Remote ID is a digital identification system that lets a flying drone broadcast its identity, location and flight data in real time. In the US it is meant to be readable by ordinary phones. US rules took effect in 2021, with operator compliance required by 16 September 2023, and the EU has its own version called Direct Remote Identification.
What gets broadcast
The ASTM F3411 Open Drone ID standard describes messages that cover identifiers, location, altitude, direction and speed. It uses Wi-Fi for longer range and Bluetooth Low Energy for shorter range.
The key design choice is that the broadcast goes out in the open. Anyone with a compatible receiver can read it, which is how the system supports airspace awareness and enforcement.
US dates
According to the reference summary of the FAA rules:
- The final rule and Part 89 regulations were published in the Federal Register on 15 January 2021.
- The rule took effect on 16 March 2021, except for Subpart C, which took effect on 16 September 2022.
- Small drone operators had to comply by 16 September 2023.
- The FAA ended its discretionary enforcement period on 16 March 2024.
Check the FAA's current pages for exceptions and exemptions before you rely on this list.
EU equivalent
In the EU, Regulation 2019/945 requires Remote ID on drones over 250 grams flying below 120 meters in the Open or Specific category, and the system must allow wireless access to the operator ID. Regulation 2019/947 requires operators to affix their operator ID to the drone. A European standard in draft lists Bluetooth 5 Long Range, Wi-Fi Beacon and Wi-Fi NAN as mandatory.
Security and privacy questions
A public broadcast raises questions that product teams should think through.
- Privacy. Anyone nearby can see the drone's identity and position. Operators should know that the broadcast reveals where they are flying.
- Trust. A broadcast is only information. Whether a receiver can trust it depends on how identifiers are issued and checked, which is outside what this post can confirm.
- Software. The module that creates the broadcast is software with updates, dependencies and a supply chain, like any other.
What developers should do
If you build drones or apps that read Remote ID:
- Read the standard and the current rule text for the market you ship in.
- Treat received broadcasts as untrusted input and validate fields before using them.
- Decide what your app stores about nearby drones, and for how long.
- Keep the broadcast module updatable in the field.
Safeguard's SBOM and dependency scanning can inventory the libraries in an app that reads or generates these messages.
Quick check
Is Remote ID encrypted?
It is described as a broadcast readable by smartphones and similar devices, so the content is meant to be received openly.
Does the EU use the same system?
No. The EU calls its system Direct Remote Identification and sets its requirements in Regulations 2019/945 and 2019/947.
Sources
Last reviewed: 19 October 2026.
