Action Camera and Drone Privacy UK 2026: What GoPro and DJI Know About You

Action cameras and drones have become genuinely mainstream consumer technology. GoPro HERO cameras are standard kit for cyclists, surfers, and skiers. DJI drones are flown by hobbyists, estate agents, and content creators across the UK. Insta360's 360-degree cameras are increasingly popular for immersive video. But alongside the footage you capture, these devices — and the apps that control them — collect a significant amount of data about you, your location, and your behaviour.

This guide examines what the major manufacturers collect, how UK law applies, what your legal obligations are when filming with a drone in the UK, and practical steps you can take to reduce your data footprint without giving up your camera or drone entirely. All information is based on publicly available privacy policies, UK Civil Aviation Authority (CAA) guidance, and Information Commissioner's Office (ICO) documentation as of September 2026.

What Data Do Action Cameras and Drones Collect?

The camera hardware itself does not transmit data — it records to a memory card. The data collection happens through the companion apps you use to control the device, transfer footage, and access cloud services. Understanding this distinction is important: you can use many action cameras and drones with minimal data exposure if you choose not to use the manufacturer's app or cloud services.

GoPro: What the HERO13 Black and GoPro Quik App Collect

The GoPro HERO13 Black (available in the UK at approximately £399 as of September 2026 from Amazon UK, Currys, and John Lewis — prices subject to change) connects to your smartphone via Bluetooth and Wi-Fi through the GoPro Quik app. When you use the Quik app, GoPro's privacy policy states that the company may collect:

• Device identifiers: Your smartphone's advertising ID, device model, and operating system version.
• Usage data: Which features you use within the app, how often you open it, and how long sessions last.
• Location data: If you grant location permission, the app can access your GPS coordinates. This is used for features like GPS overlays in footage and the GoPro map feature.
• Footage metadata: When you upload footage to GoPro Plus cloud storage, metadata including timestamps, GPS coordinates embedded in the video, and camera settings are transmitted alongside the footage.
• Account information: If you create a GoPro account, your name, email address, and subscription status are stored on GoPro's servers.

GoPro is a US-headquartered company. Data from UK users is transferred to and stored on servers in the United States. Under UK GDPR, GoPro must have a lawful basis for this international data transfer — GoPro relies on Standard Contractual Clauses (SCCs) for transfers from the UK to the US.

GoPro Plus, the subscription cloud storage service, automatically uploads footage from your camera when connected to Wi-Fi. If you subscribe to GoPro Plus, your footage is stored on GoPro's servers. GoPro's terms of service grant the company a licence to use your content for promotional purposes unless you opt out — this is worth reviewing in the app settings.

DJI: What the Mini 4 Pro, Air 3, and DJI Fly App Collect

DJI is the world's largest consumer drone manufacturer and is headquartered in Shenzhen, China. This has attracted significant scrutiny from governments in the US and EU regarding data security. In the UK, DJI drones remain legal to purchase and fly, but users should be aware of the data practices involved.

The DJI Mini 4 Pro (approximately £759 as of September 2026 from Amazon UK and Currys — prices subject to change) weighs 249g, placing it just under the 250g threshold that triggers CAA registration requirements. The DJI Air 3 (approximately £1,049 as of September 2026 from Amazon UK and Currys — prices subject to change) weighs 720g and requires CAA registration.

The DJI Fly app, required to fly most DJI consumer drones, collects:

• Flight logs: Every flight is logged, including GPS coordinates of takeoff and landing points, flight path, altitude, speed, and duration. These logs are stored locally on your device and, unless you opt out, transmitted to DJI's servers.
• Device information: Your smartphone model, operating system, and app version.
• Location data: The app requires location access to display maps, enforce geofencing (DJI's FlySafe system), and log flight data.
• Video metadata: If you use DJI's cloud services, footage metadata including GPS coordinates, timestamps, and camera settings is transmitted.
• Account data: If you create a DJI account, your name, email, and country of residence are stored.

DJI states in its privacy policy that data may be stored on servers in China and the United States. DJI has implemented a Local Data Mode in the DJI Fly app, which prevents the app from transmitting any data to DJI's servers during a flight session. This is the most effective privacy measure available to DJI drone users and is discussed further in the practical steps section below.

