VPN use in Russia in late 2026: where the actual danger lies

Roughly 40 percent of people in Russia now use a VPN, and among them the share paying for one grew from 15 to 48 percent between 2024 and 2026. Tens of millions carry a VPN app on their phone, and many of them have a recurring charge sitting in a bank statement. Every one of them has a reason to ask what that app, and that charge, might end up costing.

In November 2026, using a VPN in Russia is not an offence, and neither is paying for one. Anton Gorelkin, deputy chair of the Duma's IT committee, said in February 2026 that a fine for VPN use is not planned and not even discussed. A lawyer's review published by Izvestia on 28 October 2026 came to the same conclusion.

The danger has shifted away from the act of connecting itself. It now sits in two places. One is whatever the VPN use gets attached to, such as a search or a criminal charge. The other is records. A payment, a customer list or a connection log is stored for years, and it can be read later under rules that did not exist when the record was created. Three of those rules came into force in the past 14 months.

Is using a VPN against the law in Russia?

No. What the law punishes is narrower, and the details matter.

As of 1 September 2025, Article 13.53 of the Code of Administrative Offences, introduced by Federal Law 281-FZ, penalizes the deliberate search for and access to materials on the federal list of extremist materials. The fine runs from 3,000 to 5,000 rubles, and the article was drafted to apply to searches carried out through a VPN. The first fine, 3,000 rubles, went to a resident of Kamensk-Uralsky on 10 December 2025. A 16-year-old in Myski received the same fine from a juvenile commission in early 2026, and a court fined a resident of Dmitrov on 12 November 2026. No overall count of these fines has been published.

The same legislative package made advertising VPN services an offence, with fines reaching 500,000 rubles for companies. Since March 2024, publishing content that popularizes circumvention tools has been grounds for blocking the publisher. Providers face their own rule. A service that declines to connect to the state's block list is itself blocked. Roskomnadzor reported 469 blocked VPN services by late February 2026, up from 258 in October 2025. No official figure for the autumn had been published as of November 2026.

One rumour from the summer can be laid to rest. On 7 July 2026 the digital ministry denied it was weighing a charge on foreign traffic, including VPN traffic.

Placed side by side, the rules that can touch a VPN user or a VPN payment look like this. Our ledger of Russia's VPN rules follows them as they change.

The third row is the one most often misread, because it is the only place where the tool itself appears in the Criminal Code.

What does "VPN as an aggravating circumstance" mean in practice?

An aggravating circumstance does not make something a crime. It lets a court impose a heavier sentence for a crime that exists. Federal Law No. 282-FZ of 31 July 2025 added one such circumstance to Article 63 part 1 of the Criminal Code. It is clause "f" in transliteration, the Russian letter "ф", and it has been in force since 1 September 2025. The wording covers "committing a crime using software and hardware means of access to information resources and information and telecommunication networks to which access is restricted". The prosecutor's office published its own explanation on 12 September 2025.

Two properties define the clause's reach. It sits in the General Part of the code, so it can apply to any crime. It also needs a crime to attach to. A person who uses a VPN and commits no crime falls outside it. The clause never names VPNs. It describes a category of tools, and a VPN used to reach a blocked resource fits that description.

The law is 14 months old, and the known court practice is thin. In April 2026 Verstka found the first two verdicts applying it, both in drug cases. In Novomoskovsk, in the Tula region, a court in December 2025 sentenced a man to 1 year and 8 months in a colony after he reached a blocked seller's site through a VPN. In Ukhta, in Komi, a February 2026 verdict gave three years suspended. Reports by Meduza and Novaya Gazeta Europe note that it is unclear whether the tool was a VPN or Tor. OVD-Info said at the time that it knew of no political cases using the clause.

Two later developments belong beside the clause, though neither is law. On 28 October 2026 Eva Merkacheva, a member of the presidential human rights council, told Fontanka that investigators cite VPN use and disappearing messages as "methods of conspiracy" when asking courts to order pre-trial arrest. Her account is anecdotal and gives no count of cases. It concerns arrest hearings, which are a separate matter from clause "f". On 28 July 2026 Alexander Bastrykin, head of the Investigative Committee, said a bill had been prepared that would make the use of AI, VPNs and proxies a new aggravating circumstance where information technology is the main tool of the crime. No bill number has been published in the Duma as of November 2026. It remains a proposal.

