Consumer PD

A contract concluded with a data subject cannot contain provisions restricting the rights and freedoms of the subject, setting cases of processing minors' PD unless otherwise provided by law, or allowing, as a condition of concluding the contract, inaction by the subject

Art. 6(1)(5), Law 152-FZ as amended by 266-FZ of 14.07.2022

Defects per RKN

• 1
• subject's inaction as acceptance of an offer

• 2
• PD transfer to an indefinite circle of persons, incl. for advertising

• 3
• processing for purposes outside the contract's subject

• 4
• indefinite PD processing

Consequence: processing on such contract terms is processing without a basis under Art. 13.11(1) of the CAO, since 30.05.2025 fine of ₽150-300k for organisations, and RKN named the defects at the open day on 29.09.2022

A seller, performer or aggregator owner may not refuse a consumer to conclude, perform, amend or terminate a paid contract because of refusal to provide PD. There are two exceptions: the duty to provide data is set by law or is directly related to performing the contract (Art. 16(4) Consumer Protection Law)

Consumer

a citizen who intends to order or buy, or orders, buys or uses goods, works and services for personal needs unrelated to business

Seller

organisation of any form or sole trader selling goods to consumers under a sale contract

Executor

organisation of any form or sole trader doing work or providing services to consumers under a paid contract

Aggregator owner

owner of software or a site where the consumer sees the seller's offer, contracts and prepays

Consequence: consumer status arises at the intent stage, so the ban covers calculators, requests and pre-contract consultations, and a marketplace answers for its form fields like the seller

Banned terms, Art. 16(2) Consumer Protection Law

Sub-para. 1. Unilateral change

right of a seller, performer or aggregator to unilaterally withdraw from an obligation or change the subject, price, term and other conditions where the law does not allow it

Sub-para. 5. Tying

making the purchase of some goods or services conditional on compulsory purchase of others, including entering other contracts

Sub-para. 15. Other breaches

terms violating international treaties, the Consumer Protection Law and other consumer protection acts

Recommendations

How to write the contract

have a special section exhaustively describing PD processing terms

do not include elastic wording that lets operators and processors be changed unilaterally

do not impose PD processing by group companies and ecosystem participants

do not put consent to processing for other purposes in the contract

In 2026: prohibited terms are void (Art. 16(1)), including them is punished under Art. 14.8(2) of the CAO, consumers win court rulings voiding imposed consents, and since 01.09.2025 consent is drawn up separately from the contract altogether

1

Ban

a contract cannot be refused over refusal to give PD unless the law requires it or performance needs it

2

Demand

a consumer may ask for the specific reasons and legal grounds why the contract is impossible without PD

3

In writing

incl. electronic document, reply within 7 days of the request

4

Orally

information is given immediately

5

Form of reply

the same as the demand was made in, unless it states otherwise

review the consumer PD set for minimisation, justify each field by a norm or the contract's subject

fix in internal acts the reply procedure and an option to buy without giving PD

account for all forms in which a consumer demand may arrive

prepare instructions and train staff dealing with consumers

Field test: name the norm that obliges collecting the field, or a contract action impossible without it. If neither can be named, the field is excessive, and a general reference to the processing policy does not meet the duty

₽5-10k

Officials

Art. 14.8(7), refusing a contract over refusal to give PD, from 01.09.2022 (Law 145-FZ)

₽30-50k

Legal entities

Art. 14.8(7) if PD is not required by law and not needed to perform the contract

₽200-500k

Refusal for refusing biometrics

Art. 14.8(8) for organisations since 30.05.2025, officials ₽50-100k

• Case
• Position
• Source

• Passport copy at a telecom operator
• excessive as to data not needed for the contract, including on termination via chat
• Rospotrebnadzor, webinar 27.07.2023

• Passport for refund to a card
• excessive, the payment instrument already identifies the payee, fine upheld at first instance
• A75-29509/2025, 12.03.2026

• Biometrics for issuing a bank card
• conditioning is prohibited, the bank received a caution
• Rospotrebnadzor, 19.01.2024

• SNILS for paid medical services
• provided at the citizen's discretion
• Health Ministry letter 18.01.2024 No. 31-2/63 on Resolution 736, now 659

Law 289-FZ of 31.07.2025

In force from 01.10.2026

the law introduces the concepts of digital and intermediary platform, owner, operator, partner, pickup point and product card. A platform becomes an intermediary one once entered in the register

Data protection

any platform owner protects its information under information and PD laws

Partner check

intermediary platform operator checks the partner in EGRUL, EGRIP or via ESIA

Algorithms

the operator may select the performer, calculate pay and restrict orders by algorithm alone, and a performer who is a citizen may know of it

Restricted goods

sale with buyer identification via the UBS under Art. 10 of Law 572-FZ or another method set by the Government

