Russia’s sovereign internet law, Federal Law No. 90 signed on May 1, 2019 and in force since November 1, 2019, requires internet providers to install traffic filtering equipment controlled by the regulator Roskomnadzor, lets the state take central control of routing during a declared threat, and set up a national domain name system that providers had to use from January 1, 2021. It also bars state and municipal information systems, and those of companies buying under Russia’s procurement law for state linked firms, from using databases and technical equipment located outside Russia. Since 2019 the same infrastructure has been used to slow and block services, from Twitter in 2021 to YouTube, WhatsApp and Telegram by 2026.
The original headline at this address, from April 2019, focused on one narrow clause: the ban on foreign databases for state systems. That clause still matters, but the bigger story is the filtering and routing machinery the law created, and how it has been used since. This explainer covers both, using the law’s provisions and reporting from rights groups and news outlets.
What the sovereign internet law requires
Federal Law No. 90 amended two existing statutes, the Law on Communications and the Law on Information. The State Duma adopted it on April 16, 2019, the Federation Council approved it on April 22, and President Putin signed it on May 1. Most provisions took effect on November 1, 2019, with the national DNS obligation following on January 1, 2021.
| Provision | What it requires | Who it binds |
|---|---|---|
| Technical means of countering threats (TSPU) | Install equipment supplied by the state on the network and give the regulator control of it | Internet providers and other telecom operators |
| Centralized management | Follow Roskomnadzor’s routing and traffic instructions when it declares a threat to the network | Operators and other network owners |
| Reporting | Provide network diagrams, routing information and details of where equipment sits | Operators and network owners |
| Traffic exchange points | Do not connect networks whose owners fail the law’s requirements | Owners of exchange points |
| National DNS | Use Russia’s national domain name system to resolve addresses, from January 1, 2021 | Internet providers |
| Exercises | Take part in drills on keeping the Russian network running | Operators, organized by the government |
| Foreign databases and equipment | Do not allow information systems to use databases or technical means located abroad | Operators of state and municipal systems and of systems run by companies buying under the procurement law for state linked firms |
The law also shields operators from liability when a service failure is caused by the state’s filtering equipment. Human Rights Watch noted in its 2019 analysis that Roskomnadzor gained the power to block content it treats as a threat without judicial authorization, and that the law’s definitions of a threat are vague.
The foreign databases rule behind the original headline
The clause that gave this page its original title is short. It says operators of state information systems, municipal information systems and the information systems of legal entities that purchase under Russia’s procurement law for state linked companies must not permit those systems to use databases and technical means located outside Russia. The requirement sits in Article 13 of the Law on Information, which already required technical equipment for government bodies’ systems to be located in Russia.
When the bill passed in April 2019, Russian industry experts quoted in the tech press warned that the wording reached further than it seemed. Their example was network routing: large state linked carriers use international registries such as the RIPE database, which holds routing and address information for Europe and the Middle East. Read literally, the clause could put such lookups in question for systems covered by the rule.
Two points keep this in perspective. The clause binds state and quasi state systems, not private individuals or ordinary businesses. And it echoes a broader Russian policy of pulling data and infrastructure home, which also drives the personal data localization rules we cover in our explainer on Google and Russia’s data localization law.
TSPU: the filtering boxes inside every network
TSPU is the Russian abbreviation for technical means of countering threats. In practice these are deep packet inspection systems that the state supplies to internet providers and that Roskomnadzor, not the provider, controls. They can identify traffic by what it is, not only by where it is going, which lets the regulator slow a specific service by a chosen amount or block it outright.
The first widely noticed use came in March 2021, when Roskomnadzor announced it was slowing Twitter. The most visible later case is YouTube. From the summer of 2024, Russian users saw severe slowdowns. Officials attributed them to aging Google caching servers left in Russia, while independent technical analysts found targeted throttling of Google video domains through deep packet inspection, and Google said the slowdown was not the result of any action on its part.
The national DNS and the disconnection drills
The national domain name system is a Russian copy of the information needed to turn domain names into addresses. Providers have had to route their DNS lookups through it since January 1, 2021. That gives the authorities a second lever beyond filtering: a domain can be removed from the national system so that, for users relying on their provider’s resolver, it simply does not exist. Human Rights Watch reported that in February 2026 the domains of YouTube, Facebook, WhatsApp and some independent media disappeared from the national DNS.
The law also requires exercises. The communications ministry reported a first round in December 2019 and said ordinary users did not notice changes. Later tests were reported in individual regions, including a Roskomnadzor exercise in December 2024 that disrupted service in Chechnya, Dagestan and Ingushetia and that the regulator described as routine.
