PD compliance on websites

01

Stage 1

Simulated Roskomnadzor inspection

external review without operator contact: pages, forms, documents, domain, hosting, cookies, register check. Then each zone's gap and fix are recorded

Stage 2. Twelve PD compliance control zones on a website

• 1
• PD collection points in forms and page components

• 2
• responsible person: domain, resource, operator

• 3
• localisation of Russian PD databases

• 4
• external services: instruction or another model

• 5
• contract with users: agreement, offer, consent

• 6
• recording legally significant actions

• 7
• monitoring and analytics of user behaviour

• 8
• marketing and information mailings

• 9
• publishing PD with consent to dissemination

• 10
• notifications of processing and cross-border transfer

• 11
• informing about recommendation technologies

• 12
• user authorisation

Tip: a review the operator runs itself every quarter reproduces the picture of the site that Roskomnadzor sees from outside

Localisation and CBT

PD collected into a DB on foreign hosting

PD collection by foreign metrics and services (Google Analytics, reCAPTCHA)

CBT not stated in the policy and consents

Consents and agreements

no consent to direct marketing and/or advertising

no consent to dissemination of PD

no notice about metrics on entering the site

consent without a separate expression of will

user inaction as a condition of consent

Policy

no policy link on PD collection pages

PD collection web forms differ from the policy

third-party metrics and services not described

processing by purpose and PD destruction not described

no period (condition) for ending processing stated

Notifications, recommendations and authorisation

processing and/or CBT notifications not filed

processing differs from the notifications filed

PD collected in excess of the purposes

no recommendation technology rules (Art. 13.56)

foreign sign-in services (Art. 13.55)

• Control criticality
• high
• medium
• moderate

Ranking of violations

• 1
• no consent to processing

• 2
• no PD processing policy

• 3
• form wider than the policy

• 4
• links to others' collection forms

• 5
• Russians' PD collected on foreign hosting

• 6
• no CBT information in the policy

• 7
• metric not stated in the policy

• 8
• processing period missing or wrong

• 9
• no processing notification

System functions

search for sites that collect and disseminate PD

checking on complaints and the action plan

integration with the citizens' complaint form

at least 500k sites a year and 15k a week for the words "consent", "will sell database"

evidence base module

• Monitoring priority
• banks, pension funds, MFIs, payments
• insurers
• debt collectors
• social media
• telecoms

• online shops
• transport
• postal
• healthcare
• education
• utilities, mgmt cos
• MFC
• authorities

Result: the system checks consents and policies against form fields and register data, so any gap between documents and actual collection is visible without the operator

2024

year results

77% with signs of violations

about 6.5k demands to bring sites into compliance, 258 offence reports

H1 2025

half-year

almost 27k inspections

signs of violations in 84% of cases, 8k demands, 208 reports

2026

14.08.2026

almost 160k sites

coverage doubled from 80k a year earlier, signs of violations in almost 90% of cases

9 in 10

alerts are correct

Roskomnadzor says about one in ten is wrong; there is no separate procedure to challenge a machine assessment

under 10%

persistent violators

Roskomnadzor calls a report a last resort when a demand gets no response

Selection

Who is checked first

sectors citizens complain about most: finance, online shops, education, utilities

under the 2021 specification the sample covers sites collecting or disseminating PD, complaint sites and monitoring-plan sites

• more critical
• less critical

• Localisation and CBT
• PD database on foreign hosting
• foreign metrics and forms: Google Analytics, reCAPTCHA
• CBT not stated in the policy, consents and agreements

• Consents and agreements
• no consent to marketing and advertising
• no consent to dissemination
• no notice about metrics on entry
• consent without a separate expression of will
• user inaction as a condition of consent

• Policy
• no policy link on collection pages
• forms do not match the policy description
• third-party metrics, forms and services not described
• no description by purpose or destruction procedure
• processing end period missing or wrong

• Notifications, recommendations, authorisation
• processing and CBT notifications not filed
• processing differs from the notification
• collection excessive for the purposes
• no link to recommendation technology rules
• foreign authorisation services (SSO)

Example: RKN Southern District Office demand of 11.02.2025 on one site: a policy-acknowledgement checkbox instead of consent, Google Analytics as a breach of Art. 18(5), no CBT notification, no categories, periods or destruction procedure by purpose in the policy