DJI's FlySafe geofencing system automatically restricts flight in certain areas (near airports, prisons, and other sensitive locations). This system requires the drone to check in with DJI's servers to receive up-to-date geofencing data. In Local Data Mode, this check-in does not occur — which means you must ensure you are not in a restricted zone before enabling Local Data Mode, as the automatic restriction will not apply.

Insta360: What the X4 and Insta360 App Collect

The Insta360 X4 (approximately £449 as of September 2026 from Amazon UK and Currys — prices subject to change) is a 360-degree action camera that connects to the Insta360 app for footage transfer and editing. Insta360 is also a Chinese company, headquartered in Shenzhen.

The Insta360 app collects device identifiers, usage analytics, and — if you use Insta360's cloud storage — footage metadata. Insta360's privacy policy states that data may be transferred to servers outside the UK, including in China. As with DJI and GoPro, you can limit data collection by not creating an account and not using cloud storage features.

UK Legal Framework: What You Need to Know

UK GDPR and the Data Protection Act 2018

UK GDPR (the UK's post-Brexit version of the EU's General Data Protection Regulation) applies to any company that processes personal data of UK residents, regardless of where the company is based. This means GoPro, DJI, and Insta360 are all subject to UK GDPR when handling data from UK users.

Under UK GDPR, you have the right to:

• Access the personal data a company holds about you (Subject Access Request)
• Request deletion of your personal data (Right to Erasure)
• Object to processing of your data for certain purposes
• Withdraw consent for data processing where consent is the lawful basis

If you believe a company has mishandled your data, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Filming Other People: Your Obligations Under UK Law

When you film identifiable individuals with an action camera or drone, UK GDPR may apply to you as well — not just to the manufacturer. The ICO has published guidance on drone filming that is worth reading before you fly.

Key points from ICO guidance:

• Filming in public spaces: Generally permitted, but you must not film in a way that is intrusive or that a reasonable person would find objectionable. Systematic or repeated filming of specific individuals without their knowledge is likely to breach UK GDPR.
• Filming private property: Filming into private gardens, homes, or other private spaces without permission is likely to breach both UK GDPR and potentially the Protection from Harassment Act 1997.
• Storing footage of identifiable people: If you store footage that clearly identifies individuals, you are processing personal data and UK GDPR applies. For purely personal or household use (filming your own family on holiday, for example), the household exemption in the Data Protection Act 2018 applies and you are not subject to the full requirements of UK GDPR.
• Commercial use: If you use footage commercially — for a YouTube channel, estate agency, or any paid work — the household exemption does not apply and you must comply with UK GDPR in full.

CAA Drone Regulations: Your Legal Obligations

The Civil Aviation Authority (CAA) regulates drone use in the UK under the Air Navigation Order 2016 (as amended) and subsequent regulations. The key rules for recreational drone users are:

• Registration: If your drone weighs more than 250g, you must register as an operator with the CAA (£9 per year via the CAA's Drone and Model Aircraft Registration and Education Service, DMARES). You must also pass an online theory test to obtain a Flyer ID.
• Weight threshold: The DJI Mini 4 Pro at 249g falls just under the 250g threshold and does not require registration. The DJI Air 3 at 720g requires both Operator ID and Flyer ID.
• Maximum altitude: In the Open Category (for recreational and low-risk commercial use), the maximum altitude is 120 metres (approximately 400 feet) above ground level.
• Visual line of sight: You must keep your drone within your visual line of sight at all times.
• No-fly zones: You must not fly within 5km of an airport or aerodrome without permission. Other restricted zones include prisons, military sites, and areas designated by the CAA. DJI's FlySafe system enforces many of these restrictions automatically, but you remain legally responsible for compliance.
• UK Drone Code: The CAA's Drone Code summarises the key rules: fly below 120m, keep the drone in sight, never fly near airports, always follow the manufacturer's instructions, and respect the privacy of others.

Breaching CAA regulations can result in fines and, in serious cases, criminal prosecution. Always check the CAA's drone map and the NATS (National Air Traffic Services) drone assist app before flying.

