Russia’s Digital Ministry sent the country’s largest internet companies guidance on detecting VPN use on users’ devices, RBC reported. According to the outlet, the document was distributed after ministry meetings with more than 20 platforms, including Sber, Yandex, VK, Wildberries, Ozon, Avito, and X5.
Journalists say that at those meetings, minister Maksut Shadayev ordered companies to restrict access to online services for users with VPN enabled by April 15. Otherwise, the publication says, companies could lose their IT accreditation, which allows them to remain on official white lists.
The guidance proposes focusing first on devices running Android and iOS, since they account for more than half of users. It outlines three steps: identifying the device’s IP address and checking whether it matches Russian IPs and Roskomnadzor’s blacklist, checking for circumvention tools through the company’s own app if it is installed, and detecting VPN use on other systems, including Windows and macOS.
At the same time, the document notes that the second stage is difficult to implement on iPhones because iOS significantly restricts access to system settings. On Android, by contrast, an app can request information about the active network and determine whether traffic is passing through a VPN. The recommendations advise against constant monitoring because it would increase data usage and battery consumption.
The document also lists situations in which VPN detection is difficult: when a VPN is configured on routers or in virtual machines, when users rely on proxy servers, split tunneling, or CDNs. It also notes that new VPN services appear faster than IP reputation databases are updated.
Cyberlawyer and Roskomsvoboda co-founder Sarkis Darbinyan said platforms were likely being asked to embed a module in their mobile apps that can detect VPN connections and send requests to Russian and foreign servers, including Telegram and WhatsApp.
In his view, such technology could then be used to fully or partially block access to the companies’ own services. Darbinyan describes the move as unprecedented for business apps and warns that it could undermine user trust, trigger public scandals, lead to app removals from the App Store and Google Play, and cause companies to lose both audience and revenue.