Cookie Consent Under Russia's 152-FZ

Unlike the GDPR, Russia's Federal Law 152-FZ "On Personal Data" has no dedicated cookie article — but per Roskomnadzor guidance, cookies (including IP addresses and device identifiers) are treated as personal data because they can identify a website visitor online. That means cookie collection falls under 152-FZ's general consent requirements.

What changed on September 1, 2025

• Consent to personal data processing must now be a separate document — it can no longer be bundled into terms of service or a privacy policy as a single clause.
• Websites can no longer restrict access to content, products, or services if a visitor declines to consent to data processing not directly required for the service itself.
• Sites that collect cookies must notify Roskomnadzor of personal data processing and publish a personal data policy with a dedicated cookie section.
• Technical means of processing personal data must be physically located in Russia (Art. 18(5), 152-FZ), or operate with Roskomnadzor approval.

Checklist

• A cookie banner that blocks non-essential cookies until explicit consent;
• A standalone personal data consent document, separate from the terms of service;
• A personal data policy with a section describing the cookies used;
• A Roskomnadzor notification on file;
• A consent audit log as proof for inspections;
• Consent data hosted on servers located in Russia.

Fines

Under Art. 13.11 of Russia's Administrative Code, penalties for processing personal data without proper consent range roughly from ₽10,000–15,000 for individuals, ₽50,000–100,000 for officials and sole proprietors, and ₽150,000–300,000 for legal entities (figures based on public sources as of 2025 and vary by specific violation). Separately, more severe violations tied to personal data leaks can carry fines in the millions of rubles for legal entities — a distinct, higher tier of liability unrelated to simply missing a cookie banner.

Getting compliant quickly

In practice it comes down to three things: a banner that actually blocks cookies until consent, a consent audit log as evidence, and data hosted on servers in Russia. Cookiestack covers all three with a single script tag — no developers required, with a free plan to start.

Start for free →

This article is for informational purposes only and is not legal advice. Consult a qualified data protection lawyer for your specific situation.