How the system has been used, 2021 to 2026
| When | What happened |
|---|---|
| March 2021 | Twitter slowed by Roskomnadzor |
| March 2022 | Facebook, Instagram and Twitter blocked after the invasion of Ukraine |
| Summer 2024 | YouTube severely slowed |
| August 2025 | Voice and video calls restricted on WhatsApp and Telegram |
| September 2025 | Fines take effect for intentionally searching for material on the official extremist list; the state messenger Max must be preinstalled on phones sold in Russia |
| February 2026 | Telegram throttling confirmed by Roskomnadzor; major foreign domains removed from national DNS; amendments allow the FSB to demand internet and phone shutdowns without a court order |
| Spring 2026 | Telegram largely unreachable without a VPN; large Russian platforms begin restricting users who connect through VPNs |
VPNs are the main way Russians reach blocked services, so they have become the main target. According to Human Rights Watch’s March 2026 report, Roskomnadzor had blocked 469 VPN services by February 2026 and had been blocking three major VPN protocols since December 2025. Promoting VPNs as a way around blocks is banned, and the first fine for VPN advertising came in January 2025. Mobile internet shutdowns also became common from 2025, with a whitelist of approved Russian services that stay reachable during outages.
What is actually prohibited, and for whom
A lot of coverage blurs this, so here is the split as of September 2026:
- Internet providers must host TSPU, use the national DNS, follow centralized routing orders and report network details. Letting traffic bypass the filtering equipment has led to fines.
- State and quasi state systems must not use databases or technical equipment located abroad.
- VPN providers and advertisers face blocking, and promoting VPNs to get around blocks is banned.
- Individuals are not fined simply for using a VPN under current law, as far as published reporting shows. They can be fined for intentionally searching for material on the official extremist list, with fines of 3,000 to 5,000 rubles according to Human Rights Watch.
- Websites aimed at Russian users face separate data rules, such as storing Russian citizens’ personal data in Russia and, for Russian sites, offering only Russian login methods.
Public DNS resolvers are a gray area. The national DNS obligation binds providers, not individual devices, and Mediazona reported in April 2026 that well known public resolvers were still reachable. That can change at any time, because TSPU can filter DNS traffic like any other traffic.
What this means for you
For most US readers, Russia’s internet rules matter in three situations.
You run a website or app with Russian users. Expect Russian traffic to arrive through VPN endpoints in other countries, and expect sudden drops when a CDN, a messenger or a protocol is throttled. Segment analytics by country and by network, as described in our guide to using Google Analytics for marketing, so you can tell a blocking event from a product problem. Get legal advice before marketing circumvention tools to Russian users, because advertising them is banned there.
You or your staff travel to Russia. The State Department’s travel advisory is at Level 4, Do not travel, and tells US citizens to assume that all electronic communications and devices in Russia are monitored. It also advises logging out of social media while there.
You follow internet policy. Russia is the clearest example of a state building national control points into ordinary networks. The contrast with the EU, which regulates large platforms through competition law and user choice, is sharp, as our explainer on Google’s changes for European users shows.
Frequently asked questions
Can Russia actually disconnect from the global internet?
The law is designed to let Roskomnadzor reroute and cut traffic centrally, and the authorities have run national and regional drills. Whether the whole country could run cut off for long is disputed, because Russia’s networks have many operators and cross border links. In practice, the state mostly uses targeted slowdowns, blocks and regional shutdowns.
Is using a VPN illegal in Russia?
As of September 2026, published reporting indicates that individuals are not fined simply for using a VPN. However, hundreds of VPN services are blocked, promoting VPNs to bypass blocks is banned, searching for material on the official extremist list is fined, and major Russian platforms have started restricting users who connect through VPNs.
What does TSPU stand for?
It is the Russian abbreviation for technical means of countering threats. These are deep packet inspection systems the state installs in internet providers’ networks under the 2019 law. Roskomnadzor controls them centrally, and they can slow a chosen service, block it or reroute traffic without the provider’s involvement.
Does the law ban foreign DNS servers?
The law obliges internet providers to use Russia’s national DNS, which let authorities remove domains such as YouTube from it in 2026. It does not directly ban individuals from configuring a public resolver, and such resolvers were reported reachable in 2026, but the state’s filtering equipment can restrict DNS traffic at any time.
Does any of this apply to US websites?
Russian law cannot make a US site install TSPU, but it can block the site for Russian users and require local storage of Russian citizens’ personal data if the site targets Russia. US sanctions and data security rules add their own limits, so companies serving Russia need legal advice.
The bottom line
The 2019 headline about foreign databases captured a real but narrow rule for state systems. The lasting significance of Federal Law No. 90 is the infrastructure: filtering equipment in every network, a national DNS that can make sites vanish, and central control over routing.
That infrastructure turned the law from a contingency plan into a daily tool. By 2026 it underpinned the slowdown of YouTube, the blocking of Telegram and WhatsApp features, and a sustained campaign against VPNs. Anyone building for, reporting on or traveling to Russia should plan around it.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
