Marketing and data

Profiling

Assessing personal aspects

any form of automated processing of PD to evaluate certain personal aspects of a person, in particular to analyse or predict work performance, economic situation, health, preferences, interests, reliability, behaviour and movements

Targeting

Delivering an offer

using profiling results to inform, deliver personal offers and advertising messages through various channels in the interests of the operator and third parties

Definition

Law 152-FZ has no profiling, the wording derives from Art. 4 GDPR, and Art. 16 of Law 152-FZ restricts only decisions based solely on automated processing

Basis

targeted advertising, scoring and recommendation algorithms need their own basis under Art. 6, and direct promotional contacts need consent under Art. 15(1)

Harm

profiling creates new information about a person unknown to them and leads to negative decisions

Agenda

in 2026 sector standards in place of consent and a consent management platform are discussed

Art. 15, Law 152-FZ

Provision

processing PD to promote goods, works and services by direct contacts with a potential consumer via communications, and for political campaigning, is allowed only with prior consent of the subject (Part 1)

processing is deemed done without consent unless the operator proves it was obtained (Part 1)

on the subject's demand the operator must immediately stop such processing (Part 2)

What follows from this in 2026

Contract and interest do not help

a marketing purpose rests neither on the contract with the addressee nor on legitimate interest

Any form, but provable

written form is not needed, while a tick, call recording or confirmation code works with a consent log

Service or advertising

a message performing a contract is not advertising, but a promo block makes the whole thing advertising

Withdrawal stops mailings

withdrawing Art. 15 consent also requires stopping advertising communication

Where violations are caught: by RKN's oral position (14.08.2026) large operators most often breach Art. 15(1) in e-mail mailings. The regulator treated an e-mail address alone as PD in letter of 08.08.2024 No. 08-329520, though courts rejected this criterion (Section 05)

• Provision
• What it requires
• Who proves
• How it ends

• Art. 15(1), Law 152-FZ
• prior consent of the subject to processing for promotion by direct contacts
• PD operator
• immediately on the subject's demand

• Art. 18(1), Advertising Law
• prior consent of the subscriber or addressee to advertising over telecom networks
• ad distributor
• immediately on the addressee's demand

• Art. 18(2), Advertising Law
• ban on auto-dialling and auto-mailing
• no presumption
• not legalised by consent

• Art. 44.1(1), Communications Law
• subscriber consent to mailings via mobile communications
• customer or telecom operator
• opt-out at the telecom operator from next day

• Art. 44.1-1, Communications Law
• mass-call consent since 01.09.2025 and contract with subscriber's operator
• call customer
• blanket opt-out at the telecom operator

Conclusion: consents under the three regimes do not replace one another, and consent to PD processing at registration is not advertising consent

• Model
• Risk
• Practice

• Double active confirmation
• minimal
• empty box and a code or link, no negative practice

• Single active
• low
• empty box without verification, unambiguity is met

• Pre-set tick
• disputed
• no court ruling, Moscow FAS Office found it improper (24.09.2026)

• Tick for refusal
• not unambiguous
• silence is not consent, outcomes against telecoms differ

Three recording requirements

• 1
• Addressee

a specific ad distributor, not future partners

• 2
• Separateness

the advertising wording is not dissolved in the policy

• 3
• Record

time, text of the label shown and the subject's identifier

Channels and number: consent is given by a tick per channel: calls, SMS, e-mail, messengers, push. The number is confirmed by a code, otherwise the log proves only that someone entered digits

1

Cut out the prohibited

ad auto-dialling is banned by Art. 18(2) Advertising Law and consent does not legalise it

2

Assess the scale

the threshold is set by the operator's antifraud policy, so plan the campaign for the worst case

3

Collect consent

prior, unambiguously identifying the subscriber and specifically for calls, proved by the customer

4

Conclude contracts

with each operator whose subscribers the calls are for

5

Arrange labelling

display agreement: name and call category up to 32 characters (Resolution of 28.08.2025 No. 1300)

operator may block calls lacking consent and ask the customer to confirm it (Digital Ministry letter of 29.12.2025 No. P12-130083)

subscriber opt-out at the operator is non-selective and blocks all mass calls except authorities and listed organisations

operators announced blocking unlabelled calls from 15.10.2026, on 14.10.2026 the Digital Ministry asked not to block banks until November, disputed for non-mass calls

from 01.03.2027 informing calls required by acts and bank calls under a contract with the subscriber are exempt (Law 210-FZ of 26.06.2026)

1

Direct contacts

under Art. 15(1) only with prior consent, for a young child given by the legal representative. The rule does not cover targeted advertising without direct contacts

2

Profiling

there is no special ban for children: Art. 16 bans decisions based solely on automated processing with legal effects for any subject, and a child profile raises the harm assessment

3

Digital Ministry draft

ban on SMS to numbers issued to children, incl. login codes, exceptions for Art. 44.1(3) Communications Law, Bank of Russia, NSPK and GIS. Not adopted as of 30.09.2026

