For years the Kremlin treated the blocking of VPNs as a quiet, technical chore — something Roskomnadzor did without ever quite admitting it was the point. That ambiguity is gone. A subsidy document that surfaced in early May 2026, first reported by independent journalist Maria Kolomychenko, sets a formal state target: 92% effectiveness against VPN services by 2030, underwritten by roughly 20 billion rubles a year in filtering infrastructure. For the first time, defeating the tools citizens use to reach the open internet is named as an explicit government objective rather than an awkward side effect of "protecting" them.
The target lands atop an already aggressive campaign. By February 2026, Roskomnadzor had confirmed blocking 469 distinct VPN services and was throttling the three most popular VPN protocols outright, according to Human Rights Watch's March 12 documentation of Russia's "digital iron curtain." Independent tallies put the cumulative figure above 1,000 restricted services. And since April 15, 2026, the campaign reached inside the apps Russians use every day.
From blocking VPNs to blocking VPN users
The April escalation is the genuinely new move. At a March 30 meeting with more than 20 major platforms, Digital Development Minister Maksut Shadayev directed companies to detect and block their own users who connect over a VPN — or lose their place on the government's operational "whitelist" and forfeit IT tax benefits. By mid-April, Gosuslugi, Sberbank, Ozon, Wildberries, Aviasales, Yandex services and Russian Railways had begun denying access to VPN-enabled users, as Meduza and The Moscow Times reported.
The mechanism matters. Platforms were handed a technical manual describing a two-step detection method and a feed of Roskomnadzor-identified VPN IP addresses, and were required to pass newly observed VPN addresses back to the regulator for blocking elsewhere. The state is conscripting private companies — banks, retailers, the government services portal itself — into a distributed surveillance and enforcement network. This is the same architecture as Russia's foreign-agent and platform-liability regime: the law rarely bans the citizen directly; it makes intermediaries do the banning, then punishes the intermediary that refuses.
The official justification, fairly stated
The strongest version of the government's case deserves to be heard. The Digital Development Ministry argues the measures protect users: "This is being done to protect the data you enter on platforms," it stated on April 27, "especially... government services, where citizens' personal data is stored." Many free VPNs genuinely do harvest traffic, and some are run by outright malicious operators; a citizen entering tax or banking details through an unknown free proxy is taking a real risk. Roskomnadzor can also point, accurately, to the fact that VPN traffic is sometimes used to route fraud and botnet command-and-control — a Russia-linked residential-proxy network of more than 17 million devices was dismantled in the Netherlands as recently as May 29, 2026.
That case is not nothing. But it collapses on contact with the policy's actual shape. If the goal were genuinely to steer citizens toward safer connections, the state would certify trustworthy VPNs, publish security standards, and fund consumer education — not set a 92% blanket blocking target and force the government's own services portal to lock out anyone using encryption. A data-protection rationale that ends in citizens being unable to file their taxes over a secure tunnel is not a data-protection rationale.
Why a blanket block is the wrong instrument
Proportionate regulation targets harms, not tools. VPNs and encryption are dual-use, load-bearing infrastructure of the modern economy: remote workers, exporters reaching foreign suppliers, security teams, journalists, and ordinary travelers all depend on them. Russia's own state agencies and businesses rely on VPNs to reach international systems, which is precisely why analysts at CEPA note the Kremlin cannot actually prohibit them outright. The 2030 target is therefore not a clean ban but a permanent, expensive war of attrition — one the government has chosen to wage against a technology roughly 41% of Russian internet users already depend on.
That scale is the tell. When circumvention is this widespread, blanket blocking does not eliminate risk; it pushes the cautious majority toward whatever obfuscated, unvetted tool still happens to work, while the determined minority adapts. Russia's own history proves it: VPN installations spiked more than 11,000% in a single day when Instagram and Facebook were blocked in 2022. The state's filtering accidentally froze banking apps and metro turnstiles in early April 2026 — collateral damage that is structural, not incidental, because the system cannot reliably distinguish a VPN from ordinary foreign traffic.
The deeper cost
Naming a numeric target converts censorship from a posture into a procurement line — 20 billion rubles a year, a deep-packet-inspection bureaucracy with quotas to hit and budgets to defend. Layered onto February's law letting the FSB order ISPs to cut connections without a court order, and a proposed 15 GB monthly cap on mobile VPN traffic with per-gigabyte surcharges, the trajectory is toward a sovereign internet where reaching the global network is a metered, monitored privilege.
We hold the pro-innovation view plainly: an open, interoperable internet and strong encryption are the substrate of economic dynamism and free expression, and treating circumvention as an enemy to be defeated by quota is a self-inflicted wound on Russia's own digital economy. The honest lesson for every other jurisdiction tempted by 'lawful' platform conscription is that the architecture travels faster than the intent — and a 92% target is a confession that the other 8% were never the real problem.