Russia does not need to block every VPN one by one. It can lean on the few companies that control how software reaches phones and how messages are stored. On 30 October 2026 the Electronic Frontier Foundation published "Why VPNs Are Worth Defending". It reports that VPN developers say their apps are again being pulled from Apple's App Store in Russia. It also cites Bloomberg's report that Apple and Microsoft were added to Russia's state surveillance registry. Together these show a strategy that works through intermediaries, and it is more durable than blocking individual tools.
The case for the state's position
The strongest argument for Russia's approach is one every government makes. Lawful-access regimes exist because serious crime, from fraud to terrorism, does use messaging and anonymizing tools, and a state that cannot compel local compliance from a foreign platform has little leverage. Data-localisation rules also give domestic courts a way to reach firms that operate in the country. A proportionate version of this logic would rest on judicial authorisation, narrow scope and public oversight. The Russian framework has none of these safeguards, which is the problem.
What the registry actually requires
The registry is a statutory category, not a blacklist. Article 10.1 of Federal Law 149-FZ governs "organizers of information dissemination". Under its text, listed organizers must store in Russia information about the fact of message exchange and about the users involved for three years. The three-year period reflects an amendment in 41-FZ of 1 April 2025. They must also store message content, voice, images and video for up to six months. Part 3.1 requires them to give this information to bodies conducting operational-search or security activity "in cases established by federal law". Part 4.1 requires them to hand over the information needed to decode messages where additional encryption is used.
On timing, Novaya Gazeta Europe reports that Roskomnadzor listed Apple and Microsoft on 2 October. A Telegram channel spotted the entries, and the news spread on 28 October. It also notes that registration does not mean either company already complies or intends to. We could not reach the registry on rkn.gov.ru to confirm the entries directly, so the listing rests on press reporting. Neither company has commented publicly.
The registry matters less for what it does on day one than for what it makes possible. Non-compliance can lead to fines and, if violations are not fixed after notice, to blocking. A company that has been listed must choose between handing over local users' data and risking its market access. Whatever Apple or Microsoft decide, the choice itself is the leverage.
The same lever applied to circumvention tools
The registry is one of two levers. The other is the app store. Article 15.8 of the same law, added in 2017, bars owners of tools that give access to blocked resources from allowing that use in Russia. It obliges them to connect to Roskomnadzor's blocklist system. It lets the regulator restrict access to non-compliant tools and requires internet providers to act within one day of instruction.
Human Rights Watch's 24 September 2026 report documents how this plays out through Apple. In March 2026 Apple removed Streisand, V2Box, v2RayTun, Happ and Proxy Utility from its App Store. The removal notice for v2RayTun cited a Roskomnadzor demand under Article 15.1 of the information law. HRW also reports that a Russian court fined Google 22.8 million rubles (about $300,000) in February for not removing VPN apps on official order. That fine shows what refusal costs, and why a platform might comply.
Apple's stated reasoning, given to HRW, is that it must follow the law wherever it operates. It also says that refusing lawful orders in Russia "could result in Apple no longer being able to operate the App Store". The company argues the App Store remains an important way for Russians to reach information. That is a real argument, and one should take it seriously: a store that stays open carries some tools and a store that is shut out carries none. But it also shows the structure of the pressure. Each concession narrows what users can install, and the next demand starts from the new baseline.
The scale of the dependence
The pressure falls on a population that relies on these tools. HRW cites estimates that around 57 million people, about 40 percent of Russia's population, use VPNs. It reports that at least 469 VPN services had been blocked by February 2026, and that Roskomnadzor now blocks large IP ranges, including whole subnets. It says Amnezia VPN needed a month and a half to restore service after bulk blocking, phishing of staff and DDoS attacks.
Apple's own transparency data, as HRW reports it, shows 1,213 app removals in response to Russian government requests in 2025. That was nearly 60 percent of all such removals worldwide. The number does not say how many of those were VPNs. Apple removed 468 "utility" apps in 2025, a category that includes VPNs. Even so, the concentration of takedown demands in a single country is a measure of how much weight Moscow puts on the store as a control point.
What proportionate policy would look like
This is not an argument for platforms to leave Russia. Exit would cut users off from updates, secure messaging and a legitimate channel of information. The more defensible path is narrower and more transparent:
- Platforms should publish per-country takedown counts that specify which apps were VPNs, so that the public can see what compliance costs.
- They should resist storing message content or encryption keys locally where the legal regime has no independent judicial check.
- They should give developers advance notice and appeal routes before delisting, so tools can reach users through alternative distribution.
- Democratic governments should avoid copying the logic. EFF notes that several US states have floated VPN restrictions of their own, and Russia's experience shows where that path leads.
EFF's closing point is that what authorities call a "loophole" is really "an expression of user control". The Russian case supports that. Circumvention tools are the user-side response to a state that controls networks, and the registry and the app store are the state's response in turn. The test for global platforms is whether they can keep serving users without becoming the enforcement arm of that state.