Foreign contour: enforcement measures under Art. 9 of Law 236-FZ may be applied to a foreign platform operator from the register, as to foreign internet companies

Art. 6(1)(5) of Law 152-FZ is aimed at implementing the principle of proper performance of obligations (Art. 309 Civil Code), protects the rights of parties to contractual relations, including for utilities, and a fair balance of their legitimate interests

Constitutional Court ruling, 17.07.2018, 1810-O

Complaint

a utility supplier used the applicant's personal phone number without her consent

Argument

the norm breaks the balance of parties to a utilities contract and favours the legal entity (Arts. 17, 24, 46 of the Constitution)

Result

Constitutional Court declined to hear the complaint

Boundary: the contract covers only processing needed to perform it. By RKN's oral position (14.08.2026) that is most relationships, but promotion and other purposes need their own basis

Without consent

Concluding and performing the contract

Art. 6(1)(5) of Law 152-FZ allows processing a borrower's PD without consent to conclude a contract on their initiative and perform a consumer loan contract

Only with consent

Other purposes, third parties

processing for other purposes, instructing another person to process and disclosing PD to third parties need the borrower's consent (Art. 5(2), 6(3), 7)

Separate consents

Marketing and biometrics

creditors are advised to take separate consents for promotion and for biometric PD, in view of Arts. 9(1), 11, 15

From 2025: since 01.09.2025 any consent is drawn up separately from other documents (Art. 9(1) as amended by Law 156-FZ), so the 2021 recommendation became the general rule, and a separate tick is needed for each recipient

1

28.09.2023: objection

client messages the bank chat objecting to placing their biometrics in the UBS and demands destruction by 30.09.2023

2

05.11.2023: ATM

the client withdraws cash. After PIN entry the screen shows "By continuing, you agree...", and refusal is possible by buttons "Decline" and "Got it"

3

Support's reply

you gave consent to biometrics, most likely at an ATM: that day you withdrew money there

4

2025: courts

biometric consent given by entering a one-time code on login to the personal account was held void

What a client should do

• read the screen text before entering the PIN
• press "Decline" if you disagree
• check biometrics on Gosuslugi

withdraw unneeded consents

Result: Vologda Regional Court on 18.03.2025 (33-802/2025), the Third Cassation Court upheld the decision on 04.08.2025 (88-14185/2025). Read what is on the screen before entering the PIN

I authorise the Federal Tax Service to perform all actions (operations) with my personal data... and transfer to a credit institution... In case of withdrawal of consent... the Federal Tax Service may not stop their processing until this consent expires

"Agreement on personal data processing" in the taxpayer's personal account

What is wrong

• 1
• called an agreement, though it is a consent

• 2
• "all actions" instead of a specific list

• 3
• withdrawal changes nothing, so the person has no choice

• 4
• where processing rests on law, consent only simulates choice

By law: after consent is withdrawn processing stops unless another basis exists (Art. 9(2)), and PD is destroyed within 30 days (Art. 21(5)). Write consents so that withdrawal means something

vs

Unfair

Consent without choice

creditors: banks, microlenders, credit co-ops, pawnshops

consent to receive advertising is built into the loan contract, application or other document and the borrower cannot decline it, though the advertising and communications laws require the subscriber's prior consent

RKN (29.09.2022) also opposes marketing consents in the contract text and advises against embedding them

Recommended

Separate signature or tick

including in electronic documents of remote channels

give the borrower a separate signature or tick for advertising consent

list specific ad distributors, the creditor and third parties

best practice is a separate document, and refusing it does not affect the contract

Practice: Supreme Court (22.06.2026) allowed ad consent in exchange for a discount if the purchase is available without it (A07-5689/2025), while courts tend to treat consent required for the service itself as forced (88-17782/2025, ₽12,000 compensation)

"I agree unless stated otherwise" and a "do not agree" box

Data verification

checking subscriber-supplied data under contract terms

Payment offset

money under one contract goes to a debt under another

Operator advertising

advertising and mailings from the operator

Third-party advertising

advertising and mailings from third parties

PD processing

PD processing under clauses 3.3-3.6

Data in the account

providing information in the personal account

All six consents are deemed given until the subscriber himself ticks the box "do not agree" next to each of them, that is, refusal requires an action and consent does not

2026 assessment

Why the design is vulnerable

consent is inferred from inaction, and inaction cannot be a form of consent (RKN, 29.09.2022)

since 01.09.2025 consent is separate from the contract (Art. 9(1))

Art. 16(3.1) Consumer Protection Law bars giving consent for the consumer or building in pre-set consent

practice on the "disagree" box has diverged: A40-172089/2018 for the operator (first instance), A40-64096/2017 against (Moscow District, 01.02.2018)

vs

Claim granted

Soglasie Insurance

Moscow City Court appeal ruling of 04.04.2022 No. 33-9501/22

to calculate the OSAGO price the site demanded full name, birth date, sex, passport and driving licence, and the terms treated using the site as consent to PD processing and transfer for advertising

