Is using a VPN legal in Russia? What the law actually says

“Is it legal to use a VPN in Russia?” gets asked more often than any other question, and the answers online range from “everything has been banned since last year” to “there are no restrictions at all.” Both are wrong. What follows is a walk through the documents: which rules have been adopted, when they took effect and, above all, whom they are addressed to.

This is a snapshot as of September 15, 2026. Every statement rests on the text of a law; where something concerns enforcement practice or news reports, that is flagged separately.

The short answer

Russian legislation contains no ban on using a VPN. You check that against the lists themselves rather than against headlines: the Code of Administrative Offenses (KoAP) contains exactly three offenses involving tools for accessing blocked resources, and in none of them is the user the party held liable. The list of aggravating circumstances in Article 4.3 of the KoAP does not mention using such tools either.

Officials repeat the same thing publicly. In April 2026, the president’s press secretary answered the question directly: there are no bans on this score and no liability is established for use. In the summer of 2025, when the law on fines for searching for extremist material was going through, the head of the Ministry of Digital Development made a point of saying that there were no plans to fine VPN users.

It is important to understand that this is the absence of a ban, not a guarantee of access. In parallel, the infrastructure around VPNs is being squeezed: services are blocked, apps are pulled from the stores, and some Russian platforms stop working while a connection is switched on. Law and practice diverge here, and there is a separate section on that below.

What the laws actually contain

The word “VPN” barely appears in the legal texts. The term that carries legal weight is a cumbersome one: “software and hardware tools for accessing information resources to which access is restricted.” It refers specifically to tools for getting around blocks, not to encryption as such.

The fine for searching for extremist material

This is the only rule where the party held liable is an ordinary individual. Article 13.53 of the KoAP punishes deliberately searching for material known to be extremist — material on the published federal list — and gaining access to it, including through tools for getting around blocks. The fine runs from 3 to 5 thousand rubles.

The way the rule is built matters: what is punished is the search for particular material, while the means of connecting is named only as one of the ways of doing it and is no offense in itself. A page opened by accident does not fall under this article: it turns on intent and on the material being known to be extremist.

It is too early to judge how it is enforced. According to media and human rights organizations, the first known penalty was handed down in December 2025, and as of mid-2026 only isolated cases are publicly known. We could not find official court statistics for this article.

A VPN as an aggravating circumstance

Since September 1, 2025, Article 63 of the Criminal Code has included clause (f): committing a crime using tools for accessing blocked resources. This is where confusion sets in most often, so point by point:

• it is not a crime in itself and not an element that changes the charge, but a circumstance the court may take into account when setting a sentence;
• it applies only where there is already a crime. Accessing a blocked site is not a crime;
• the KoAP has no equivalent aggravating circumstance — the list in Article 4.3 is closed and contains no such item.

Going by media reports, by the spring of 2026 there had been isolated sentences that applied this clause, mostly in drug cases.

The advertising ban: who it applies to

Since September 1, 2025, the Advertising Law has prohibited advertising tools for accessing resources to which access is restricted, and the KoAP has added fines on top. The parties here are the same as everywhere else in advertising law: the advertiser and whoever distributes the advertising. That means both channel authors and the platforms that carried such advertising fall under the rule. An ordinary user is not a party to this offense.

The first known case, according to an industry publication, was decided by the Federal Antimonopoly Service (FAS) in January 2026: the owner of a Telegram channel was held liable, and what the antitrust regulator treated as advertising was posts containing links to services.

Why services stop working if there is no ban

The absence of a ban does not mean everything works. Here is what actually happens.

• Services are restricted. According to Roskomnadzor, access to 469 VPN services had been restricted by the end of February 2026. The grounds are failure to meet the requirements of Article 15.8 and the rules on centralized management of the communications network.
• Apps are removed. According to business media, more than two dozen apps were pulled from the Russian App Store in March 2026 at the agency’s demand.
• Russian platforms shut out an active VPN. In the spring of 2026, the Ministry of Digital Development asked large platforms to restrict access for users with a connection switched on. That is a request from the agency rather than a rule of law, but the effect on a person is real enough.
• Whitelists. The lists of resources that keep working when mobile internet is restricted are drawn up by the ministry together with the operators. There is no regulation setting out how something gets on a list or how that can be appealed — specialized legal publications make the same point.
• Suspension of service. Since the spring of 2026, the law has required operators to suspend service at the demand of the security agencies in cases established by acts of the president. The list of those cases has not been published, so there is no way to check it.

How the connections themselves are built, and why some of them stop working sooner than others, is covered separately: what VLESS and Reality are, in plain English.

Corporate use

Connections inside organizations are a separate story. Part 17 of Article 15.8 expressly carves out cases where the circle of users is determined in advance by the owner and the connection is needed for the organization’s own operations; there are exceptions for government bodies as well.

In April 2026, Roskomnadzor publicly confirmed that corporate communication inside the country is not restricted, and that companies needing foreign encryption protocols should file an application with the Center for Monitoring and Control of the Public Communication Network.

We could not find a federal ban for civil servants. That does not mean there is none at all: an employer is free to set its own internal rules, and those are what is worth checking.

What is being discussed but has not been adopted

There are plenty of rumors around this subject, so it is worth separating discussion from actual rules.

• “A total ban as of such and such a date.” Texts like this circulate regularly on aggregator sites, but none of them cite a legal act. As of September 2026, legislation contains no such rule.
• A charge for “international” mobile traffic. The ministry has confirmed that it is working on such a measure; the timeline has been pushed back several times and no legal act exists.
• The Investigative Committee initiative. In July 2026, media reported on a draft law it had prepared to toughen punishment for crimes committed using technology, including tools for getting around blocks. We could not find any record of the draft being submitted to the State Duma.
• Fines for use. In 2026, members of the relevant parliamentary committee said publicly that such fines were not being discussed, and the head of the Ministry of Digital Development called administrative liability “a blunt-instrument solution” that the ministry does not like.

For now these are discussions and nothing more. An adopted rule always has a law number, a publication date and a date on which it takes effect — that is what to check news reports against.

What to take away

• As of September 2026, Russian law contains neither a ban on using a VPN nor any liability for the mere fact of using one.
• Liability is established for other things: advertising circumvention tools, violations by the services themselves, and deliberately searching for extremist material.
• The Criminal Code has acquired an aggravating circumstance, but it applies only to someone who has committed a crime.
• The date everyone repeats, March 1, 2024, refers to the criteria for blocking pages about ways around blocks, not to a ban on use.
• Law and practice diverge: there is no ban, yet services are blocked, apps are removed, and some Russian platforms do not work while a connection is switched on.

If you have moved abroad and need access to Russian services, the practical side of the question is covered here: what a “reverse VPN” is and why you need one after moving.