Since 2025, Roskomnadzor has moved to a new level of control. Now, an automated AI-based monitoring system scans Russian websites 24/7. It finds violations on its own, records them, and transmits the data for issuing fines. The human factor no longer works — if there is a flaw on the website, the system will find it.

Fines for violations in the processing of personal data (152-FZ) and trading rules (ZoZPP) have increased significantly. To avoid losing money and facing blocks, here are 8 points you need to check on your website right now:

1. Data collection forms (applications, chats, subscriptions)

Any form where a user leaves their full name or phone number must have a mandatory consent checkbox (not pre-checked by default!) and a link to the Privacy Policy. Otherwise, this is a direct processing of personal data without consent.

2. Cookie banner

You cannot collect analytics and cookies before the user clicks «Agree». The banner must be present on the first visit, and the privacy policy must explicitly state which cookies you collect and why.

3. Company legal details

For individual entrepreneurs and LLCs, according to the consumer protection law (ZoZPP), full legal details (INN, OGRN, legal address) must be in the website footer. This is a basic rule of trust and transparency.

4. Registration in the personal data operators registry

If your website collects a customer database (even just names and phone numbers in a CRM), you are obliged to notify Roskomnadzor and be included in the personal data operators registry.

5. Cross-border data transfer

Carefully check where the data goes. The use of foreign services (Google Analytics, some Western CDNs, foreign authorization forms) may be considered a cross-border transfer, which requires separate permission. This is especially relevant if your domain is not in the .ru/.рф/.su zone.

6. Reviews with names and photos

If you publish customer reviews with their photos or full names, consent to data processing alone is not enough. A separate written consent for the dissemination of personal data is required.

7. Resume submission form

If the website has a «Careers» section with a resume upload form, a separate personal data processing policy must be developed for job applicants.

8. Foreign words and abbreviations

Roskomnadzor and Rospotrebnadzor have recently been closely monitoring compliance with the state language law. It is recommended to eliminate or replace foreign terms and anglicisms with Russian equivalents (for example, not «Sale», but «Распродажа», not «call-back», but «обратный звонок»).

What to do?
Go through this checklist yourself or pass it to your developer. If you are unsure about the security of your website and doubt the correctness of your documents — we at DLILB will help you conduct a comprehensive audit, find vulnerabilities, and bring your resource into compliance with the new legal requirements.

Save this post so you don't lose the checklist 🔥