Website fines in Russia in 2026: what owners should check

In 2026 Russian website owners got more obligations and more fines. Some of the rules existed before, but only now did they start costing real money. According to industry media, since the spring Roskomnadzor has been looking for violations on websites with a bot, and after an official order the owner has 10 days to fix them.

The good news is that most violations can be fixed in a day or two, and you can check your website yourself. Below are ten points: what the law requires, what a violation costs and what to do.

A note up front: I am a developer, not a lawyer. This is a practical list of things worth checking on a website, not legal advice. Before serious decisions, check the amounts and wording against the law itself or with a lawyer.

Who this applies to

Anyone with a website that has a lead form, a personal account, an online shop or advertising: companies, sole proprietors and self-employed people. Fines are highest for companies and lower for sole proprietors and officials, but still noticeable.

What the law requires. If the website has a personal account, users from Russia may sign in only with a Russian phone number, through Gosuslugi (the state services portal), the Unified Biometric System or other Russian services such as VK ID or Yandex ID. The ban itself has existed since 2023, and since 7 July 2026 there is a fine for it under the new Article 13.55 of the Code of Administrative Offences.

Fine. Companies RUB 500,000-700,000, up to RUB 1.4 million for a repeat violation. Officials and sole proprietors RUB 30,000-50,000, individuals RUB 10,000-20,000.

How to check. Open the sign-in and registration form. If it has "Sign in with Google" or "Sign in with Apple" buttons, remove them and keep Russian options.

A disputed point. Ordinary registration with an email and password when the email is on gmail.com. Some lawyers believe this is not a violation, because the law bans signing in through someone else's service, not an email address. Adding phone number sign-in is the safer option.

If there is no personal account and everything on the website is open without signing in, this point does not apply to you, according to lawyers' analysis.

2. "You may also like" blocks

What the law requires. If the website picks recommendations for a specific visitor, you must tell users about it, publish the rules for how the recommendations work and the owner's contact details. The obligation has existed since 2023, and since July 2026 violating it is fined under Article 13.56 of the Code of Administrative Offences. The amounts are the same as in point 1.

A disputed point. Lawyers disagree whether this applies to a small shop with a "Similar products" block or only to large platforms. If you have such a block, it is easier to add a short notice and a page with the rules than to argue later.

What the law requires. Since 1 September 2025, consent to the processing of personal data has to be a separate document. The person ticks the box themselves: a pre-ticked box does not count as consent. The form needs a link to the privacy policy next to it. Consent to marketing emails is a separate checkbox, and refusing marketing must not prevent the person from sending a request.

Fine. According to an analysis published on Klerk, processing data without consent can cost a company RUB 300,000-700,000, and RUB 1-1.5 million for a repeat violation.

How to check. Submit every form on the website: request, call-back, estimate, newsletter. Is there a separate checkbox? Is it pre-ticked? Is there a link to the policy?

Tip. Keep a consent log: date and time, page and policy version. Without it you cannot prove that the person actually agreed.

4. Privacy policy and the Roskomnadzor register

What the law requires. The policy has to describe what your website actually collects, not be a downloaded template. If your website collects even a name and a phone number, you are already processing personal data and must file a notification with the Roskomnadzor register of data operators.

Fine. For not filing the notification, according to Anti-Malware, RUB 100,000-300,000 for a company. For having no policy at all, different analyses give different amounts, from RUB 30,000 to 100,000.

How to check. Look your company up in the register of operators at pd.rkn.gov.ru and reread the policy: does it match what the website actually collects?

5. Cookies and analytics counters

What the law requires. Yandex Metrica and Google Analytics collect IP addresses and device data, and that is personal data. So the website needs a cookie banner with a clear choice. Lawyers recommend turning analytics on only after the visitor agrees, although there is no single strict rule on this.

About Google Analytics separately. There is no direct ban, but in its letters Roskomnadzor treats it as a cross-border data transfer that you have to report. Switching to Yandex Metrica is simpler and safer.

How to check. Open the website in incognito mode. Does a banner appear? Ask your developer which counters are installed on the website.

6. Where your requests are stored

What the law requires. Since 1 July 2025, data of Russian citizens may not be collected directly into foreign databases. Google Forms, foreign CRMs and website builders that store data abroad are all at risk.

Fine. For databases with Russian citizens' data stored outside Russia, a company faces RUB 1-6 million, and RUB 6-18 million for a repeat violation.

