Russia’s data localization law requires any company that collects personal data of Russian citizens to record and store it first in databases physically located in Russia, and Google never publicly committed to full compliance. The law took effect on September 1, 2015, and weeks later Google described the question as complex and announced no decision. Russian courts fined Google repeatedly for localization violations starting in 2021, and its Russian subsidiary went bankrupt after authorities seized its bank account in 2022. For US companies, the story is a practical lesson in how data sovereignty rules collide with sanctions and US data security law.
This page began life as a short news item from 2015 about Google weighing a transfer of Russian users’ personal data to servers in Russia. What follows is the full story since then, built from court reporting, regulator statements and the legal texts, with a practical section on what it means for US businesses today.
What Russia’s data localization law requires
The core rule sits in Russia’s personal data law, Federal Law No. 152 of 2006. Federal Law No. 242, signed on July 21, 2014, added a requirement that operators collecting personal data of Russian citizens, including over the internet, must record, systematize, accumulate, store, update and retrieve that data using databases located in Russia. The start date was brought forward to September 1, 2015.
Official guidance from the Russian communications ministry at the time allowed copies of the data to exist abroad, as long as the primary database was in Russia and the foreign copy held nothing the Russian one lacked. That detail matters: the law has never been a flat ban on data leaving Russia. It is a rule about where data lands first.
| Element | What it means in practice |
|---|---|
| Who is covered | Operators that collect personal data of Russian citizens; since July 2025 also processors working on their behalf |
| Core duty | Collect into and keep the primary database in Russia |
| Copies abroad | Historically allowed as secondary copies; transfers abroad now also carry notification duties to the regulator |
| Enforcer | Roskomnadzor, the federal communications and media regulator |
| Penalties | Entry on a register of violators, blocking in Russia, and fines of up to 6 million rubles for a first offense and up to 18 million rubles for a repeat offense by a company |
The fine levels come from Federal Law No. 405, signed in December 2019. Before that change, the fines available for localization breaches were far lower.
The 2015 question: would Google move Russian data?
When the law took effect, Roskomnadzor said it would give Facebook, Google and Twitter until January 2016 before checking them, and a spokesperson acknowledged the regulator lacked resources to audit companies of that size. According to law firm reporting from that period, the three companies had either told regulators they would not build data centers in Russia soon, or had not said whether they would comply.
In October 2015, Google’s then president for Europe, the Middle East and Africa told RIA Novosti that some parts of localization were technically possible and others were not, that it was a complex discussion, and that Google was talking with the authorities. No decision was announced. That is the moment the original headline on this page captured.
In December 2015, the head of Roskomnadzor told reporters, according to Interfax, that unofficial information suggested Google and Apple were working on localizing databases in Russia. He described the information as unofficial, and neither company confirmed it publicly. Google has never published a statement that it fully localized Russian users’ data, and later court rulings found that it had not.
How Russia enforced the law
Enforcement came in waves.
| When | What happened |
|---|---|
| November 2016 | LinkedIn blocked in Russia after a Moscow court ruled against it in August and the Moscow City Court upheld the ruling on November 10 |
| December 2019 | Maximum fines raised to 6 million rubles, and 18 million rubles for repeat offenses |
| February 2020 | Twitter and Facebook fined 4 million rubles each by a Moscow district court |
| July 2021 | Google fined 3 million rubles, its first fine under the localization rules |
| June 2022 | Google fined 15 million rubles for a repeat violation |
| November 2023 | Google fined another 15 million rubles for repeatedly refusing to store Russian users’ data in Russia |
LinkedIn remains the clearest example of the law’s real teeth. Blocking a service costs Russia little when the service has a small local footprint, while blocking Google Search or YouTube outright would affect tens of millions of people. For large platforms, fines and gradual pressure were the preferred tools, at least until 2022.
What happened to Google in Russia after 2022
After Russia’s full scale invasion of Ukraine in February 2022, the relationship broke down on several fronts at once. Google stopped selling ads in Russia, Russian authorities seized the main bank account of its local subsidiary, and in May 2022 that subsidiary said it would file for bankruptcy because it could no longer pay staff and suppliers. Reuters, citing RIA, reported in October 2023 that a Moscow court had declared the subsidiary bankrupt.
That bankruptcy changed the meaning of every later fine. As the AP report on the November 2023 fine noted, collection was unlikely because Google’s Russian operations had effectively stopped. Russian courts nevertheless kept adding penalties, including a compounding penalty over blocked YouTube channels of Russian state media that grew into a figure larger than the world economy, and new rulings over unpaid fines were still being reported in 2026.
Google’s free consumer services did not simply vanish. Search, Gmail and Maps stayed reachable for ordinary users, while YouTube was sharply slowed from mid 2024. That slowdown was carried out with Russia’s own network filtering equipment, which we explain in our companion piece on Russia’s sovereign internet law.
