Since 1 September 2026, Russian hotels with more than 50 rooms have had to offer guests check-in through the state-backed Max messenger. Hotels with 50 rooms or fewer have until 1 September 2028. The guest opens the 'Digital ID' section of Max and presents a QR code. The hotel scans it, and the passport data loads straight into its system. Guests can still show a paper passport, and only adult Russian citizens can use the feature. By mid-August, more than 800 hotels in 70 regions had already connected, according to a government information site relaying Max's press service.
The best case for the scheme
The case for it is stronger than critics usually admit. Hotel registration in Russia has long meant handing over a passport so staff can retype or photocopy its details. That is slow, error-prone, and leaves scans of identity documents in desk drawers and on unmanaged PCs. A dynamic QR code that transmits verified fields only, and only when the guest chooses, can be a privacy improvement over a photocopy. The framework is also not a sudden mandate. Government Resolution No. 1912 of 27 November 2025 approved new hotel-service rules, and Rospotrebnadzor's guidance says guests may be identified by presenting documents, through the national messenger or the Gosuslugi app, or by biometrics. A legal-database record of the resolution shows it was published on 30 November 2025 with main provisions effective 1 March 2026. Convenience and fewer data-entry errors are legitimate goals, and I take them seriously.
Voluntary for the guest, mandatory for everyone else
The 'voluntary' label is accurate but narrow. The guest may still present a paper passport. The hotel has no such choice: The Moscow Times reported on 7 July that Economic Development Minister Maxim Reshetnikov announced that hotels with more than 50 rooms must buy hardware and train staff to use Max. Foreign guests must still show physical passports for migration tracking, so the system serves one group of people while leaving the old process intact for others.
A mandate on businesses that creates a convenient default for users is a classic nudge. Defaults matter. When one check-in lane is a two-second scan and the other is a paper form, 'voluntary' erodes at the margin. That would be tolerable if the lane were open and interoperable. It is not.
Why the platform matters more than the rule
A Digital ID in Max is not a standalone credential. Setup requires a confirmed Gosuslugi account, a QR code generated inside the messenger, consent to data processing, and a PIN. The identity data sits in a state-run ecosystem. That ecosystem also includes the messenger itself, which, per the same Moscow Times report, launched in spring 2025 as a Kremlin-vetted alternative to WhatsApp and Telegram. It must be pre-installed on smartphones and computers sold in Russia, and officials plan to make it a 'super-app' combining messaging, payments and government services.
That design choice, not the QR code, is the policy problem. A hotel check-in feature is a modest use case, and the same credential is being extended into other uses. In August 2026, teenagers aged 14 and up gained access to Digital ID in Max, initially students and citizens with disabilities, to prove age and social status for things like transport and cultural discounts. The same report notes that the credential is meant for adult-only purchases and hotel check-in once the holder reaches the required age. Each new use makes the platform harder to avoid and more valuable as a single point of compromise.
Russia's own recent record shows what that concentration risks. On 16 October 2026, The Record reported that a 19-year-old suspect was placed under house arrest over a Dodo Pizza breach that reportedly involved records from hundreds of millions of orders over 15 years. Reportedly, the hackers got in through corporate credentials exposed on GitHub. That breach did not involve Max or Gosuslugi, and I do not suggest otherwise. It illustrates a general point: even large, well-resourced operators leak, and a centralised identity store raises the stakes of every leak.
What proportionate design would look like
A pro-innovation approach does not reject digital identity. Estonia and others show that digital credentials can work. It asks for structural safeguards that this rollout does not visibly include:
- Selective disclosure. A hotel needs a name, a document number and a validity check. Systems should transmit only those fields, and the published rules should say so.
- Retention limits. Hotel systems should delete or minimise stored passport data on a published schedule, instead of building new private databases of scanned identity.
- Competing wallets. If the check-in standard is a QR payload, any compliant app should be able to present it. Naming one state-backed messenger by function entrenches a platform rather than a standard.
- Independent oversight. Rules touching the Unified Biometric System and Gosuslugi need audit rights and breach reporting that do not depend on the operator marking its own homework.
What to watch
The measure of this policy is not the 800 connected hotels but what happens to the paper alternative. If front desks start treating passports as an exception, 'voluntary' will describe the law and not the practice. Watch whether the 2028 deadline for small hotels holds, whether Max Digital ID is attached to further mandatory services, and whether any regulator publishes a data-protection assessment. Without those, a genuine convenience is also a further step toward a single state-run identity layer.
One caution on sourcing: secondary outlets cite Government Resolution No. 674 of 2 June 2026 as amending the hotel rules. I could not verify that from an official text, and this analysis does not rely on it.