Last year, Platforma reported a rise in VPN users in Russia by 37 percent compared with 2022. A separate study by the Regional Public Center for Internet Technologies, ROCIT, found that 41.5 percent of Russians view VPNs as unsafe.
A different ROCIT survey suggests VPN services can collect data about a user’s location, payment details, device information, IP address, and more. These apps may also gather statistical and analytical data. Interestingly, the highest risk appears to be VPNs operating under U.S. jurisdiction.
Experts from Zecurion warned that setting up a VPN typically requires connecting to external servers using various network protocols. This can expose users to vulnerabilities that attackers might exploit to steal data. The Central Bank of the Russian Federation even advises disabling VPN usage when making online payments or accessing financial services.
Safety first
Russia places a strong emphasis on protecting online safety and personal data. In response, Roskomnadzor has developed criteria to block sites that offer access to resources prohibited in Russia. Beginning this year, a prohibition on promoting VPN services came into effect.
Also in Russia, the law known as No. 149-FZ, dated July 27, 2006, On Information, Information Technologies and Information Protection, remains in force. In 2017, Article 15.8 was added, declaring that programs that enable access to blocked resources are prohibited. Another key law is No. 152-FZ, On Personal Data, which sets strict rules on the collection and use of personal data with owner consent.
Lawyer Efim Kazantsev of the Moscow Digital School notes that using a VPN can present risks, so basic digital hygiene is essential. He explains that users should not rely on a VPN service constantly because all data may pass through the service provider’s servers. In the least harmful scenarios, this data could be used for marketing analytics and sold to systems that target users with personalized ads.
Kazantsev also points to reports of passwords and even funds being stolen from banking apps after VPN use. He recommends minimizing VPN use and avoiding it for banking and other sensitive activities that require passwords and access codes.
Another key precaution is to be selective about which VPN service to choose. It helps to take a few minutes to learn about the service, check user reviews, identify the company behind it, and read online impressions. Legally, Russia has strengthened protections for personal data, and compliance matters hold real weight.
The expert adds that while some offshore VPN providers exist, they may not align with Russian data protection standards. Following prudent digital hygiene and guarding personal data is essential.
Anton Nemkin, a member of the State Duma committee on Information Policy, Information Technologies and Communications, notes that free VPN services are common in app stores yet often pose hidden risks to users’ data. He emphasizes that many promote privacy as a marketing tactic while data may be leaked and sold to fraudsters.
Nemkin reiterates that Russia already has strong laws protecting online users and is preparing further amendments. He stresses that a broad ban on disseminating VPN services online is part of efforts to protect citizens’ security and data in cyberspace.
He also cautions that VPNs can bring inconveniences, including slower devices and reduced internet speed, and that some VPNs serve as gateways to blocked resources, sometimes used to spread misinformation, fraud, or fraudulent acts online. The mental impact on both adults and children is a concern as well. He urges individuals to limit VPN usage proactively rather than wait for nationwide restrictions, promising that personal online safety remains a shared responsibility across society.