VPN ban without ban
Russian authorities do not ban VPNs by law, but by April 2026 they had established a system of restrictions that resulted in app downloads increasing 14-fold.
At the end of March 2026, the head of the Ministry of Digital Development Maksut Shadaev held two meetings in a row: with mobile operators and with representatives of more than twenty major internet companies. As reported by Kommersant, RBC and Forbes Citing industry sources, operators were asked to impose a fee for "international traffic" over 15 GB per month by April 15, and whitelisted companies were asked to restrict access for users with VPNs enabled. At the same time, Apple was removing VPN apps from the Russian App Store: by the end of April, 116 services were unavailable, according to the Apple Censorship Project.
A month later, the scheme failed. According to an investigation by Hi-Tech Mail.ru, by April 28, Ozon, Wildberries, Yandex services, VkusVill, Perekrestok, Pyaterochka, and 2GIS were again open with VPNs enabled. The marketplaces recorded a drop in activity and lifted the blocks without any public announcements.
A law that prohibits nothing
Federal Law No. 281-FZ, signed on July 31, 2025, does not prohibit VPNs. It establishes a fine of 3000–5000 rubles for individuals searching for materials listed as extremist using blocking circumvention tools. Advertising VPN services carries a harsher penalty: up to 80,000 rubles for individuals, up to 150,000 for officials, and up to 500,000 for legal entities. Amendment No. 282-FZ to Article 63 of the Criminal Code recognizes the use of a VPN in the commission of a crime as an aggravating circumstance.
There is no direct ban on the use of this technology in any legislation. State Duma deputy Anton Gorelkin In April 2026, he confirmed that a complete ban was not on the chamber's agenda, and that legal corporate VPNs would remain a viable business tool. On March 30, Minister Shadayev stated that the Ministry of Digital Development, Communications, and Mass Media is obligated to reduce VPN usage, but opposed administrative liability for the use itself. On April 2, the presidential press secretary Dmitry Peskov said he had no information about the order Vladimir Putin limit VPN operation.
The discrepancy between public rhetoric and government action can be described not as a communication breakdown, but as a structural decision. An outright ban would require a political move with obvious consequences: millions of citizens would become offenders, businesses would lose a remote work tool, and responsibility would fall on specific signatories of the law. Indirect restrictions, through instructions to operators, pressure on platforms, and payment barriers, distribute responsibility among dozens of actors and require no official recognition of the goal.
Four pressure levels
First level – Telecom operators. The Ministry of Digital Development proposed charging for traffic to foreign servers over 15 GB per month on mobile networks. According to the ministry's calculations, this is the average monthly volume of a VPN user. Experts interviewed by the Habr portal countered: 15 GB is enough for messaging and occasional calls, but watching videos in acceptable quality will exhaust the limit in a few days. Beyond this limit, the charge is 100–150 rubles per gigabyte. An active user of video services via VPN faces a bill of several thousand rubles per day.
By April, operators began discussing a deferment with the Ministry of Digital Development, citing technical difficulties: separating national and international traffic requires the deployment of new deep packet inspection infrastructure. The deadline was pushed back.
Second level – "whitelisted" platforms that continue to operate during mobile internet outages. As reported by RBC and Zona, companies were offered a choice: block users with active VPNs or lose their place on the list and their IT accreditation. The Ministry of Digital Development, Communications, and Mass Media distributed a technical guide with a detection algorithm. It includes:
- IP comparison with Roskomnadzor databases;
- parallel requests to Russian and foreign domains;
- separate procedure for desktop systems;
- A whitelist of corporate VPNs, linked to business hours and verified with GPS and base stations.
Third level – Apple ecosystem. Effective April 1, 2026, all four major telecom operators blocked Apple ID top-ups from phone balances. At the same time, Apple removed apps from the Russian App Store: Streisand, V2Box, v2RayTun, and Happ – in March; by the end of April, the list had grown to 116. Previously installed apps work, but without updates.
