Russia has expanded restrictions on VPN use, with banks, retail platforms, streaming services and other major sites now denying access to some users connected through encrypted networks. The move, reported Wednesday by state and independent outlets and observed by AFP journalists in Moscow, marks a broader effort by the authorities to narrow the digital workarounds many Russians have relied on since wartime censorship intensified in 2022.
The immediate effect is practical as much as political. A tool widely used to reach blocked news outlets, foreign platforms and messaging services is becoming harder to keep on in ordinary daily life, forcing users to choose between privacy and access to basic online services.
How the new restrictions work
VPNs route internet traffic through encrypted channels, which can shield browsing activity from local networks and make it harder for service providers or state agencies to inspect what a user is doing online. They are also one of the most common ways to bypass blocks on websites and apps. That dual function has long made them a target for governments seeking tighter control over information flows.
According to Russian media reports, operators and major online platforms were told to block users whose connections appear to come through VPN services. AFP journalists in Moscow encountered warning messages on major retailers including Ozon and Wildberries telling them to disable VPN access. This points to a more coordinated system: not only pressure on telecom providers to disrupt VPN traffic, but active refusal by online services to serve users unless they connect in a way that is easier to monitor.
Why this matters beyond technical enforcement
Since the full-scale invasion of Ukraine, the Kremlin has built a far more restrictive information environment. Independent journalism has been pushed out, foreign platforms have been blocked or curtailed, and public criticism of the war has become dangerous. In that setting, VPNs have been more than a privacy tool. For many users, they have been a basic route to uncensored reporting, overseas services and private communication.
Blocking VPN users at the service level deepens that pressure. It does not need to criminalize VPN use outright to be effective. If banking, shopping, streaming and communication become unreliable while a VPN is switched on, many users will stop using one for convenience alone. That kind of friction can be as powerful as a formal ban, especially when it is applied across multiple parts of everyday digital life.
A wider push toward state-supervised platforms
The reported crackdown comes alongside pressure on major messaging services. Russia’s internet regulator has been slowing Telegram and WhatsApp while encouraging users to move toward Max, a state-backed super-app presented as a domestic alternative. Critics have raised concerns that such platforms can offer weaker privacy protections and give authorities greater visibility into communications and user behavior.
This mirrors a broader policy direction in Russia: replacing a more open internet with a managed digital environment built around domestic infrastructure, domestic platforms and tighter surveillance capacity. The government does not need to sever the country from the global internet completely to achieve that goal. It can instead make foreign or privacy-protecting tools slower, less reliable and harder to combine with routine online activity.
What comes next
Kremlin spokesman Dmitry Peskov said Wednesday that there is currently no ban on VPNs and no criminal liability for using them. That distinction matters legally, but less so in practice if access continues to narrow. Technical restrictions, throttling and service denials can reshape behavior without the visibility of a formal prohibition.
For Russian internet users, the likely result is a network that feels increasingly conditional: open in appearance, but structured to favor traceable traffic and approved platforms. For outside observers, the latest measures are another sign that internet control is no longer limited to blocking individual sites. It now extends to the basic architecture of access itself.