For an ordinary user, the clause matters only if a criminal charge exists. VPN use alone leads nowhere. Once a person faces a charge of any kind, a VPN on the device or in the case file is something the prosecution can use.

What does paying for a VPN leave behind?

An app can be deleted. A payment record cannot, and for a VPN subscription it is often the trace that lasts longest.

In Russia that trace sits on domestic rails. Visa and Mastercard suspended their Russian operations in March 2022, so a Russian-issued card cannot pay a foreign merchant directly. A foreign service that advertises payment by Mir card or through SBP, the central bank's Faster Payments System, therefore has a Russian leg somewhere in its payment chain. Public reporting describes these legs by category: a Russian acquirer behind a storefront or a bot, a payment agent that collects rubles and settles abroad, a reseller marketplace, a domestic transfer to an individual. In every case, the money moves on Russian payment rails at the moment the customer pays. The foreign branding comes later.

Three layers can read that leg.

The middle layer is the new one. Law 461-FZ took effect on 1 September 2026, and from that date the financial monitor no longer has to ask each bank separately. The volume it covers is large. SBP alone carried 4.7 billion operations worth 26.5 trillion rubles in the first quarter of 2026.

Sellers in this market often suggest discretion through neutral merchant names, or charges that look like transfers to unrelated firms or individuals. At ledger level this is cosmetic. The bank and NSPK resolve any recipient to a registered entity or a verified person, whatever the display name says. In the criminal cases over donations to Alexei Navalny's Anti-Corruption Foundation, FBK, investigators matched bank statements by a repeating merchant identifier. Identical monthly amounts to the same recipient form a subscription pattern on their own.

Whether anyone actually queries the ledger for VPN subscriptions is a different question. No source documents it, and no prosecution over a VPN payment is documented anywhere. With nearly half of Russia's VPN users now paying, the records that could be queried describe tens of millions of people.

One expected rule did not arrive. In spring 2026, industry reporting anticipated a ban on paying for VPNs with Russian cards under the "Antifraud 2.0" bill, and at least one large Russian acquirer was reported to have stopped servicing VPN providers. The bill became Law 210-FZ of 26 June 2026, and the published summary of the law shows no VPN payment provision. As of November 2026, no such ban has been enacted.

Does the recipient of your payment change the risk?

A payment record has two ends, and the second end can matter more than the first. Russian law treats some recipients very differently from others, and some of its rules punish the payer while others only affect the recipient.

Foreign agents are where the confusion is greatest. No law punishes paying or buying from a foreign agent. A VPN service was first placed on the foreign-agent register in November 2023. Lawyers interviewed by Fontanka at the time said that "having financial relations with a foreign agent is not prohibited". One of them added that enforcement in this area is "absolutely arbitrary". The money rules that exist bind the agent. Since 1 March 2025, a foreign agent's income from Russian sources such as property sales and rent, intellectual property payments, interest and dividends goes to a special ruble account that stays frozen until the person is removed from the register. Salaries and fees are not covered. As of November 2026, no rule sanctions the person who pays.

Other designations do reach the payer. Financing an organization declared "undesirable" is a crime under Article 284.1 part 2 of the Criminal Code. In February 2026, Ksenia Belova was sentenced to a year and a half in a settlement colony for sending 150,000 rubles to the bank card of an activist of the AllatRa movement. The transfer went to an individual's personal card, and the court counted it as financing the organization. She said she had been misled about what the money was for. The court treated that as a "defence tactic".

Financing an organization declared "extremist" is a crime under Article 282.3. Mediazona counted at least 225 criminal cases in 64 regions over donations to FBK by 21 April 2026, which is the latest full count. The sums can be small. In October 2026 a Moscow resident named Ainulin was sentenced to three years for donating 2,100 rubles. On 12 November 2026 prosecutors asked for five years in the Leonovich case. Among the prosecuted payments were automatic charges that landed after the designation took effect, from subscriptions the donors say they had cancelled or never knowingly set up.

A third mechanism affects the recipient and stops the payment. Rosfinmonitoring keeps a list of terrorists and extremists that held about 23,000 individuals and 900 organizations in October 2026. People are added when they are charged, before any conviction. Their accounts are restricted and banks freeze their funds. A transfer to a listed individual is not criminalized as such, but the bank blocks it.

