User authorisation

01

What is regulated

Authorisation of users of sites, apps, information systems and software for access to their content

02

Who is covered

Owners of resources serving a Russian audience - for users located in Russia

03

Requirements

Authorisation by one of four methods and a ban on foreign sign-in services - Apple ID, Google Sign-In

04

Governed by

Art. 8(10) of Law 149-FZ "On Information" (406-FZ of 31.07.2023)

05

Liability

Administrative (CAO) and criminal - for non-compliance and for passing on authorisation data

06

Outlook

Antifraud-3: a wider circle of obliged persons, the subscriber number as identifier and storage of sign-in records

Law 149-FZ does not define these terms. Their accepted meaning comes from GOST R 58833-2020 "Information protection. Identification and authentication. General provisions": three separate procedures in sequence.

The user presents an identifier - a login, email address or phone number - and the system compares it with the list of assigned ones.

The system verifies the user is genuine and that the identifier presented belongs to them - password, SMS code, biometrics, access key.

The system grants access rights or other powers under set rules. Successful recognition of the user is only one of the grounds for this.

In Art. 8(10) of Law 149-FZ "authorisation" is not granting access rights

The provision speaks of access for users who have passed authorisation and requires it by one of four methods: subscriber number, ESIA, UBS or another information system. Under the GOST these are means of identification and authentication, not of granting rights. So the law's "authorisation" is closer to what engineers call "sign-in".

SUBJECT OF REGULATION

Authorisation of users of sites, mobile apps, information systems and software required to give access to the information posted on them.

Broad coverage

The requirement may reach operating systems and application software (e.g. Microsoft Office), public Wi-Fi points and mobile devices - wherever access to information is restricted.

Term not defined

The law does not define "authorisation", and the bill's authors speak of "registration". Until official clarification, the requirement may cover both initial sign-in and further use of the resource.

Governed by

CURRENT RULE

Art. 8(10) of Law 149-FZ

Stated motive

"The law aims to protect our citizens' personal data, given that many foreign services openly or covertly take part in the information war."

Author of the bill

Resource owners are Russian companies and individuals who open access only to "authorised" users and operate in Russia.

Users in Russia

Authorisation is needed for those located in Russia. Foreign citizens in Russia fall under the requirement on a par with Russians.

Users abroad

Those outside Russia (including Russians abroad) are formally exempt - foreign SSO sign-in can be kept for them.

How location is determined

No procedure is set: in practice IP, geolocation and the number's country code (+7) are used. A VPN blurs the test and risks error both ways.

The criterion "internet activity in Russia" is undefined. By analogy with Law 236-FZ, signs of a Russian audience are a Russian-language interface, ads aimed at Russia, Russian-zone domains and payments in roubles.

• Foreign resources
• If the owner is a foreign citizen or organisation, sign-in via Google, Apple and any other SSO can be kept.

• Foreign email
• Foreign email addresses remain valid identifiers: the "system providing authorisation" is the Russian resource's own software.

• Registration before 01.12.2023
• The requirement is not retroactive - users who registered before this date keep access to resources.

Important: the Government's right to allow email authorisation in the Russian domain zone has not yet been exercised.

• Phone number
• 01

By mobile phone number. The law has no direct ban on a non-Russian carrier.

• ESIA
• 02

Through ESIA (the Unified Identification and Authentication System) - in short, the Gosuslugi portal.

• UBS
• 03

Through the Unified Biometric System, which stores Russian citizens' biometric data.

• Another information system
• 04

A system of a Russian citizen with no second citizenship or of a Russian entity: the resource's own sign-in or SSO - VK ID, Yandex ID.

Foreign authorisation services are banned. Russian resources can no longer use Apple ID, Google Sign-In and the like.

CAO, ART. 13.55

Failure to comply with the authorisation duty from 07.07.2026

• Entity
• ₽500-700k

• Official
• ₽30-50k

CAO, ART. 13.29.2

Passing authorisation data without consent

• Entity
• up to ₽200k

• Sole trader
• up to ₽100k

• Individual
• up to ₽50k

Criminal Code, ART. 274.5

Organising transfer of such data

• Fine
• up to ₽700k

• Imprisonment
• up to 3 years

• Individual
• up to ₽20k
• Forced labour
• up to 3 years

Fate of accounts

It is unclear what happens to an account if the user did not switch from foreign SSO and the resource has removed that method.

Conflict with Apple's rules

Since 2024, App Store rule 4.8 requires an equivalent privacy-protecting sign-in option, not necessarily Sign in with Apple, so it does not directly conflict with the ban.

THE MARKET HAS REACTED

Litres and VK Play are removing Apple and Google ID sign-in; Ozon has already switched off such authorisation.

• ?
• Is a foreign email as a login already a violation?

No. Cross-authorisation is banned, i.e. a sign-in button via a foreign service. A Gmail address entered as a login gives no account access. RKN and the bill's authors read the rule so, though some publications read it more broadly.

• ?
• Is the user liable for choosing the sign-in method?

