of daily operations, and take-off, landing and loading areas, with assured communications coverage and procedures for lost link. The enabled uses named are package delivery, agriculture, aerial surveying and civic interest including public safety, recreation and flight testing.
Authorisation would come in two tiers. Lower risk operations with limited fleet size, weight and scope would need a permit the FAA could issue promptly. Higher risk operations, by aircraft size, weight, speed or fleet size, would need an operating certificate, with a thorough review, more oversight, a safety management system and a training programme. Certified operators would appoint an operations supervisor responsible for overall safety and security and flight coordinators who directly oversee flights and can intervene, and notably neither role would require an FAA issued airman or remote pilot certificate.
How separation would actually work
This is the technical core. The proposal introduces Automated Data Service Providers, entities the FAA would approve and regulate, whose services keep drones separated from each other and from crewed aircraft and must conform to industry consensus standards after vetting and testing. An operator could be its own provider or contract with another company. Aircraft would also carry technology to automatically detect and avoid other cooperating aircraft, and would have to yield to all crewed aircraft broadcasting position by ADS-B, while staying clear of airports, heliports, seaplane bases, space launch and reentry sites and facilities used by electric vertical take-off and landing aircraft.
Airworthiness would work differently too. Rather than traditional FAA airworthiness certificates, the rule would establish a process for accepting an aircraft based on industry consensus standards, with manufacturers developing and testing to those standards and setting operational limitations. Part 108 aircraft would need lighting and would have to broadcast Remote ID. For the groundwork on that identification layer, see our explainer on drone rules for beginners, and on automated recognition generally, how number plate recognition works.
Security, records and reporting
- Security vetting. The Transportation Security Administration would require operations supervisors, flight coordinators and other covered personnel to obtain up to a level 3 security threat assessment, which may include a watchlist check, an immigration check and a fingerprint based criminal history records check.
- A security programme for delivery. TSA would also require permitted and certificated package delivery operators to obtain a limited security programme.
- Cyber and physical security duties. Operators would have to implement physical and cybersecurity policies, prepare for and mitigate cyber attacks, and manufacturers would have to protect aircraft from intentional electronic interference.
- Flight records. Operators would record each flight’s date, time and duration, aircraft registration, purpose, flight path including origin, destination and altitudes, assigned personnel and landing locations, plus mechanical issues, maintenance and training.
- Reporting thresholds. Reportable events would include unplanned or precautionary landings, loss of control or communication, failure of an automated data service, security breaches and any operation causing more than 500 dollars of property damage.
Read that list and the shape of the industry becomes clear. Drone delivery scales where flight paths are repeatable, sites are fixed, payloads are light and the value per delivery is high, which is why medical and pharmacy logistics keep appearing first, and badly where routes are ad hoc and the cargo is cheap. Eventually most deliveries are expected to operate within unmanned aircraft system traffic management, which the FAA describes as a cooperative arrangement in which it provides real-time airspace constraints and operators manage their own flights safely within them, without positive air traffic control services. That is a different model of automation from the one in our piece on levels of self-driving.
Common questions
Is drone delivery legal in the United States? Yes, under existing authorisations. The FAA states that commercial package delivery is conducted under Part 135 air carrier rules, with certificates, exemptions, waivers and operations specifications issued case by case, and flights kept under 400 feet.
What is BVLOS and why does it matter? Beyond visual line of sight means flying outside the pilot’s direct view. It is what makes delivery economic, and the FAA notes operators previously needed individual waivers or exemptions granted case by case.
What is FAA Part 108? A proposed new part of the regulations, announced on 6 August 2025, covering airworthiness and operating requirements for routine flights beyond visual line of sight, with permits for lower risk operations and operating certificates for higher risk ones.
Can delivery drones fly over people? The proposal would allow flights over people but not over large open-air gatherings such as concerts, sporting events or crowded parks, with five categories based on population density and restrictions increasing with density.
Why is it taking so long? Because each service needs airspace approval, environmental review under NEPA, local engagement and site infrastructure. The FAA says it has completed more than 20 environmental assessments for individual package delivery proposals plus one programmatic assessment.
Sources and further reading
Where the figures and rules above come from, so you can check them:
- Proposed Part 108 operations, altitude, aircraft weight, permits and certificates, operations over people, security, records and reporting: FAA BVLOS Fact Sheet
- Announcement of the proposed BVLOS rule, 6 August 2025: FAA Newsroom
- Part 135 package delivery, 400 foot limit, environmental assessments and UTM: FAA, Package Delivery by Drone
- Waivers and exemptions previously required for BVLOS and the uses the proposal would enable: US Department of Transportation and FAA announcement
Photo credit: Zipline-package-drop by Roksenhorn, CC BY-SA 4.0, via Wikimedia Commons.
Join the discussion