The short answer is that you need to get an FAA waiver (special permission), as required by 14 CFR 91.311:
§91.311 Towing: Other than under §91.309.
No pilot of a civil
aircraft may tow anything with that aircraft (other than under
§91.309) except in accordance with the terms of a certificate of
waiver issued by the Administrator.
(91.309 is about towing gliders, so banner towing comes under 91.311.)
You need at least a private pilot certificate to tow banners - sport and recreational pilots aren't allowed to do it - but since most banner towing is paid work, in practice the pilot will usually have a commercial certificate (this is from the waiver instructions):
When banner tow operations are conducted for compensation or hire, the
pilot must have at least a limited commercial pilot certificate
(without an instrument rating) and at least a valid second class
medical certificate. An instrument rating is not a requirement for
this operation.
The FAA has a complete guide on banner towing and the waiver issue process has more administrative details. There don't seem to be many specific airspace requirements apart from the obvious, e.g. no towing in a TFR zone. But the FAA can impose more or less any conditions that they like as part of a waiver, and it will include the approved times and areas for operation.
(As an aside, it's widely believed in the pilot community that the permanent stadium and Disney TFRs are really there to prevent banner towing, not to increase security.)