None of these rules is about VPNs, and no case connects a VPN purchase to any of them. They still explain why a seller under state scrutiny is a poor counterparty for the buyer. The buyer's payment record sits in the financial file of someone the state is investigating, and that file is read by people looking for other things. Designations can be applied later, and the donor cases show that payments continuing past a designation were prosecuted. A payment to a listed person is blocked by the bank, which leaves the buyer without the service. A grey intermediary's ledger can also change hands. When the central bank revoked QIWI Bank's licence in 2024, its records went to law enforcement.

Individual sellers in messengers are a separate case. No law is specific to buying a VPN from such a seller. The risk described there is fraud and blackmail, including threats that invoke a "criminal article". The sourcing for it is thin and limited to lawyers' question-and-answer pages.

Can leaked or copied databases tie a VPN to you?

Bank ledgers are one kind of record. Customer lists, registrant lists and client tables are another, and they reach the state by two routes. One is a leak. The other, since 1 April 2026, is a lawful copy.

On leaks, the legal position is clear. As of November 2026, no law allows Russian police to use leaked databases to identify people or as evidence. No published statute, decree, Supreme Court ruling or Duma bill authorizes it.

The practice is older than any recent law. On 17 August 2021, police visited Muscovites at home whose addresses appeared in leaked databases of Smart Voting registrants and Navalny supporters, according to OVD-Info. In February 2025, in the case of a pensioner prosecuted over 3,500 rubles donated to FBK, the leaked Smart Voting list was reportedly used to find him, while payment documents were the main evidence. That report rests on a single outlet's account. In September 2025, Mediazona wrote in its coverage of the Dmitry Regush case that security forces use these leaks as additional evidence. That is Mediazona's reading of similar cases, not a court finding. All of this is reporting about practice. None of it is a legal permission.

The law on leaks moved in the opposite direction. Since 11 December 2024, Article 272.1 of the Criminal Code makes it a crime to use, transfer, collect or store personal data obtained illegally. The penalty is up to four years, and up to ten in aggravated cases. The article has been applied to leak traders. In July 2025 a Moscow court sent seven people to detention or house arrest in a case about trading databases, among them alleged staff of the Interior Ministry's data centre. Whether the notes to the article say anything about use by investigators themselves has not been established.

The new power concerns legitimate databases, and it is wider than anything said about leaks. Since 1 April 2026, FSB bodies may obtain copies of the databases of any organization in Russia, or parts of them, free of charge and without a court decision. The order must come from the FSB director, his deputies or the head of a regional FSB office, and the database must contain information the service needs for its duties. The amendment passed the Duma on 16 December 2025 and took effect on 1 April 2026. The copies are to be destroyed once the purpose of obtaining them is reached. According to the outlet Agentstvo, no mechanism exists to check that deletion happens. Before this, access to an organization's databases generally required a court decision outside sector regimes such as SORM. No report documents this power being used to identify VPN users.

A copied database matters even when names are removed or when it holds only fragments, and the research on re-identification is consistent on why. In 2008, Narayanan and Shmatikov took the "anonymized" Netflix Prize dataset of film ratings and re-identified users by matching it against public IMDb ratings. In 2015, a study in Science examined three months of card transactions from 1.1 million people and found that four transactions with only coarse place and date information re-identified 90 percent of individuals. Knowing the amounts made identification easier still. The finding carries over to any large transaction dataset. Removing the names does not make a card anonymous.

The pattern is the same in every case. A dataset plus an identity source re-identifies people. A Russian reseller's customer list, a payment agent's ledger, a cloud provider's client table and a leaked registrant list are all datasets. Bank records, which resolve every payer to a passport, are the identity source.

What risks come with VPNs that tunnel through Russia's whitelist?

The database power reaches organizations in Russia. Since 2025, some VPN setups have come to depend on exactly such organizations, and the reason is the mobile shutdowns.

