Is It Legal to Use a VPN in Russia in 2026: Laws, Fines, and Changes

Is it legal to use a VPN in Russia?

Yes. No Russian law forbids installing a VPN app, connecting to a server, and browsing the internet. Neither the Administrative Code nor the Criminal Code contains an article punishing the mere act of using a VPN.

Officials say the same thing. On April 15, 2026, Presidential Press Secretary Dmitry Peskov told journalists: "You know there are currently no bans regarding this, no liability is provided for using them" (News.ru). In January, Anton Gorelkin, first deputy chairman of the State Duma Committee on Information Policy, told Interfax that introducing fines for VPN use is "neither planned nor even discussed" (Interfax).

However, a regulatory system has grown around VPNs since 2017. Most obligations and fines target VPN owners, advertisers, and websites. For an everyday user, only a few specific actions are punishable, and VPNs are only mentioned as a potential tool in those contexts.

What the 2017 VPN law requires

The foundation of this regulation is Federal Law No. 276-FZ of July 29, 2017 (text on the official legal portal). It took effect on November 1, 2017, and added Article 15.8 to the law 'On Information, Information Technologies, and Information Protection'.

The word 'VPN' doesn't appear in the law. It refers to "hardware and software tools for accessing restricted information resources and telecommunication networks". This covers VPNs, proxies, and anonymizers that can bypass Russian website blocks.

The law targets the owners of these services, forbidding them from providing access to resources blocked in Russia. Roskomnadzor tracks down these services and demands they connect to a federal database of blocked websites to enforce the restrictions. Those who refuse are blocked themselves. The same article orders search engines to hide links to blocked sites.

Article 15.8 imposes no duties on users. Under this law, connecting to a VPN breaks no rules, even if the VPN service ignores Roskomnadzor.

Fines for owners only appeared in 2025, when Law No. 281-FZ added Article 13.52 to the Administrative Code. Refusing to connect to Roskomnadzor's system or enforce blocks carries a fine of ₽50,000–80,000 for citizen-owners, ₽80,000–150,000 for officials, and ₽200,000–500,000 for companies. Repeat corporate offenders face up to ₽1 million.

In practice, blocking is the primary weapon. By late February 2026, Roskomnadzor claimed to have restricted 469 VPN services (3DNews via RIA Novosti). If your VPN suddenly stops connecting, this might be why, though it could also be a standard technical issue. We troubleshoot this in our guide on why your VPN isn't connecting.

There is an exception. Part 17 of Article 15.8 exempts state agencies and setups where the owner predefines the user base for a company's internal operations. Simply put, corporate VPNs are exempt. We will return to this below.

How Roskomnadzor blocks VPNs and what it means for users

"Roskomnadzor blocks VPNs" is a top search query. The agency targets services and their traffic, but these measures don't punish users. They use three methods.

1. Blocking the services directly if they violate Article 15.8. Their IP addresses and websites are restricted nationwide.
2. Throttling or blocking traffic at the network level using TSPU (deep packet inspection) equipment installed at ISPs. The Ministry of Digital Development mentioned this in 2025 (3DNews). This is why a VPN might work on home Wi-Fi but fail on a mobile network.
3. Asking app stores to remove VPN clients. In July 2024, Apple removed 25 VPN apps from the Russian App Store, according to Interfax (TechCrunch). In late March 2026, Kod Durova reported three more clients disappeared (T—J).

For users, the fallout is purely technical: blocked services won't connect, and removed apps can't be redownloaded from the Russian store. However, already installed copies usually keep working. The law does not fine you for having a blocked service or app installed.

A practical tip: choose a VPN service that offers multiple connection protocols and works with several client apps. That way, if one protocol is blocked or one app is removed, you won't be left stranded.

Why VPN sites write cautiously: the March 2024 promotion ban

The second part of this regulatory system deals with information about VPNs. Article 15.1 of the Law 'On Information' allows the state to block "information on ways and methods of providing access" to restricted resources.