Fourth level – the protocols themselves. As RBC reported in December 2025, Roskomnadzor began blocking SOCKS5, VLESS, and L2TP. Telecommunications expert Alexey Uchakin called VLESS one of the last relatively stable protocols that had long evaded detection by TSPU systems. The expert Luka Safonov He clarified that completely blocking VLESS is technically difficult, but the agency detects it through indirect indicators: traffic originating from foreign IP addresses and domain and source mismatches. According to Kommersant, the Ministry of Digital Development, Communications and Mass Media plans to increase the capacity of the TSPU by 2,5 times by 2030, to 954 terabits per second, with a budget of approximately $186 million (at the exchange rate at the time of publication, approximately 17 billion rubles).
At the same time, the system of "whitelists" for access—filtering based on the principle of "only specified"—is being expanded. According to the On The Line project, by the end of November 2025, such lists were in effect in 57 regions. These lists include government services, the MAX messenger, VK, Odnoklassniki, Yandex platforms, marketplaces, the Mir payment system, and telecom operator websites.
Numbers that describe the market
Key indicators of the VPN market in Russia
- Google Play downloads, March 2026: 9,2 млн (14-fold increase by March 2025).
- Downloads per year (March 2025 – March 2026): 35,7 млн.
- Downloads for Q1 2026: 21,27 млн – the bulk of these occurred at the end of the period, against the backdrop of a new wave of blockages.
- The active base of the five largest VPN services at the end of 2025: 7,3 million people (Sensor Tower).
- VPN search queries in Yandex, March 16–22, 2026: ≈ 3 million (3,3 times increase per year).
The source for downloads and search queries is the Digital Budget platform, based on Similarweb statistics.
The difference between the number of downloads and the active database is telling: users install, uninstall, and search for a stable solution. Each increase in blocking breaks existing apps, prompting users to download new ones. Searches are skewed toward Moscow, the Moscow region, and central Russia, where a tech-savvy audience is concentrated.
The figure of 35,7 million per year is not marginal story Enthusiasts. This is the transition of VPNs from an advanced user tool to a mass-market service. Each subsequent restriction triggers a new cycle: users gain practical experience in finding and reinstalling alternatives, the market generates new applications, and technical communities write manuals for a non-technical audience.
The Enemy's Point of View
On April 15, Russian marketplaces began blocking users with VPNs enabled. By April 28, Ozon, Wildberries, Yandex Pay, Yandex Books, Yandex Maps, and the websites of VkusVill, Perekrestok, Pyaterochka, and 2GIS were reopening with VPNs enabled. According to Hi-Tech Mail.ru's investigation, there is no unified blocking policy – access depends on the bypass method and region.
On April 27, the Ministry of Digital Development, Communications and Mass Media explained the restrictions by citing "data security": VPN services often fail to protect privacy, especially when it comes to government platforms that handle personal data. The following day, April 28, the head of the Human Rights Council Valery Fadeev At an international scientific and practical conference, Fadeev presented a different version of the rationale. According to Vedomosti, Fadeev stated that he himself does not use a VPN and continued:
Meduza and Dozhd (both designated foreign agents and undesirable organizations in Russia) aren't just another point of view; they're the enemy's point of view. And that's propaganda.
According to Fadeev, people using VPNs are not looking for a different point of view, but rather for “what the enemy is saying,” and there is “something unnatural” about this.
In April, a comment circulated in anonymous Russian-language Telegram channels listing everyday VPN use cases: communicating with employees working outside the stable access zone to Russian services; reading foreign technical forums and transferring work information from there; maintaining contact with relatives and partners abroad. The comment is anonymous and doesn't serve as a standalone argument, but one fragment—an appeal to Fadeyev—was shared publicly:
"You advised the president on this while you were an advisor? Well, thank you on behalf of the entire country."
The statement substantively confirms what is also confirmed by non-anonymous sources: VPNs are used for practical applications at industrial enterprises, professional communities, and cross-border work communications. The "data security" explanation, when applied to marketplaces and delivery services, is unconvincing, according to industry experts: personal data is stored on these platforms regardless of the user's channel of access. The explanation based on the "unnatural" interest in foreign sources also doesn't cover the actual usage.
It's plausible that platform reversals are driven by economic rather than ideological reasons: a platform that makes access less convenient loses users faster than users lose their connection to the platform. Loyalty to content outweighs loyalty to the delivery channel.
