Russia is tightening the screws on virtual private networks — again. But this time, the Kremlin isn’t just blocking servers or throttling connections. It’s going after wallets.
A sweeping set of legislative proposals now moving through Russia’s State Duma would impose steep fines on individuals and businesses caught using unauthorized VPNs to circumvent the country’s internet restrictions. The measures, first reported by TechRadar, represent Moscow’s most aggressive push yet to stamp out the tools that millions of Russian citizens rely on to access blocked content — from independent news outlets to Western social media platforms.
The numbers tell the story. Under the proposed legislation, ordinary users could face fines of up to 30,000 rubles (roughly $300) for using VPNs to access banned resources. For legal entities, the penalties jump dramatically — up to 700,000 rubles, or about $7,000. Internet service providers that fail to enforce blocking orders would face their own set of escalating fines. And VPN services themselves, if they don’t comply with Russia’s telecommunications regulator Roskomnadzor, could be shut down entirely.
This isn’t Moscow’s first attempt to rein in VPN usage. Russia formally banned unauthorized VPNs back in 2017, passing a law that required such services to connect to a government registry and block the same websites that Russian ISPs were ordered to restrict. Most major VPN providers simply ignored the directive. Some pulled their physical servers out of the country but continued serving Russian users through virtual server locations and obfuscation protocols designed to make VPN traffic look like ordinary web browsing.
The enforcement gap was enormous. And everyone knew it.
Roskomnadzor has spent the intervening years playing an expensive game of whack-a-mole, blocking IP addresses and domains associated with popular VPN services. The regulator has targeted NordVPN, ExpressVPN, Proton VPN, and dozens of smaller providers, according to reports from TechRadar. Yet VPN usage in Russia has surged, not declined. After the invasion of Ukraine in February 2022 — and the subsequent blocking of platforms including Instagram, Facebook, and Twitter — demand for VPNs inside Russia exploded. Research from multiple analytics firms estimated that VPN downloads in Russia spiked by more than 2,000% in the weeks following the initial wave of platform bans.
So Moscow is changing tactics. Rather than focusing exclusively on the supply side — blocking VPN servers and pressuring providers — the new legislation targets demand. Fine the users. Fine the companies that employ VPNs for their workers. Create enough financial risk that casual users think twice before firing up a VPN to check Instagram.
The strategy has a certain cold logic to it. Most Russian VPN users aren’t dissidents or journalists. They’re ordinary people who want to scroll through social media, watch YouTube without restrictions, or access services that have geo-blocked Russian IP addresses since the start of the war. For these users, a $300 fine — in a country where the average monthly salary hovers around 70,000 rubles — is a meaningful deterrent. Not catastrophic. But enough to change behavior at the margins.
Enforcement, however, remains the central question. How exactly does the Russian government plan to identify individual VPN users? Deep packet inspection technology, which Russia has been deploying through its Sovereign Internet infrastructure since 2019, can detect certain types of VPN traffic. The TSPU (Technical Means of Countering Threats), installed at major internet exchange points across the country, gives Roskomnadzor the ability to analyze and filter traffic at scale. But modern VPN protocols — particularly those using obfuscation techniques like those built into WireGuard-based implementations or Proton VPN’s Stealth protocol — are specifically designed to evade such detection.
It’s a technological arms race, and the VPN providers have proven remarkably adaptive.
Still, the fines don’t need to catch every user to be effective. They need to create fear. Russia’s legal system offers authorities broad discretion, and the mere existence of financial penalties on the books gives police and prosecutors a tool they can deploy selectively — against activists, journalists, or anyone who attracts official attention for other reasons. The chilling effect, in other words, may matter more than systematic enforcement.
The proposed legislation also includes provisions aimed at corporate VPN usage. Many Russian businesses — particularly those with international operations or those in the technology sector — rely on VPNs for legitimate purposes: securing communications, connecting remote offices, and accessing cloud services hosted abroad. The new rules would require companies to register their VPN usage with Roskomnadzor and demonstrate that their connections are being used for approved business purposes rather than to circumvent content restrictions. The compliance burden alone could push some companies to abandon VPN use or switch to government-approved alternatives.
This corporate angle is significant. Russia’s tech industry, already strained by sanctions, brain drain, and the departure of major Western firms, depends on reliable access to global internet infrastructure. Developers need GitHub. Engineers need Stack Overflow. Sales teams need LinkedIn. If the new VPN restrictions make it harder for Russian companies to operate internationally, the economic costs could compound the damage already inflicted by Western sanctions.
The timing of the legislation is notable. Russia has been accelerating its push toward what officials call “internet sovereignty” — a vision of a national internet that can, in theory, be disconnected from the global web and operated independently. The Sovereign Internet law of 2019 laid the groundwork. Subsequent investments in domestic infrastructure, including the expansion of Russia’s own DNS system and the development of domestic alternatives to Western platforms (Rutube for YouTube, VKontakte for Facebook, Yandex services for Google), have moved the project forward.
But the vision remains incomplete. Russians keep finding ways around the walls. VPN usage is one of the most visible signs that the Kremlin’s information control project has limits — and the new fines are an acknowledgment of that failure.
International VPN providers have responded to previous Russian crackdowns with a mix of defiance and technical innovation. NordVPN, headquartered in Panama, pulled its physical servers from Russia in 2019 but continues to offer service to Russian users. Proton VPN, based in Switzerland, has explicitly positioned itself as a tool for circumventing censorship and has invested heavily in anti-censorship technology. ExpressVPN, now owned by Kape Technologies, has similarly maintained its availability in Russia despite repeated blocking attempts.
These companies are unlikely to comply with the new regulations. Their entire value proposition rests on privacy and unrestricted access. Capitulating to Russian demands would undermine their credibility with users worldwide — a far larger market than Russia alone.
For Russian users, the practical implications will depend on how aggressively the law is enforced and how quickly VPN providers can adapt their technology to stay ahead of detection. The history of internet censorship in Russia suggests a pattern: the government announces aggressive new measures, enforcement is initially spotty, providers develop workarounds, and the cycle repeats. Each iteration, though, makes the internet a little less free and a little more surveilled.
There’s a broader geopolitical dimension too. Russia’s VPN crackdown mirrors similar efforts in China, Iran, and other authoritarian states that view unrestricted internet access as a threat to regime stability. China’s Great Firewall remains the gold standard of internet censorship, but Russia has been studying and adapting Chinese techniques for years. The proposed fines echo China’s approach of targeting users as well as providers — creating a system where the risk of accessing blocked content falls on the individual, not just the technology company.
The difference is scale and sophistication. China has spent decades and billions of dollars building its censorship infrastructure. Russia is trying to achieve similar results faster and cheaper, with a population that grew up with relatively open internet access and is far more accustomed to using circumvention tools. Whether Moscow can close that gap — technically, legally, and culturally — remains an open question.
What’s clear is that the Kremlin views VPN usage not as a minor nuisance but as a genuine threat to its information control apparatus. The new legislation, if passed, would represent a significant escalation — moving from a regime of blocking and technical interference to one of direct financial punishment for ordinary citizens. The message to Russians is unambiguous: the internet you want to access is not the internet the state wants you to have. And now there’s a price tag attached to the difference.
The State Duma is expected to take up the proposals in the coming months. Given the legislature’s track record of rubber-stamping Kremlin priorities, passage is widely considered a formality. The real test will come afterward — in the streets, on the networks, and in the quiet decisions of millions of Russians weighing whether a VPN subscription is still worth the risk.
Russia’s New VPN Crackdown: Fines, Fees, and the Quiet War on Digital Privacy first appeared on Web and IT News.
