Eight municipal police departments now run drone units, and the authority to fly is clear — Article 99-16(2) of the Civil Aviation Act exempts agencies performing statutory duties. But that is a flight-safety exemption: a Taipei City legal opinion says it 'may be unable to serve as the legal basis for conducting administrative investigation by drone', and the special-compulsory-measures chapter passed in July 2024 authorises GPS, IMSI-catchers and private-space imaging with no aerial-investigation provision at all.
Taiwan's Civil Aviation Act drone chapter regulates flight safety, not the people being flown over — and that isn't my commentary, it's the Legislative Yuan's own 2020 research report: the chapter 'contains no specific provision on the privacy management that matters most to the public.' So privacy falls back on Article 315-1 of the Criminal Code and the Personal Data Protection Act, and case law shows that catches part of it: pointing a drone at a hot spring room drew an indictment, raising a phone to a window drew four months. What it doesn't catch is evidence — the report's own words: 'by the time the victim notices it, it may already have vanished.'
Northeastern tested 17,260 Android apps and found zero activating the microphone. In May 2026 the FTC ruled that Cox Media Group — the company that claimed to be listening — collected no voice data at all and was reselling data-broker email lists, settling for $930,000. The real pipelines are off-site event feedback, lookalike spillover, contact-graph uploads, and location brokers.