The rules got stricter in 2025 and 2026
Three changes are worth knowing if you follow this area.
- Foreign databases banned at collection. An amendment signed on February 28, 2025 took effect on July 1, 2025. It prohibits recording, storing or retrieving personal data of Russian citizens using databases located outside Russia when the data is collected, with narrow exceptions, and extends localization duties to processors acting for an operator. Russian law firms read this as ending the practice of using a Russian database as a pass through while the real work happened abroad.
- No foreign sign in on Russian sites. Since December 1, 2023, Russian websites may authenticate Russian users only through Russian phone numbers, the Gosuslugi state services login, the Unified Biometric System or Russian ID services. That rules out logging in with a foreign OAuth provider such as a Google account. A law adding fines for violations was passed in June 2026.
- Transfers abroad need notice. Operators that transfer personal data outside Russia must notify Roskomnadzor, which gives the regulator another lever over foreign services.
What this means for US companies
If your product collects personal data from people in Russia, you face two sets of rules pulling in opposite directions. This is not legal advice, but these are the questions counsel will ask.
Russian law may treat you as in scope
Russian enforcement has focused on foreign services that target the Russian market. In the LinkedIn case, the court pointed to a Russian language version shown by default to visitors in Russia and to advertising in Russian as signs of targeting. If that describes you, Russian law expects your primary database for Russian citizens to sit in Russia. The LinkedIn block shows the realistic worst case: your service becomes unreachable there.
US sanctions limit how you could comply
Since September 12, 2024, a Treasury Department determination has barred US persons from providing IT consultancy and design services, IT support services, and cloud based services for enterprise management and design software to persons in Russia, with limited exceptions. Standing up or servicing infrastructure in Russia can run straight into these prohibitions, which is one reason many US companies simply stopped serving the Russian market.
US law restricts data flowing the other way
Two newer US rules cover data about Americans. The Justice Department’s Data Security Program, codified at 28 CFR Part 202 and effective April 8, 2025, names Russia among the countries of concern. It prohibits data brokerage involving bulk US sensitive personal data with those countries and restricts vendor, employment and investment agreements that would give them access. Separately, the Protecting Americans’ Data from Foreign Adversaries Act, enforced by the FTC, bars data brokers from making sensitive data about Americans available to foreign adversary countries, Russia included.
A practical checklist
- Map where you collect data about people in Russia, including forms, analytics tags and login flows.
- If you run a Russian language site, remember that social login buttons, like the one in our guide to integrating Facebook Login into a website, are not a permitted authentication method for Russian users under Russian rules.
- Check third party scripts. Tools such as the setup in our guide to adding Google Analytics to WordPress send visitor data to servers outside Russia, which Russian lawyers now flag under the 2025 amendment.
- Decide deliberately whether to serve Russia at all, and document the sanctions analysis behind that decision.
Frequently asked questions
Did Google ever move Russian users’ data to Russia?
There is no public confirmation that it did. A Russian regulator said in December 2015 that it had unofficial information about work on localization, but Google never confirmed it, and Russian courts fined Google in 2021, 2022 and 2023 specifically for failing to store Russian users’ personal data in databases located in Russia.
Does the law ban all transfers of data out of Russia?
No. The law governs where the primary database sits and where data lands at collection. Copies and transfers abroad have been possible, although transfers now require notice to Roskomnadzor, and the 2025 amendment bans using foreign databases during collection itself. In practice the rules keep getting tighter, so check the current text before relying on any exception.
Why was LinkedIn blocked but not Google?
LinkedIn had a modest user base in Russia, so blocking it carried little cost for the authorities. Google Search, Gmail and YouTube were used by tens of millions of Russians. Regulators preferred fines and gradual pressure against Google, and after 2022 used network throttling against YouTube rather than an outright block.
Can a US company legally comply with Russia’s law today?
It depends on the company and the services involved, and it needs a sanctions lawyer. Since September 2024, US persons cannot provide many IT, IT support and cloud based services to persons in Russia. Many US companies have concluded that exiting the market is simpler than trying to reconcile Russian localization with US restrictions.
Are Russian localization fines still being issued?
Yes. Russian courts continued to rule against Google after its subsidiary’s bankruptcy, and new penalties over unpaid fines were reported in 2026. With Google’s Russian entity bankrupt, these rulings function mainly as political signals, because there is little left in Russia for the authorities to collect.
The bottom line
The 2015 headline asked whether Google would move Russian data home. The answer, a decade later, is that it never publicly did, Russia fined it for years, and the question was overtaken by the war, the seizure of Google’s local bank account and the bankruptcy of its Russian subsidiary.
For US companies, the lesson is that data localization laws do not exist in isolation. Russia’s rules demand local storage, US sanctions restrict the services needed to provide it, and US data security law limits access to Americans’ data in the other direction. Decide on the market first, then on the architecture.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