No. The subject of Art. 13.55 of the CAO is the owner of a site, page, information system or program. The ₽10-20k fine for citizens is aimed at individual owners, not visitors: the risk lies with the resource, not with whoever visits it.

• ?
• Who is liable if a platform provides the sign-in?

The owner of the service on whose side authorisation technically happens. If users arrive already authorised by a platform, that is its responsibility. An RKN request may also reach you, so keep a contract, sign-in diagram and support reply.

• ?
• Does the ban apply to corporate and B2B services?

Yes. Internal and corporate services are not exempt: employees signing in to a task tracker or admin panel with a Google account fall under the ban like customers.

• ?
• How to determine the user's location?

No procedure is set. In practice IP and geolocation are checked at sign-in, less often the number's country code. The test is location, not citizenship or email domain. A user behind a VPN looks foreign to the system.

• ?
• A sign-in code sent to Gmail or Telegram - is that a violation?

No. Delivering a code or link is authentication; the channel does not grant access rights. What matters is that a Russian service generates and verifies the code or magic link, and the foreign provider gets no access to the account.

• ?
• And the delivery services: SMS aggregators and mailers?

They do not fall under Art. 8(10): authorisation stays with the resource. The risks here are under Law 152-FZ: processing instruction, localisation and CBT notification if the provider is foreign.

• ?
• Okta, PingID, Microsoft Entra ID - can they stay?

No, if user sign-in in Russia runs on their side (Art. 8(10)(4)). Your own Keycloak is fine with protection measures under Art. 16 of Law 149-FZ if Russian parties hold over 50% of votes. Otherwise use a number, ESIA, UBS or a Russian owner's SSO.

Resource type

Clearly visible

sign-in is visible to anyone outside

Less visible

a limited circle knows of the sign-in

External resources

for customers and visitors

• Priority 1
• Critical risk

The violation is visible from a browser with no effort; a foreign sign-in button gets into RKN monitoring and user complaints. Fix first

site with a sign-in form, mobile app in the stores, online shop, customer account

• Priority 2
• High risk

Found through a complaint, subdomain scanning or a partner integration check. Fix right after public services

invitation-only partner portal, CMS admin panel on a public domain, API and webhooks, test environments

Internal resources

for employees and contractors

• Priority 3
• Medium risk

No exemptions for corporate services. Found through an employee complaint or an inspection. Plan for the next release cycle

corporate email and task tracker on Google Workspace, HR portal, Jira and Confluence, VPN sign-in

• Priority 4
• Baseline risk

Detection is unlikely, but a violation is still a violation. Close it as planned during inventory and system updates

closed-loop systems, service admin panels, test environments, embedded software

The matrix sets the order and does not waive the requirement: Art. 8(10) of Law 149-FZ exempts no internal or inconspicuous resources, and Art. 13.55 of the CAO liability applies from 07.07.2026

A bill amending the Law "On Communications" and related acts, drafted by the Ministry of Digital Development per the minutes of D.Yu. Grigorenko's meeting of 27.04.2026, published for public discussion on 30.09.2026.

April 2026

The instruction from D.Yu. Grigorenko's meeting underlies the Ministry of Digital Development draft.

August 2026

After approval by state bodies and the Bank of Russia, the 19.08.2026 version had no storage rule.

September 2026

The version published on 30.09.2026 restores three-year storage of sign-in records.

March 2028

The new requirements are planned to take effect on 1 March 2028.

NEW WORDING OF PART 10

The circle of obliged persons widens

Russian entities and citizens

NOW

DRAFT

Foreign resources lose the exemption: sign-in only via foreign SSO is no longer an option.

Foreign owners - only phone-number sign-in for users in Russia (Part 10.1-1).

The storage rule is back

3 years of storing records of user registration, authorisations and termination of registration (para. 2, Part 10)

Release to operational-search and security bodies per Government rules

For ESIA sign-in, authorisation records are kept in ESIA (Part 10.1-2)

Draft published 30.09.2026, effective 01.03.2028

New Part 10.1

FOR RUSSIAN OWNERS

• Phone number
• ESIA

• UBS
• Other IS

Part 10.1-1 settles it: foreigners - phone number only, Russians - any of the four, without the users-in-Russia reservation.

RELATED CHANGES

"Antifraud" GIS

stores sign-in data used by those involved in violations (Art. 1(5) of Law 41-FZ)

Subscriber identification

is tightened, including via ESIA and UBS for a distance telecom contract

SIM cards

ban on reselling SIM cards with an already assigned number

SINGLE IDENTIFIER

+7

subscriber number

the only sign-in method open to any owner, including foreign ones

Russian resources authorise users in Russia by one of four methods; foreign sign-in services - Apple ID, Google Sign-In - are banned.

The requirement is tied to the user's location, not citizenship. Violations fall under Art. 13.55 of the CAO; Art. 274.5 of the Criminal Code covers passing on authorisation data.

The Antifraud-3 draft (effective 01.03.2028) extends the requirement to foreign resources and restores three-year storage of registration and sign-in records, available to law enforcement.

t.me/prv_adv