On July 13, 2026, the Council of the European Union added VK Company and its subsidiary Communication Platform LLC to its Russia human-rights sanctions list, alongside three firms — VAS Experts, Norsi-Trans, and Citadel — that build components of Russia's SORM surveillance infrastructure. In total the Council designated four individuals and five entities "responsible for serious human rights violations in Russia, notably the repression of civil society and democratic opposition." The listed individuals and entities now face an EU asset freeze, and the individuals a travel ban.
The designation's core claim is specific: Max, the messaging app VK subsidiary Communication Platform LLC built and now operates, was developed under the supervision of Russia's Federal Security Service and rolled out in parallel with state restrictions on WhatsApp and Telegram and a broader campaign against VPN services. According to the EU's reasoning as reported by Meduza, Max collects data on installed apps, contact lists, geolocation, and VPN usage — data the bloc says has already been used as grounds to fine a Russian citizen. VK, for its part, is accused of separately supplying user data on war critics directly to Russian security services.
The case for the listing is real
The steelman here is straightforward, and worth taking seriously before critiquing it. Max is not merely popular — it is unavoidable. Since September 1, 2025, Russian law has required Max to come pre-installed on every smartphone, tablet, and computer sold in the country, replacing an earlier VK Messenger mandate that had been in place since 2023. VK's ecosystem reached 62.7 million daily and 93.4 million monthly users in Q1 2026 — roughly 90% of Russia's internet-using population. When a state mandates installation of a single app at that scale and that app is built with FSB input, sanctioning the company that built it is not mission creep — it is the EU's human-rights sanctions regime, established in the wake of Alexei Navalny's death, doing exactly what it was designed to do: hold enablers of repression accountable, not just the officials who order the repression.
The same day, separately, the EU and UK jointly sanctioned nine individuals and four entities tied to Russian state hacking, in what the EEAS called the EU's largest cyber sanctions package to date, exposing the FSB's 16th Centre as the controller of groups including Turla. That parallel action underscores that Brussels is treating Russia's digital-control apparatus as a coherent target set — messaging surveillance and offensive cyber operations alike — rather than picking one company as a scapegoat.
Why the listing still won't move the underlying architecture
But steelmanning the case doesn't mean the tool fits the problem. VK and Communication Platform LLC have negligible EU assets, EU revenue, or EU operations to freeze — VK told the Moscow Times the sanctions "have no effect on how VK and Max work" and that its apps remain available to users as usual. That is not spin; it is a fair description of how symbolic a listing is against a company whose entire business model is domestic, state-mandated, and immune to EU market pressure. Apple had already removed VK's apps and Max from its App Store on June 3, 2026, citing sanctions compliance — a more consequential blow to VK's international footprint than this designation, and one that predates it.
The more revealing signal is who else made the list: VAS Experts, Norsi-Trans, and Citadel, the firms that build the deep-packet-inspection hardware and software underpinning SORM and Russia's VPN-blocking regime. That infrastructure, not Max's app-store presence, is the actual chokepoint. Roskomnadzor restricted access to 439 VPN services by mid-January 2026 — up 70% from October 2025 — and has stated an intent to block 92% of VPN applications by 2030, backed by roughly ₽20 billion a year in infrastructure spending. Sanctioning three DPI vendors' executives freezes assets those executives are unlikely to hold in euros; it does nothing to interrupt the semiconductor, networking, and software supply chains that let SORM scale toward that 2030 target.
A more proportionate and more effective response would pair symbolic designations with export controls on the specific dual-use networking and DPI components these vendors depend on — the approach the EU has already used against spyware vendors like NSO Group's supply chain, and one that hits an actual bottleneck rather than a balance sheet with no EU exposure. Ordinary Russians, meanwhile, remain legally required to run an app the EU itself says was built for surveillance, with no exit option a sanctions listing can provide them. The Council's designation correctly names the problem. It does not yet reach it.