Russia's VPN crackdown, 2017 to 2026: is using a VPN legal in Russia? Every law and every block

The old version of this page promised to tell readers how to stay connected and secure in Russia. It had no sources, and it gave advice that Russian law now treats as grounds for blocking the page it is written on. I have taken that advice out and replaced it with the record.

The searches that reach this page are factual ones: is using a VPN legal in Russia, what changed in the regulations, how many people use one, what happened to Opera's VPN. This version answers them from the statute book and from Roskomnadzor's own announcements. One table lists the ten rules that touch VPNs and says who each one binds. The second lists 30 enforcement steps between 2018 and September 2026, each with a source. It is a description of the law and of what the state has done. It is not a guide to getting around either.

Is using a VPN legal in Russia?

As of September 18, 2026, using a VPN is not an offence in Russia. No article of the Code of Administrative Offences or the Criminal Code penalises a person for connecting through one, and the officials responsible have said so repeatedly:

• December 26, 2024: the head of the Duma's IT committee said there was no question of fines for using a VPN.
• July 23, 2025: the digital development minister said ordinary users would not be fined "even when using a VPN".
• Reported July 25, 2025: a senior member of the Duma's information policy committee said "the very fact of using VPN will not be qualified as an offense".
• January 22, 2026: the same lawmaker said fines for use were neither planned nor discussed.
• March 31, 2026: the minister said his ministry had been told to reduce VPN use, and that fining users was a blunt solution he categorically disliked.
• April 2, 2026: the Interior Ministry's cyber-police said VPN use "increases the risk of data leaks but does not entail any legal liability".

The good news ends there. Russian VPN law is a body of rules that regulates every party around the user and leaves the user formally alone. It works by making VPNs hard to find, hard to install, hard to keep running and, since 2026, awkward to have switched on.

Which Russian laws regulate VPNs, and who does each one bind?

Count the third column. Of ten rules, eight bind someone other than the user: providers, search engines, operators, publishers, advertisers, platforms. Two touch the user, and both took effect on the same day, September 1, 2025. Neither punishes having a VPN switched on. One fines a deliberate search for extremist material, and mentions VPNs only to say they are no excuse. The other makes a sentence heavier when some other crime was committed through a VPN.

The record of those two provisions in their first year is thin. Mediazona knew of six cases under Article 13.53 by September 2026, where the only reported fines were 3,000 rubles against a statutory maximum of 5,000, and no report mentions a VPN. The first known sentences using the aggravating circumstance, in December 2025 and February 2026, were both for buying drugs online. I found no fine imposed on anyone for VPN advertising either. The antimonopoly service made its first finding under the advertising ban, reported by Vedomosti on January 27, 2026, over links in a Telegram channel, and no amount was reported.

A small number of cases does not mean a small risk. A law that is rarely applied can be applied to anyone, and the list of extremist materials runs to thousands of entries. It does mean that the statute book is not where the crackdown lives. The crackdown is technical, and the second table is where to look for it.

What has the state actually done, year by year?

Of the thirty rows, 14 fall in the six years before 2025 and 16 in the 21 months since. The early steps are aimed at VPN companies, one demand or one block at a time. From 2024 the target widens to the places where a VPN is obtained, which means app stores, search results, and pages that explain. From 2026 it widens again to the network and to the far end of the connection: the domain name system, the mobile network as a whole, and Russian services that turn a VPN user away. Only three of the 30 rows record a fine on anyone, and two of those three are fines on Google.

A VPN is a tool that moves your traffic through an encrypted tunnel to a server somewhere else, and Russian law treats the tool as lawful while treating nearly everything needed to get and run it as regulated. That sentence is the most accurate short answer I can give to "is a VPN legal in Russia".

How many Russians use a VPN, and how many VPNs are blocked?

Two series of numbers run through the period. One is Roskomnadzor's count of the services it has blocked. The other is the share of Russians who tell pollsters they use one.

Between October 2023 and February 2026 the number of blocked services rose 2.8 times, from 167 to 469. Over roughly the same period the share of people using a VPN rose from about a quarter to 40%, on polls from two different firms. Russian Field's own baseline was 34% in August 2024. Both curves go up together, which is not what a blocking programme is meant to produce. Downloads say the same thing: Russians installed VPN apps 9.2 million times from Google Play in March 2026, 14 times the figure for March 2025, in the month Telegram was blocked, weeks after WhatsApp.

My reading is that each block of a popular service creates more VPN users than each block of a VPN removes. The state appears to have drawn the same conclusion, because its 2026 measures no longer depend on blocking VPNs one by one. Freedom House scored Russia 17 out of 100 in Freedom on the Net 2025, down from 20 in 2024, and cut its indicator on anonymity and encryption to zero over the blocking of encrypted messengers and the expanded blocking of VPNs.

What does this mean for someone in Russia, or travelling there?

Four practical facts follow from the record. None of them is an instruction.

• The law on use is the same for everyone in the country. There is no separate rule for visitors, and no registration or permit for personal use.
• Do not assume a VPN is invisible. Since April 2026 large Russian services actively check for one, the ministry has circulated a guide to detecting VPNs on devices, and VPN operators told Meduza that the August 2026 blocking wave apparently drew on address data gathered by ordinary Russian apps. A VPN hides the content of your traffic from the network. It does not hide the fact that you are using one.
• The two provisions that reach users are about conduct. They are about a deliberate search for extremist material and about committing a crime. Russia's list of extremist materials is long, and what counts as extremist there is broader than in most countries.
• During a mobile shutdown nothing works. A VPN needs a connection. In 2026 only the services on the official white list stay reachable when mobile data is cut.

Le VPN has been on the receiving end of two of the rows above, the March 2024 rule and the July 2024 removals. Our iOS app was removed from the Russian App Store on July 4, 2024. The notice from Roskomnadzor reached us through Apple a day after the removal and was dated June 24. It said the app's store page contained "prohibited information on ways, methods of providing access" to restricted resources, which is the wording of the March 2024 rule, applied to the description of a VPN app. We published the details of that notice at the time. It is also why this page describes and does not instruct: under the same rule, a page that explains how to get around Russian blocks can be blocked for saying so, and since November 2024 even statistical writing about it has lost its exemption.

For the wider picture, the social media ban tracker puts Russia's platform blocks next to nine other countries', and the jurisdiction table explains why the country a VPN company is based in matters when a regulator sends it a demand.

What changes next?

• The hosting ban. The "Antifraud 2.0" package, passed by the Duma on June 10, 2026, bars Russian hosting companies from serving VPN services that ignore the 2017 rules. It was signed on June 26, 2026 as Federal Law 210-FZ. I could not confirm from which date the hosting ban applies.
• The traffic fee. The plan to charge for international mobile traffic above 15 GB a month was officially dropped on July 7, 2026, ahead of the Duma elections of September 18 to 20. Whether it returns afterwards is the first thing to watch in the fourth quarter.
• Fines for use. Denied on the record in December 2024, July 2025, January 2026 and March 2026. Any bill that changes this would be the biggest shift in the table above.
• Roskomnadzor's targets. 92% effectiveness against VPNs and 98% of traffic through the inspection equipment by December 31, 2030.
• The rule on circumvention information expires on September 1, 2029 and will need renewing.
• The next official count of blocked VPN services. The last was 469, on February 26, 2026, before the August wave.