What to do: a children's service designs login without SMS codes upfront and markets only on a representative's separate consent, withdrawable separately

Three directions of the AutoNet market ecosystem

• telematic transport and information systems
• smart urban mobility

transport and logistics services

The data spans everything from location via a GNSS receiver to the state of the car and driver, and a fully equipped car produces about 4 TB a day

20-60 MB/s

Cameras

main stream for a driverless car

10-70 MB/s

Lidars

scanning the surroundings

<10 KB/s

Radars

ultrasound 10-100 KB/s

about 50 KB/s

GPS

car location

For marketing: geolocation and driver data become PD when linked to a person, and an offer based on current location needs consent under Art. 15(1) of Law 152-FZ and, if delivered over telecom networks, under Art. 18(1) of the Advertising Law

Programmatic is a way of buying traffic in real time through ad system interfaces, letting you buy not the whole array of traffic or content but specific users

1

Visitor

visits a website or app of an ad platform

2

Ad platform

puts the impression up for sale

3

SSP

the seller's platform auctions the impression

4

DSP and DMP

buyers' platforms send a request, enter the auction and bid based on user data

5

Advertising agency

trading desk (TD/ATD) manages buying for the advertiser

Legal layer: a banner on a third-party site needs no advertising consent from the addressee since there is no direct contact, but processing user identifiers for targeting needs a basis under Art. 6(1) of Law 152-FZ

• Vertical solutions
• applications, business services and data sales for end-user tasks

• Technology tools
• basic and advanced analytics, AI and machine learning

• Digital infrastructure
• platforms for integrating, storing and processing big data

• Basic infrastructure
• equipment for collecting data and a network to transmit it

Data generation

• personal activity and transactions
• vehicle movement
• production processes

Tension with Law 152-FZ: big data value is extracted by combining datasets collected for different tasks, which conflicts with purpose limitation and retention periods, so the route is chosen in advance: a new purpose, depersonalisation or a compatibility check

vs

Roskomnadzor

Code of Ethical Conduct on the Internet

pd.rkn.gov.ru/code

draw the attention of citizens, state, society and business to a safe internet and data subject rights, raise awareness of threats to privacy

new research on how the internet and digital sovereignty work and putting it into practice

highlighting positive experience of observing human rights and freedoms online

ABD and IRI

Code of Ethics on data use

csr.ru/ru/ethics

a sectoral self-regulation act fixing the main principles of working with data

fix principles of interaction between state, citizens and business

regulate universal rules of acceptable conduct for the whole professional community

Status: Law 152-FZ does not know codes of conduct, so joining a code serves as a framework for internal decisions and an argument of good faith, but does not replace legal requirements in a dispute with the regulator

Cycle with a marketing intermediary

• 1
• Consent

the user gives consent to the service

• 2
• Instruction

the service hands marketing messages to the intermediary

• 3
• Communications

the intermediary sends marketing messages to the user

• 4
• Refusal and ban

the user refuses communications, the service forbids them to the intermediary

Communications on services already provided

• 1
• Request

the service asks the client for advertising consent

• 2
• Explicit consent

only it opens advertising communication

• 3
• No consent

lack of consent ends advertising communication

In 2026: unsubscribing is available from the first message and covers all channels, consent goes to a specific distributor, and a subscriber's opt-out at the telecom operator and an Art. 15(2) demand are different mechanisms with different performers

Digital platform

a business model letting consumers and suppliers connect online to exchange products, services and information, including their own

Digital ecosystem

a client-centric business model combining two or more groups of products, services and information to meet clients' end needs

Platforms grew out of offline hubs (malls, stations, airports), and ecosystems are their next phase. Clients pick ecosystems for convenience, choice and price, and Amazon has built its own for over 25 years

30%

E-commerce

of the world market is held by US and Chinese ecosystems

75%

Blockchain

of patents belong to the US and China

50%

Internet of Things

of the market, US and China

75%

Cloud

of cloud computing is held by US and China

01

Direct marketing

informing about group products needs consent under Art. 15(1) of Law 152-FZ, and the contract does not replace it

02

Voluntariness

consent signed as part of a contract is not free, and since 01.09.2025 it is drawn up separately (Art. 9(1))

03

Advertising

consent goes to a specific distributor, abstract partners without a list do not get it (para. 15, Supreme Commercial Court Plenum Resolution No. 58)

04

Tying

conditioning a contract on other contracts is barred (Art. 16(2)(5) Consumer Protection Law)

name the group companies individually or link to an updated list with an archive of versions

store a flag of which company the consent was given to: RKN (14.08.2026) does not allow one consent for several equal operators

make sure refusing the partner block is technically possible and does not block the main product

when statuses conflict across group systems, refusal prevails, and withdrawal from any point reaches all senders

Conclusion: fixing one defect does not cure the others, so an ecosystem clause is analysed against all four grounds at once