By the end of April, the State Duma deputy Dmitry Gusev proposed creating a list of permitted VPN protocols—a "whitelist" of services—that would minimize disruption to businesses. This is a sign of recognition that blanket restrictions hit the domestic economy harder than the intended recipients.
Distancing from above
On April 27, Vladimir Putin addressed the Federal Assembly's Legislative Council. According to Meduza and Vedomosti, he urged legislators not to dwell on bans and restrictions, describing the legislative process as "systemic" and "creative," rather than merely "adapting to current challenges and risks." That same day, Rossiyskaya Gazeta reported, he added that "any difficulties are temporary, Russia is eternal, and there's no need to dwell on bans."
Compared to the actions of the Ministry of Digital Development, Roskomnadzor, and telecom operators, this doesn't seem contradictory; rather, it's the institutionalization of an established practice. The top political leadership distances itself from specific measures, formally leaving them under the responsibility of agencies. These agencies are implementing measures that aren't formalized as a unified political decision. Members of parliament are discussing "whitelists" as a way to mitigate what officially isn't happening. The presidential human rights adviser publicly slants the issue of restrictions toward the enemy.
The result is a distributed system with four characteristics: measures are implemented, responsibility is diffuse, rhetoric is contradictory, and coordination is not public. Such a system has no single author to whom complaints can be addressed—and this is its main advantage over a formal ban.
Architecture without a project
There is no formal national plan to ban VPNs, and none is likely to emerge in the foreseeable future. This is hampered by four factors:
- the president's criticism of the course of prohibitions;
- the Ministry of Digital Development's reluctance to introduce administrative liability for the very fact of use;
- economic losses of platforms from the restrictions already introduced;
- lack of political will to formalize a complete ban into law.
Instead of a project, a four-layer architecture works:
- legislative (fines for advertising and searching for extremist materials);
- technical (protocol blocking, TSPU expansion, regional access whitelists);
- economic (payments for international traffic, blocking Apple ID replenishment);
- platform (pressure through whitelists and IT accreditation).
Coordination is carried out at the Ministry of Digital Development, Communications, and Mass Media level, without any public documentation. Similar to a manufacturing process, this extends the cycle without producing a finished product: each new iteration of blocking requires new instructions for operators, new technical guidelines for platforms, a new round of App Store removals, and a new budget for the TSPU. The end result is the same 9,2 million downloads per month and parliamentary proposals for a VPN "whitelist," effectively acknowledging something that officially doesn't exist.
Where is this going?
The fork in the road will be determined within the next year. All three scenarios below could be realized partially and in parallel; this is about the dominant logic, not mutually exclusive options.
Scenario One: Continuation of the current course – with increasing technical and economic barriers. Some form of international traffic charges will be introduced, the capacity of the VPN will be increased, and the list of blocked apps in the App Store will be expanded. The costs will be borne by operators, platforms, and users. The active VPN user base will remain between 7 and 10 million, with downloads growing with each new restriction.
Scenario two: transition to a selective model – through a "whitelist" of approved VPNs. This allows the state to control part of the market and legitimize corporate use cases. The price is a rejection of the rhetoric of fighting the technology itself and recognition of its legitimacy. Gusev's proposal is the first visible step in this direction.
Scenario three: slow dismantling The current system is under pressure from economic losses. Marketplaces that opened access at the end of April and operators seeking a deferment are already visible signs of resistance within the system. Without a formal decision from above, individual layers of the architecture may cease to function simply because their implementers are bearing the costs, and political support outweighs the benefits.
Which logic will prevail depends on the balance of power within the state—between information control agencies and those who count economic losses. By the end of 2026, the answer will be clear from a simple indicator: whether charges for international traffic have been introduced, whether a "whitelist" of permitted VPNs exists, and how many apps are available for download in the Russian App Store.
So far, there's only one answer. A user who visits Google Play in March 2026 downloads a VPN app fourteen times more often than the year before. This is the result of an architecture without a project – measured in millions of downloads and not reflected in a single line item in the federal budget.
Information