Practical Steps to Protect Your Privacy

1. Enable DJI Local Data Mode

If you fly a DJI drone, enabling Local Data Mode in the DJI Fly app is the single most effective step you can take. In Local Data Mode, the app does not transmit flight logs, location data, or any other information to DJI's servers during your session. To enable it: open DJI Fly, go to Profile → Privacy Settings → Local Data Mode. Note that geofencing will not be enforced in this mode, so you must manually verify you are not in a restricted zone before flying.

2. Review and Restrict App Permissions

On both iOS and Android, you can review and restrict the permissions granted to GoPro Quik, DJI Fly, and Insta360 apps. Consider:

• Revoking location access when not actively using the app (set to 'While Using' rather than 'Always')
• Disabling microphone access if you do not use voice control features
• Disabling contacts access (some apps request this unnecessarily)

3. Disable Automatic Cloud Upload

GoPro Quik can automatically upload footage to GoPro Plus when your camera is connected to Wi-Fi. If you do not want your footage stored on GoPro's servers, disable this feature in the app settings. Similarly, DJI and Insta360 apps offer cloud sync features that can be disabled.

4. Use Offline Editing Software

Instead of using manufacturer apps for editing, consider transferring footage directly from the memory card to your computer and using offline editing software such as DaVinci Resolve (free), Adobe Premiere Pro, or Final Cut Pro. This avoids transmitting footage to manufacturer servers entirely.

5. Delete Flight Logs Regularly

DJI Fly stores flight logs locally on your device. You can delete these from within the app. If you are concerned about the data these logs contain, delete them after each session.

6. Do Not Create an Account Unless Necessary

Many features of GoPro Quik, DJI Fly, and Insta360 apps work without creating an account. Avoiding account creation limits the personal data associated with your usage. Note that some features — including cloud storage and firmware updates — may require an account.

7. Exercise Your UK GDPR Rights

If you want to know what data GoPro, DJI, or Insta360 holds about you, you can submit a Subject Access Request (SAR) to each company. Under UK GDPR, they must respond within one month. You can also request deletion of your data. Contact details for data protection requests are available in each company's privacy policy.

8. Be Mindful When Filming Others

Before filming in areas where you might capture identifiable individuals, consider whether your filming is proportionate and respectful. Avoid filming into private gardens or homes. If you are filming commercially, ensure you have a lawful basis under UK GDPR for processing footage of identifiable people.

How Do the Manufacturers Compare on Privacy?

Should You Be Worried?

For the vast majority of recreational users, the practical privacy risk from action cameras and drones is low — provided you take sensible precautions. The data collected by these apps is broadly similar to what any smartphone app collects: device identifiers, usage analytics, and location data if you grant permission.

The more significant concern with DJI specifically is the Chinese data jurisdiction question. DJI has stated that it does not share user data with the Chinese government, and there is no publicly documented evidence that it has done so. However, Chinese law does require companies to cooperate with state intelligence requests, which creates a theoretical risk that does not exist with US-headquartered companies subject to US law. For most recreational users, this risk is academic. For professionals working in sensitive environments — government contractors, journalists, security researchers — it may be worth considering alternative manufacturers or using DJI's Local Data Mode consistently.

The more immediate and practical concern for UK drone users is compliance with CAA regulations. Flying without registration (where required), exceeding altitude limits, or flying near airports carries real legal consequences. The ICO's guidance on filming identifiable individuals is also worth reading before you use a drone commercially.

Key Takeaways

• Action cameras and drones collect data primarily through their companion apps, not the hardware itself. You can significantly reduce data exposure by limiting app permissions and avoiding cloud services.
• DJI's Local Data Mode is the most effective privacy tool available to drone users — enable it if data transmission to DJI's servers concerns you.
• UK GDPR applies to GoPro, DJI, and Insta360 when they process data from UK users. You have rights including Subject Access Requests and the right to erasure.
• If your drone weighs over 250g, you must register with the CAA and obtain a Flyer ID. The DJI Mini 4 Pro at 249g is exempt; the DJI Air 3 at 720g is not.
• When filming identifiable individuals commercially, UK GDPR applies to you as the data controller. The ICO's drone filming guidance is the authoritative reference.
• For most recreational users, the practical privacy risk is manageable with sensible app settings and an awareness of what data is being collected.

All prices quoted are approximate UK retail prices as of September 2026 and are subject to change. Regulatory information is based on CAA and ICO guidance current as of September 2026 — always check the CAA and ICO websites for the latest rules before flying.