Roskomnadzor Order No. 168 from November 8, 2023 (text), defines exactly what falls under this ban. It took effect on March 1, 2024, and runs until September 1, 2029. Materials can be blocked if they:

• describe steps or provide instructions on how to access blocked resources;
• encourage people to use these methods, including listing their benefits or endorsing them;
• offer to sell access to a blocked resource or software to bypass blocks;
• directly provide such access, for example, by hosting a software download.

The order makes an exception for scientific, technical, and statistical information.

Publishers—websites, pages, or authors—are liable here, facing Roskomnadzor blocks. Readers are not affected. This is why Russian tech sites will explain VPN security, data encryption, and network setups, but won't give a step-by-step tutorial on unblocking a specific site. We break down the underlying tech in our article on how VPNs work.

What changed on September 1, 2025

In the summer of 2025, the State Duma passed several laws that news outlets lumped together as the "September 1 VPN law". In reality, there are three separate laws. All were signed on July 31, 2025, and took effect on September 1.

VPN advertising is banned

Law No. 332-FZ (text) added Part 10.8 to Article 5 of the Law 'On Advertising':

Advertising of hardware and software tools used to access information resources and telecommunications networks that are restricted under the legislation of the Russian Federation is prohibited.

Part 10.8, Article 5 of the Federal Law 'On Advertising'

Law No. 281-FZ (text) introduced the fines via a new Part 18, Article 14.3 of the Administrative Code: ₽50,000–80,000 for citizens, ₽80,000–150,000 for officials, and ₽200,000–500,000 for companies.

The person or entity distributing the ad is held liable: bloggers, channel owners, websites, or stores. The law defines advertising as information aimed at an indefinite audience. The first known case emerged in January 2026, when the Vologda branch of the Federal Antimonopoly Service penalized a Telegram channel for posting links to VPN services (Vedomosti).

Fines for searching for extremist materials

The same Law No. 281-FZ added Article 13.53 to the Administrative Code. Its title is long but specific: "Searching for known extremist materials and gaining access to them, including through hardware and software tools for accessing restricted resources". The fine for citizens is ₽3,000 to ₽5,000.

This article has three conditions. The search must be deliberate. The materials must be known as extremist—meaning they are either on the official federal list or fit the definition in the law 'On Countering Extremist Activity'. It is the search and access to these specific materials that is punished. The Ministry of Justice maintains and publishes this list (Ministry website).

VPNs are merely mentioned in the title as a potential access method. Using one doesn't increase the fine. How courts will prove intent is still unclear; legal precedent is just beginning to take shape.

VPN use as an aggravating circumstance

The third law, No. 282-FZ (text), added Clause 'f' to the list of aggravating circumstances in Part 1, Article 63 of the Criminal Code (current text on ConsultantPlus):

committing a crime using hardware and software tools to access restricted information resources and telecommunications networks

Clause 'f', Part 1, Article 63 of the Criminal Code of the Russian Federation

This rule only applies when a person is already on trial for a crime. Technically, it can be applied to any Criminal Code article, but it bans nothing on its own. If there's no crime, there's nothing to aggravate.

What everyday users actually risk

Let's summarize this with examples. The law provides no penalties in any of these scenarios:

• connecting to a work VPN to access your company's internal systems;
• turning on a VPN in a cafe or airport to secure your data on public Wi-Fi (we explain why this matters in our guide on public Wi-Fi security);
• keeping a VPN app on your phone and paying for a subscription;
• using a foreign service that blocked access from Russia itself, like ChatGPT (read more in ChatGPT, Claude, and Gemini in Russia).

Trouble is possible in these specific situations:

• publishing an ad for a VPN that bypasses blocks on a public channel or blog (a fine starting at ₽50,000);
• deliberately searching for items on the federal extremist materials list (a ₽3,000–5,000 fine, whether a VPN is used or not);
• committing a crime where a VPN or proxy was used as a tool (the court may treat this as an aggravating circumstance).

