In short. A website falls under Russia's Federal Law 152-FZ "On Personal Data" the moment it collects any visitor data — a name, email, or phone in a form, as well as analytics cookies. The minimum for compliance: a privacy policy, explicit consent to data processing (a checkbox the user ticks themselves), a cookie notice, processing and storage of Russian citizens' data on servers in Russia, and a notification filed with Roskomnadzor. You can check a site yourself against a checklist: is there a policy and consent, how are the forms and cookies set up, where does the analytics live. Below is exactly what the law requires and how to check each point, including the technical part.
This is a practical self-check guide, not legal advice. For disputed points, consult a lawyer.
When a site falls under 152-FZ at all
The belief "my site is simple, the law isn't about me" is the most common mistake. 152-FZ applies the moment you collect personal data — and that's not just passport details but any data that can identify a person: a name and email in a request form, a phone number, and in many readings, analytics-system cookies too, because they're tied to a specific user.
If your site has even one form (contact, subscription, order) or an analytics counter, you're already a personal-data operator. The question isn't whether 152-FZ applies to you, but whether the requirements are met.
Self-check checklist
1. Privacy policy
A separate page describing what data you collect, why, how you store it, whom you share it with, and how to delete it. It must be reachable from every page with forms (usually a footer link). No policy is the first and most visible violation.
2. Explicit consent to processing
The user must give consent themselves — a checkbox by the form with a link to the policy. The key: the checkbox must not be pre-ticked (checked in advance) — that's exactly a common violation. Consent is given by an active user action, not by default.
3. Cookie notice
A banner stating the site uses cookies, with a link to the policy. Check that it actually shows to a new visitor and that declining optional cookies really disables the analytics counters. Technically, the cookies and their flags (which are set, whether there are trackers) are convenient to view with the cookie analyzer.
4. Data localization in Russia
Russian citizens' data must be initially collected and stored in databases within Russia (Art. 18(5)). In practice that means: the server/hosting and analytics are in Russia. Foreign analytics without storage in Russia is a risk. Where the server is physically located can be estimated via an IP check (the hosting country).
5. Notification to Roskomnadzor
A personal-data operator must file a notification with Roskomnadzor of the intent to process data (with several exceptions). This is an organizational step, not technical, but without it compliance is incomplete.
6. Protecting the data technically
The law requires taking protective measures. The basics checkable from outside: the site works over HTTPS, forms submit over a secure connection, there are no leaks via insecure headers. A security scanner shows the technical hygiene.
| Item | How to check |
|---|---|
| Privacy policy | A page exists, footer link on every page with forms |
| Consent (checkbox) | Not pre-ticked, with a link to the policy |
| Cookie notice | Shows to a new visitor; declining disables counters (cookie analyzer) |
| Storage in Russia | Hosting and analytics in Russia (IP check — country) |
| Roskomnadzor notice | Filed (checkable in the operator registry) |
| HTTPS and protection | security scanner, HTTPS on forms |
The most common violations
- A pre-ticked consent checkbox. A classic: the box is checked by default — consent isn't considered voluntary.
- No policy, or it isn't tied to the forms. There's a form but no policy link next to it.
- A cookie banner "for show." It shows, but declining disables nothing — the counters load anyway.
- Data goes abroad without storage in Russia. Analytics or a CRM on foreign servers without primary storage in Russia.
152-FZ isn't checked with one button but by a combination: organizational documents (policy, consent, Roskomnadzor notice) plus the technical part (HTTPS, cookies, where the data is stored). Start with what's visible from outside — forms, cookies, HTTPS.
A detailed breakdown of the law's requirements for a website is on the 152-FZ page; it also shows how consent and the policy are done by example.
Frequently asked questions
I have a business-card site with no forms. Does 152-FZ concern me?
If there's not a single form and no analytics with cookies, formally you collect no data. But the moment a contact form or an analytics counter appears, you become an operator. In practice, almost any site with analytics is already under the law.
Is it enough to put up a privacy policy?
No. The policy is the required minimum, but not everything: you also need voluntary consent (a non-pre-ticked checkbox), a cookie notice, storage of Russians' data in Russia, and a Roskomnadzor notification. A policy page alone without the rest doesn't provide compliance.
Are analytics and metrics personal data?
A disputed but cautious answer is yes, in the part of cookies and identifiers tied to a user. It's safer to use analytics with data storage in Russia, declare it in the policy, and offer a way to opt out via the cookie notice.
Checklist to remember
- Have a form or analytics — you're already a personal-data operator.
- Minimum: policy + voluntary consent (checkbox not pre-ticked) + cookie notice.
- Russians' data — store and process in Russia; analytics — with storage in Russia.
- An operator files a notification with Roskomnadzor.
- The technical side is checked from outside: HTTPS, cookies (analyzer), headers (scanner).