• Relationship block
• Ways of interaction
• Documents that formalise the relationship

• Site features and content
• page viewing, checkbox, password, data entry, online chat
• user agreement (Terms of Use), website privacy policy (Online Privacy Policy), a footer link to the company's PD processing policy (Data Processing Policy)

• Analytics, marketing and mailings
• pop-up message, single opt-in checkbox, PIN code or link for double opt-in
• Cookie Notice, consent to marketing and information mailings (Marketing Consent)

• Separate business activities
• purchase, data entry, file upload
• public offer or adhesion contract with a Privacy Notice, consent to PD processing (Personal Data Processing Consent)

Cookie types per aboutcookies.com

• Critical: necessary
• Functional: preferences
• Analytical: statistics
• Marketing: advertising and targeting

Social: social media

Trap: a register built from input forms covers only what the user enters. Data from cookies and metrics and derived profiles fall out of the documents and surface when the page is inspected

Domain administrator

the person in whose name the domain name for network addressing is registered

Site owner

the person who independently and at its own discretion determines how the site is used, including posting information

PD operator

the person who organises or carries out processing and sets its purposes, PD scope and actions

Logic of the regulator and courts

domain administrator = site owner = PD operator

until proved otherwise, and the operator itself must rebut the presumption

Whose rights the regulator checks

• domain name
• design and content

• CMS and databases
• IT infrastructure

Practice: in the LinkedIn blocking case the Moscow City Court (33-38783/16, 10.11.2016) held the domain administrator answerable for site content, as the site cannot be used without its control. If someone else should be operator, allocate rights by contract in advance

Art. 18(5) of Law 152-FZ from 01.07.2025

when collecting PD, including online, recording, systematisation, accumulation, storage, updating and retrieval of Russian citizens' PD using databases abroad are not permitted, except under Art. 6(1)(2), (3), (4), (8)

• Question
• Localisation required
• Not required

• Whose PD
• Russian citizens, database aimed at Russia
• other persons

• Source of PD
• subject, open sources, behaviour monitoring, database edits
• only other databases

• Basis
• any, except exceptions
• Art. 6(1)(2), (3), (4), (8)

• DB location
• abroad
• in Russia

Metrics

RKN offices (Volga, Kurgan, South) treated Google Analytics as a breach of Art. 18(5); head office (04.08.2025) and Ministry of Digital Development (12.05.2025) see CBT

Aimed at Russia

domain .ru, .rf, .su, Russian interface, services in Russia. ₽6m Ookla fine upheld in cassation (16-1536/2025): registration open. Taobao appeal 29.09.2026 (A40-325054/2025) also rejected a registration ban for access from Russia

Takeaways: do not keep PD collected in Russia in foreign databases. Data derived by analysing a dataset already collected in Russia may be processed abroad

In Roskomnadzor's view, an instruction arises when the operator is able itself to carry out processing, including access and storage, but chose to delegate it in whole or in part to a processor counterparty

Processing instruction needed

virtual hosting

cloud services SaaS, PaaS, IaaS

administration and support

IT security

IaaS not always an instruction: RPPA view

No instruction: the service is provided to the user or operator

• SSO: Yandex ID, VK ID, Sber ID, ESIA
• login: LastPass, OneLogin

• forms: Google Forms, Yandex Forms
• chats: Chatra, Jivosite

• surveys: Typeform, Anketolog
• payment: Mastercard API, PayPal

• widgets: VK, Yandex
• media: YouTube, Vimeo
• protection: reCAPTCHA, Cloudflare

• analytics: Google Analytics, Metrica
• maps: Google, Yandex

• fonts: Google Fonts
• email: MailGun
• e-sign: SignNow, Diadoc

• consents: OneTrust
• reviews: Foursquare, Yelp
• Search Console

Risk: a foreign service from any group means CBT and a non-localisation risk. Per RKN's position of 14.08.2026, CBT terms go into both the user agreement and the policy