What to do. Requests should first be saved on a Russian server or in a Russian CRM. Russian services such as Yandex Forms can replace Google Forms.

7. The Russian language on the website

What the law requires. Federal Law No. 168-FZ has applied since 1 March 2026: information for consumers must be in Russian. Foreign text may stay only as a duplicate with the same meaning and design. Registered trademarks, company names and words from the official dictionaries may be used without translation. Technical standards such as Wi-Fi and USB do not need translating.

Where violations usually hide. "Sale", "Contact us" and "Checkout" buttons, menus and banners in English, plan names such as "Pro".

How to fix it. Replace "Sale" with the Russian word for sale, "Contact us" with a Russian "Contact us" and "Checkout" with a Russian "Place an order". If you need the English version, it goes next to the Russian one in the same font and size.

Fine. For consumer information, companies RUB 5,000-10,000 and sole proprietors RUB 500-1,000; when selling goods and services, companies RUB 30,000-40,000; in advertising, companies RUB 100,000-500,000. Lawyers warn that a fine may be counted for each violation separately. There is almost no court practice on websites yet, and the details are disputed.

8. Advertising on the website

If the website has ad banners or affiliate links, they have to be labelled: an "Advertising" mark, a special token and advertiser data submitted through an advertising data operator. The fine is up to RUB 500,000, although in practice smaller amounts also occur. Separate consent for marketing emails was covered in point 3.

9. Photos and images

Photos "from the internet" or from Pinterest may not be used without a licence. The risk here is not a fine but compensation to the rights holder, and according to T-Zh it can reach RUB 10 million. One more point: publishing photos of employees requires their consent, and Roskomnadzor looks at this during inspections.

10. Seller details and terms

A website that sells anything must show the company name, tax ID or registration number, contacts, prices and return terms, and an online shop also needs a public offer. If mandatory information about the seller or the product is missing, a company faces RUB 30,000-40,000 under Article 14.5 of the Code of Administrative Offences.

A 15-minute check

Open the website in incognito mode: does a cookie banner appear?
Submit every form: is the consent checkbox separate, is it pre-ticked, is there a link to the policy?
Open the personal account sign-in: are there Google or Apple buttons?
Scroll through the home page and the menu: are there English buttons or banners without translation?
Look at the website footer: are the company details and the privacy policy there?
Find your company in the register of operators at pd.rkn.gov.ru.
Ask your developer which counters are installed on the website and where requests go.

What inspections find most often

According to Anti-Malware, Roskomnadzor most often finds:

links to documents without confirmation that the person has read them;
pre-ticked consent checkboxes;
companies that are not in the register of operators;
mistakes in the documents themselves;
analytics without notice to visitors;
photos of employees without their consent.

Looking ahead: the artificial intelligence law

A law on the development of AI was adopted in the summer of 2026. The obligation to let users label content created by AI takes effect on 1 March 2027 and so far applies to websites and services with more than 500,000 visitors a day. It does not affect small businesses yet, but a bill on mandatory labelling of AI-generated materials has already been submitted to the State Duma, so it is worth keeping an eye on the topic.

Frequently asked questions

I have a simple business-card website without forms. Does this apply to me?

Partly. Even without forms, a website usually has an analytics counter, which means it needs a cookie banner. The requirements for the Russian language and company details also apply. But without forms and a personal account the risks are much lower.

I am self-employed. What fines do I face?

A self-employed person without sole proprietor status is usually liable as an individual under the Code of Administrative Offences, so the amounts are lower than for a company. The obligations are the same.

Do I need to remove Google Analytics?

There is no direct ban, but there is a risk: Roskomnadzor treats it as a cross-border data transfer. It is simpler to switch to Yandex Metrica and add a cookie banner.

How much time do I get to fix things?

According to Anti-Malware, after a Roskomnadzor order you get 10 days.

A contractor built the website. Who is responsible?

The website owner. So it is worth checking the website yourself, even if professionals built it.

Summary

Almost every point on this list can be closed in a day or two of work: remove unnecessary buttons, separate the consents, translate the interface, move forms to Russian services. That is cheaper than any fine and less stressful for the business.

A website check against 152-FZ, the Russian language law and the new sign-in rules: a list of violations and fixes as part of ongoing support. Website support starts at RUB 10,000 per month; details are in website support and development. If you are only planning a website, it can be built to these requirements from the start: a multi-page website. Contacts are on the page Roman Mikhailov, developer.