Meshchansky Court dismissed the claim, Moscow City Court reversed and granted all of it

scope held excessive, the clause treating site use as consent removed, the list of third parties added

Claim dismissed

Absolut Insurance

Moscow City Court appeal ruling of 30.11.2023 No. 33-49093/2023

PD requested only as needed to calculate the OSAGO price

the scope of data requested decided it, not the fact of collection

Logic of Art. 16: the price is disclosed before data is collected, and demanding PD merely to learn it Rospotrebnadzor treats as a breach of Art. 16(4) Consumer Protection Law (webinar 27.07.2023)

28.01.2022

RKN orally

From 14, the teenager's consent is enough

within their capacity

31.01.2024

RKN orally

Up to 18, a representative signs

except cases expressly provided by law

22.10.2025

RKN orally

From 14 to 18 alone within capacity

under 14 through a legal representative

14.08.2026

RKN orally

Alone only per Art. 26 Civil Code

otherwise a legal representative consents

position 1

Teenager alone within Art. 26 Civil Code

RKN letters of 30.03.2023 No. 08-26424 and 30.05.2024 No. 08-192564, ESIA from 14 within capacity (Resolution No. 977)

position 2

Always the legal representative

RKN Central FD Office letter 02.05.2024, case A70-2034/2017 (pupil biometrics), case 12-2573/2026 on Art. 9(6)

position 3

Teenager with a representative's approval

expert construct by analogy with Arts. 26, 175 Civil Code, no direct support in RKN or court positions

Basis: Art. 9(6) of Law 152-FZ was written for incapacitated persons (Art. 29 Civil Code), yet case 12-2573/2026 applied it to a teenager. Experts advise building a children's form on Arts. 26, 28 Civil Code and sectoral rules

• Process
• Basis
• Limit

• Admission, student body, attestation, education documents
• education law, Art. 6(1)(2)
• both parents' passport copies and income certificates beyond the sector norm are excessive

• All-Russian Olympiad
• Ministry of Education order, Art. 6(1)(2)
• RKN letter of 07.12.2023 No. 08-133024, publication without consent under Art. 10.1(15) is an expert view

• Public service or child benefit
• law, Art. 6(1)(4)
• refusal without the other parent's consent is unlawful

• E-gradebook, cloud platform
• instruction with representative consent unless law says otherwise
• contract with a list of actions and localisation, a service with own purposes is a recipient

• Site photos, extracurricular contests, biometrics
• separate consent
• parent's refusal of an optional block does not affect teaching

Digital Ministry, 28.08.2020

Three streams of subjects in one school

letter No. LB-S-074-24059 divides data of pupils, parents and staff by basis and scope

From 01.09.2025

Consent is kept out of the application

consent inside the enrolment application is not separate and goes onto its own form

1

PD regime

dissemination consent under Art. 10.1, given by a representative for a young child. The form under RKN Order No. 18 has no field for it, so one is added, which is disputed

2

Image and private life

Arts. 152.1, 152.2 Civil Code apply alongside Law 152-FZ, and clearing one regime leaves the other

3

Sectoral bans

a media outlet does not disclose a juvenile offender without the teenager's and representative's consent, nor a victim except to protect rights (Art. 41 Media Law)

Recommended beyond consent

no adoption, health or hardship details, no reliance on a hidden name beside school, class and photo, provide a withdrawal and deletion channel

Disputed

Open does not mean publicly available

experts hold a child's photo posted online is no basis for profiling, RKN's oral positions of 28.01.2022 and 14.08.2026 differ

Exception: officials submit information on their children's income under Art. 8 of the Anti-Corruption Law without consent (Art. 6(1)(2)), and publish it only to the extent and on the sites set by anti-corruption acts

vs

Low risk

small data volume and low probability of harm

age barrier with the choice preserved

log with date, time, choice and session, without it a tick does not prove age

High risk

special categories, biometrics, publication, profiling, CBT

simplified authorisation or ESIA, where from age 14 within capacity the teenager or a representative consents to connected organisations (Resolution No. 977)

18+ resource

Threshold is backed by destruction

children's data stops being processed within 3 working days and is destroyed within 10 (Art. 21(3)), otherwise the threshold shows awareness of the risk

Child profile

Age for access, not for marketing

age is not taken for the Law 436-FZ filter in the recommendations, while parental control, per the Constitutional Court (2-P), gathers data on a child's private life but is lawful for safety

Foreign services: foreign learning and gaming platforms have run into Art. 18(5) since 01.07.2025, the mechanism is disputed, and the embedding operator bears the risk