A sanctions list, not an app ban
On July 13, 2026, the Council of the European Union added VK — Russia's dominant social network — and its subsidiary Communication Platform LLC, developer of the state-backed MAX messenger, to its human rights sanctions list for Russia. The listing, part of a package naming four individuals and five entities, freezes any EU-held assets and bars EU persons and firms from making funds available to the sanctioned companies (Council of the EU). Three other newly listed firms — Citadel, VAS Experts, and Norsi-Trans — supply hardware and software for SORM, the FSB's long-standing lawful-intercept system (Euronews). The EU's designation states plainly that development of MAX "was supervised by the Federal Security Service," and that VK "provides technical support for the repression of civil society and democratic opposition" (The Moscow Times).
The steelman: this isn't a garden-variety app
The case for sanctions here is unusually strong, and it's worth stating plainly before arguing the limits of the response. MAX is not merely a domestic WhatsApp clone competing on features. Russian regulators have made it structurally mandatory: since September 1, 2025, it has been required pre-installed software on every smartphone and tablet sold in the country (The Moscow Times), and Moscow has openly promoted it as the successor to Gosuslugi, the government-services portal, folding messaging, social features, payments, and official notifications into one FSB-cleared platform. Unlike WhatsApp or Telegram, MAX lacks end-to-end encryption, and its privacy policy explicitly reserves the right to share user data with authorities on request. On February 12, 2026, the Kremlin blocked WhatsApp outright, with spokesperson Dmitry Peskov citing the company's "reluctance to comply with the norms and letter of Russian law," while urging citizens to switch to MAX (Al Jazeera). Telegram has faced parallel throttling. When a state simultaneously mandates a surveillance-linked app and degrades its only real competitors, calling the resulting adoption numbers organic — MAX grew from roughly 1 million registered accounts in June 2025 to more than 18 million by late August (The Moscow Times) — is not credible. Targeting the specific firms that engineered that coercion, rather than issuing a vague statement, is a defensible and proportionate use of the EU's sanctions toolkit.
Where the sanctions logic should stop
The useful distinction the MAX case surfaces is between bundling imposed by a state through coercion and non-transparent data sharing and bundling that is merely commercially convenient. The EU's sanctions target the former — correctly. They say nothing, and should say nothing, about super-apps or platform consolidation as a business model in general. That distinction matters because regulators elsewhere are also intervening in how social platforms bundle commerce, and it's worth being precise about which problem each intervention actually solves.
Indonesia's Trade Ministry Regulation 31/2023 barred social platforms from processing direct in-app payments, forcing TikTok to shut down TikTok Shop's Indonesian operations on October 4, 2023 (KrAsia). TikTok didn't exit commerce in Indonesia; it restructured around the rule, investing $1.5 billion for a 75% stake in GoTo's Tokopedia and folding TikTok Shop into that separately licensed e-commerce entity (PYMNTS). That is proportionate regulation working as designed: a specific, remediable competition and data-separation concern, addressed structurally, with the underlying service preserved and a market-based compliance path open to the company.
MAX is the inverse case. There is no compliance path, no divestiture option, and no competitive alternative that Russian users are permitted to choose freely — WhatsApp is blocked, Telegram is degraded, and the substitute is legally mandatory. The problem the EU sanctioned was never that VK combined messaging with payments and government services under one roof; plenty of well-governed platforms do exactly that. The problem is that the roof was built by a state security service, with no opt-out, specifically to capture data on dissent.
The limits of the tool
Sanctions of this kind mostly hit reputational and financial edges — EU market access and asset exposure for firms with limited EU footprint to begin with. VK's press office called the impact operationally negligible, and that is plausibly true in the near term (The Moscow Times). The sanctions won't unblock WhatsApp or restore Telegram's reliability inside Russia, and they don't touch the domestic legal mandate that makes MAX inescapable. What they do is put a documented, evidence-based marker on the record — naming the FSB's supervisory role and the specific firms that built the surveillance architecture — that becomes relevant if EU institutions, courts, or future accountability processes need it. That is a modest but legitimate function, and a far better use of sanctions authority than reaching for broader, less targeted measures against Russian tech generally. Precision here is the point: sanction the coercion, not the app category.