A separate warning about scammers: on February 26, 2026, Roskomnadzor warned about fake emails sent in its name, telling corporate employees about a "workplace VPN ban". The agency dismissed these as fakes (ComNews). If someone calls or writes claiming to be from Roskomnadzor, the police, or a bank, demanding you pay a "VPN fine" or verify something urgently, hang up. Administrative fines are issued via official protocols, not collected over the phone.

There is also a technical side. A VPN hides your traffic content from your ISP and websites, but it doesn't make you invisible: your ISP sees you connecting to a server, and the VPN provider sees where your traffic goes. That's why you should choose a provider based on who runs it and how they handle data. We list the criteria in our guide on how to choose a VPN.

Corporate VPNs are legal to use

The 2017 law explicitly exempts corporate networks. Part 17 of Article 15.8 does not apply when "the circle of users is predefined by the owners" and the tool is used "for technological purposes ensuring the operations" of an organization. An employee checking work email via a corporate VPN is breaking no rules.

Roskomnadzor reiterated this in 2026. On April 22, the agency stated that VPNs for corporate use are not restricted, noting that over 1,700 enterprises have been cleared to use VPNs, and access to foreign traffic via VPN is ensured "in accordance with company requests" (Fontanka).

Technically, work connections are sometimes caught up in broader restrictions. Maksut Shadayev, head of the Ministry of Digital Development, mentioned this back in May 2025 (3DNews). If your work VPN stops connecting, that's a problem for your IT department. According to Roskomnadzor, access is granted based on company applications, so the organization has to sort it out.

Why Russian apps ask you to disable your VPN

Since mid-April 2026, many Russian apps refuse to load if a VPN is running. Gosuslugi, banks (like Sber or T-Bank), and marketplaces (like Ozon) display a prompt asking you to turn it off. No law requires this. It is an informal agreement between the government and major companies.

According to RBC, on March 30, Digital Development Minister Maksut Shadayev asked top platforms to restrict access for users with active VPNs by April 15. Companies that ignored the request reportedly faced removal from internet 'whitelists' and the loss of IT tax benefits (T—J summary, Kommersant).

On April 27, the Ministry of Digital Development cited data security, arguing that most VPNs fail to protect personal data and hackers use them to intercept traffic (Expert). Gosuslugi even promised a complaint button in case the app demands you turn off a VPN when you aren't using one.

Users face no penalties for leaving their VPN on: the app simply won't open. We discuss how to deal with this without toggling your VPN ten times a day in our article on accessing banks and Gosuslugi with a VPN. The 'whitelists' used to pressure these companies are part of a separate issue regarding mobile internet shutdowns, which we cover in internet whitelists and shutdowns.

Fake VPN law dates and what to watch out for

Search results are full of queries about VPN laws starting "April 1", "April 15", or "May 1". While no such laws exist, each date has a backstory.

T—J reported on the Apple ID limits and traffic fees in the spring (April 1, 15 GB).

International traffic fees

The idea of charging for traffic routed through foreign servers hasn't been scrapped. In October 2026, Kommersant cited sources saying the Ministry was discussing a fee with operators for international traffic exceeding 50 GB per month, specifically on 5G networks. Operators lack the technical capacity to implement this right now, and no final decision has been made (Kommersant).

New aggravating circumstances

In the summer of 2026, State Duma deputies brought up a bill that would make using VPNs and artificial intelligence during a crime an aggravating circumstance. Anton Tkachev, first deputy chairman of the IT committee, expects it to pass in the fall, emphasizing: "The use of these technologies is not a crime in itself" (URA.RU).

How to check law rumors

Enacted laws are published on the official legal portal, and pending bills can be tracked in the State Duma's legislative database. A real law always has a number and a signing date. If a chat group is panicking about a new ban but there's no law number, it's likely just a rumor. We cover real updates on VPNs and restrictions in our news section.