Mass regional shutdowns of mobile internet began in May 2025, officially as a measure against drones. On 8 July 2025 users in 77 regions reported shutdowns in a single day, and at least 2,099 shutdowns were counted that month. The monitoring project Na Svyazi found that by 2026 all 83 of Russia's internationally recognized regions had experienced at least one. Mobile data traffic fell 22 percent year on year in the first half of 2026, and in the worst-hit regions, Ivanovo among them, it was down more than 40 percent.

What remains reachable during a shutdown is the whitelist, a registry of approved domestic services that the digital ministry first published in September 2025 with a few dozen entries. It passed 500 by April 2026. Its reported core is government portals, VK and Yandex services, the Mir payment system, major banks and marketplaces. Whitelist mode turns censorship inside out. Instead of a list of what is forbidden, there is a list of what is allowed, and anything new, foreign or unapproved is blocked by default. The physical side of this arrangement is the subject of our article on the Sber and VK data centre strikes and the whitelist.

Some VPN setups have stayed reachable in this mode by routing through infrastructure that is itself whitelisted, such as servers rented inside Russian clouds. The clearest sign that the practice was widespread is that the state answered it three times in 2026.

No fourth official round has been confirmed since 31 August. Blocking waves were reported in September and November 2026, and attribution for them is weak. Our account of the September 2026 blocking wave sets out what is known.

Each of those rounds cut working connections overnight, so availability is one problem with such paths. The larger problem is legal. Routing through a whitelisted Russian platform places a Russian legal entity in the path, and Russian law is explicit about what such an entity must do.

The right-hand column does not mean that any path is safe. A user's own Russian operator stores connection metadata for a year under the same rules. The comparison shows only where a company that can be compelled sits.

The companies in the left-hand column have a record. A Novaya Gazeta Europe study counted more than 30,000 cases over posts and memes across all platforms, with VK behind about 80 percent of the administrative cases and about 46 percent of the criminal ones. Documented handovers have included a defendant's complete login history by IP address. Yandex reported 77,979 government data requests in 2024 and satisfied 74 percent. In April 2026 Yandex's cloud wrote state-directed client blocking into its standard contract. Since 1 April 2026, the FSB's power to copy databases without a court applies to every one of these organizations.

What might change next?

Four measures are pending as of November 2026. None of them is law.

The Bastrykin proposal from July 2026 would introduce a second, broader aggravating circumstance covering AI, VPNs and proxies. No bill number has been published in the Duma. If a text appears, its wording will show whether the existing clause "f" is being widened or duplicated.

The "Antifraud 3.0" package is a digital ministry draft whose public comment period ran until 15 October 2026. As reported by CNews, it would bar owners of VPN services from Russian hosting, possibly from 1 March 2028. That would act on providers and on the Russian relays that whitelist routing depends on.

The first formal rules for admission to the whitelist were drafted in October 2026. CNews reported on 5 October that the date they take effect is unknown. Until then, admission and removal remain informal.

The fourth concerns payments. No ban on paying for a VPN with a Russian card has been enacted, and the reported FSB demand for remote access to bank systems carries a 2027 horizon without a public text.

What does this add up to for a VPN user in Russia?

The baseline has survived two years of new legislation. Using a VPN in Russia is not an offence, paying for one is not an offence, and no prosecution over a VPN payment has been documented.

The rules around that baseline have changed three times since September 2025. From 1 September 2025, a VPN can make any criminal sentence heavier, and an account from October 2026 says investigators bring it up when they request arrest. From 1 April 2026, the FSB can copy any Russian organization's database without a court. From 1 September 2026, the payment stream is read centrally and without notice to the client. Each of these rules concerns records or context. None concerns VPN use on its own.

That is why the counterparty matters as much as the tool. Every Russian entity in the chain, whether it takes the payment, hosts the relay or resells the subscription, is a place where a record about the user is kept under Russian law. A seller who is under investigation or designated adds that seller's own file to the picture. The donor cases show that Russian practice reads old records under new designations, so a record made lawfully in 2026 is not guaranteed to be read under 2026 rules.

For a person in Russia, then, the exposure in late 2026 is rarely the connection. It is the accumulated record of who was paid, through which Russian company, and what else that record sits next to if a case of any kind is ever opened.

We will update this page when any of the pending measures moves, if a documented case of payment-based enforcement against VPN buyers appears, or if courts begin applying clause "f" outside drug cases. The Russia country page gathers our other coverage.