Privacy policy

Roskomnadzor content guidance

operator details

purposes, PD categories and list, subject categories, methods, processing and storage periods, destruction procedure (Art. 18.1(1)(2))

legal bases and measures to comply with Law 152-FZ

ways to contact the operator

if any: transfer to third parties and CBT

Consent to PD processing

specific, substantive, informed, conscious, unambiguous

operator details

purposes, PD categories and list, subject categories, methods, periods, destruction procedure

contact methods, including for withdrawing consent

link to the operator's policy

if any: transfer to third parties and CBT

Separation

a contract does not legalise all processing; then consent is a separate text, set apart visually and in meaning, by a separate expression of will

Browse-wrap

a "by continuing to use the site you agree" banner is not enough: silence is not acceptance (Art. 438(2) of the Civil Code), and RKN orally (31.01.2024) requires a link to the full text with a log entry

Intermediary

a site that is not media or a social network with 500k+ daily users (Art. 10.6 of Law 149-FZ) is not liable for third-party content until it learns of a violation (18-P of 09.07.2013, A40-236948/2025)

1

Text and terms

the user sees the contract or consent text and the terms

2

Click "I confirm"

click-wrap: a contract or consent is made by clicking "I agree" next to the text

3

Log entry

access_log records the user's IP address, date and time, page and browser

4

Log retention

the log is protected and kept as evidence of a legally significant action

What to consider when logging

• 1
• there are no requirements for log content or retention, so data minimisation applies

• 2
• ensure the confidentiality, integrity and availability of logs

• 3
• logging can be PD collection, so keep logs on resources localised in Russia

2026 bill

Confirmation code did not become mandatory

code confirmation of significant actions by SMS and Max from 01.09.2026 was discussed, but the second antifraud package (210-FZ) adopted on 26.06.2026 omits it

Note: a simple web consent form without later user identification gives a medium degree of harm under RKN Order No. 178

Roskomnadzor: if a site runs metrics, the operator must

tell the user on entry about metrics programs and obtain consent to process the PD they collect

state exactly which programs are used

include information on metrics programs in the privacy policy

A policy link is not enough: describe consent terms in a separate file or section and keep consent apart from other documents

Sample cookie description in the policy

• Type
• Owner
• Purpose
• Term
• How to disable

• Technical
• operator
• site operation, security, login
• deleted a month after the visit
• in browser settings; login becomes less convenient

• Analytics
• Google Analytics
• visit statistics and site improvement
• until the browser closes or up to 24 months
• on Google's opt-out page

Nuances: RKN orally (27.08.2025) does not treat technical cookies without visitor identification as PD, but treats metrics cookies as PD. At the open day (14.08.2026) entering a site after notice was called consent, yet written guidance requires active action, so a button is safer. IP anonymisation in Google Analytics does not help: cookies and device data go out openly

• Who
• What was found
• Outcome

• RKN, Tyumen, Khanty-Mansi, Yamal-Nenets, 24.07.2026
• metrics without basis or notice, no period in the user contract, policy defects, no notification
• bring processing into compliance

• RKN Central District, 19.08.2026
• metrics programs without a basis, excessive and unspecified period in the policy
• stop the unlawful processing

• Prosecutor, museum reserve, 10.06.2026
• Metrics without a cookie warning or consent (part 1), policy does not cover metrics data (part 3)
• two warnings to the director (5-361/2026, 5-362/2026)

• Prosecutor, institution, 16.06-31.08.2026
• the same violations on the institution's site
• ₽150k fine set aside, on retrial a warning on request (5-349/2026)

Conclusion: everything is visible from outside: policy, user contract, counters and the register of operators. Self-check the site against all requirements, not just the interface

• Double opt-in
• consent twice: a form tick and confirmation by an email link

• Single opt-in
• consent once: ticking an empty "I agree to PD processing" checkbox

• Silent opt-in
• box pre-ticked and left, or a "Submit" button with a consent clause

• Silent opt-out
• pre-set refusal: the "I disagree" box is already ticked

• Soft opt-out
• negated refusal: "Disagree" or "Disagree with refusal"

• Hard opt-out
• consent is built into new terms and deemed given unless a refusal is sent

Practice: Roskomnadzor said on 14.08.2026 that large operators most often breach Art. 15(1) of Law 152-FZ in email mailings. Unsubscribing is not a withdrawal of consent; they are different interface elements. The rules on mass and automatic calls apply separately

Recognise these formulas?

by pressing "Decline", "End call", "Exit" or "Close", you agree to the processing of your data...

by using an ATM so that it reads your facial parameters, you agree...

by not answering three bank support calls, you agree...

by deleting or downloading the bank's app, you agree...

by paying for purchases with the bank's card, you agree...

by withdrawing consent, you agree...

A joke with a grain of truth

Consent by a single "thanks"

Bank support tells a client no biometrics consent was given. The client replies "Thanks", the assistant sends an "OK" gesture with small print on it: by pressing "Thanks", you agree

consent must, among other things, be specific, informed, conscious and unambiguous (Art. 9(1))

refusal must not be harder than consent

• No close X, the consent box is already ticked
• To close the window, untick the box and press "Continue"

Conclusion: a pre-ticked box is passive consent (silent opt-in): neither specific nor unambiguous, and refusal is harder than consent. Avoid such windows in your products

Roskomnadzor service

pd.rkn.gov.ru/soglasiya: guidance on preparing consent to dissemination

RPPA sample consent

rppa.ru/_media/analitika/srpd.docx

The personal data on this page are disseminated with the subject's permission for the purpose of [...]. The subject has set these conditions and prohibitions on processing by any persons: [...]

Disclaimer next to the published PD under Art. 10.1(10) of Law 152-FZ, within three working days of receiving consent

Disputed: Art. 10.1 consent is a special case of Art. 6(1)(1) consent, and dissemination is possible on other bases: Moscow District Commercial Court 30.03.2023, Supreme Court refused review 21.07.2023 (A40-139096/2022), RKN letter 15.05.2024 No. 08-166301. Oral views of 2025-2026 are stricter

+

PD processing, Art. 22

From 01.09.2022 notify even in former exceptions

employee and applicant PD under the Labour Code

PD for concluding and performing a contract with the subject

PD of members of public associations and religious organisations

PD disseminated with the subject's consent

only full names or processing for site entry passes

PD in PDIS named in federal laws

Cross-border transfer, Art. 12(3)

A separate notice of intent before CBT starts

filed separately from the Art. 22 notification, citing its details

those already doing CBT before 01.03.2023 sent a notice and information on bases under Art. 6

the subject's written consent is not needed for this, and activity is not suspended during review

Roskomnadzor may ban or restrict the transfer within 10 working days

to countries off the adequacy list, no transfer before the review period expires

Practice: in a remote site review RKN checks the site against the register of operators, and a missing notification becomes a separate demand item alongside site defects

What is regulated

Recommendation technologies

information technologies for providing information based on collecting, systematising and analysing data on the preferences of users located in Russia

Who is covered

owners of sites, apps, systems and programs who are Russian citizens or Russian entities and serve information by the preferences of users in Russia

Does not apply

to GIS operators, state bodies and local self-government bodies, nor to output by user-set parameters and filters

Rules of use

processes and methods for collecting and analysing preference data, how they are applied, types and sources of data

Russian language; no payment, registration or identification needed; text not covered

Notice of use

on all pages incl. personal: "Recommendation technologies are used on the information resource"

link to a page with the prescribed wording on collecting and analysing preferences

Ban: no technology may violate rights or serve information unlawfully. From 07.07.2026 Art. 13.56 of the CAO applies: entities ₽500-700k, repeat ₽1-1.4m, non-compliance with a demand up to ₽2.8m

• 1
• Mobile phone number

the carrier may be non-Russian: the law has no direct ban

• 2
• ESIA

sign-in via the Gosuslugi portal

• 3
• UBS

sign-in via the Unified Biometric System

• 4
• Another sign-in system

owner is a Russian citizen with no other citizenship or a Russian entity: own sign-in, VK ID, Yandex ID

Who is covered

Russian resource owners with access for authorised users

the test is the user's location in Russia, not citizenship; foreign owners' resources are outside the rule. The law does not define authorisation, so registration and repeat sign-ins are checked

Prohibited

foreign sign-in services: Apple ID, Google Sign-In, Telegram login

Permitted

foreign email as an identifier and code channel. RKN does not treat entering an email at registration as authorisation (letter of 11.06.2026)

Bill

an amendment letting the Government allow email sign-in in the Russian domain zone was not adopted

From 07.07.2026: entities face ₽500-700k fines for breaching authorisation rules (Art. 13.55 of the CAO, Law 199-FZ of 26.06.2026)