On March 31, 2025, the Russian regulatory authority, Roskomnadzor, officially registered a new order that mandates telecom operators and internet providers to collect and transmit comprehensive data about the devices used by internet users in the country. This order, which is set to come into force on April 12, 2025, outlines the types of information that must be shared with the agency, including device types, IP addresses, and specific identifiers related to traffic routing.
The order requires operators to gather detailed information about all devices that connect to the internet, which includes smartphones, laptops, modems, and routers. Specifically, providers must collect and report the IP addresses assigned to users, the geographical location of these addresses, and unique identifiers for the technical means used to counter threats (TSPU). These measures are part of a broader initiative aimed at enhancing the regulation of internet traffic and improving the identification of users accessing online content.
According to Roskomnadzor, the new regulations are designed to help the agency effectively monitor and restrict access to prohibited websites and illegal content. The order specifies that existing operators, those who received their licenses before the new rules take effect, will have six months to comply, while new operators will be given 15 business days from the commencement of their services. This initiative is expected to impact approximately 1,981 telecom operators across Russia, with 493 already connected to the TSPU.
In a statement regarding the new requirements, Roskomnadzor explained, "The procedure, terms, composition, and format for the provision by a telecom operator to Roskomnadzor of information that allows identifying communication facilities and user equipment in the 'Internet' network on the territory of Russia are established." This includes not only the collection of basic data but also the obligation to report any changes in user information within one day.
However, the introduction of these requirements has sparked considerable concern among telecom operators, particularly regarding the implications for user privacy and the potential costs associated with implementing the necessary infrastructure changes. MTS, one of Russia's largest telecom companies, expressed worries about the risks to communication secrecy posed by the collection of user IP addresses. The company noted that the information gathered about subscribers, which is not derived from contractual agreements, constitutes a breach of privacy and can only be shared with third parties with the subscriber's consent unless otherwise mandated by law.
MTS further highlighted the technical challenges involved in complying with the new order, stating that accurately determining how users connect to the internet—whether through a computer, laptop, or smartphone—can be problematic. The company estimated that it would require approximately six months to adapt its network design and implement the necessary systems to meet the new requirements.
In contrast, Rostelecom, another major player in the Russian telecom market, has indicated that it does not foresee any significant challenges in fulfilling the obligations outlined in the order. They stated they would comply fully with Roskomnadzor's directives.
The new order also requires that the information provided by telecom operators includes not just the IP addresses but also the MAC addresses of devices, precise coordinates of installed equipment, and the identification numbers of TSPUs through which user traffic passes. This level of detail is intended to enhance the regulatory authority's ability to monitor internet activity and enforce restrictions on access to illegal online resources.
Experts have pointed out that while the initiative aims to protect citizens from online threats and ensure compliance with data processing regulations, it raises significant questions about the balance between security and privacy. The collection of such extensive data could lead to a chilling effect on internet usage, as users may feel their online activities are being closely monitored.
As the implementation date approaches, the telecom sector is bracing for the operational and financial implications of the new regulations. The estimated cost for operators to comply with Roskomnadzor's requirements is around 389 million rubles annually, totaling approximately 2.3 billion rubles over six years. These costs include the necessary upgrades to network infrastructure and the establishment of systems to facilitate the collection and transmission of the mandated data.
In an effort to address concerns raised by operators, Roskomnadzor has indicated that it will consider feedback and make adjustments to certain points of the order as needed. The agency has acknowledged that some proposals from companies like MTS will be taken into account during the regulatory impact assessment process.
Ultimately, the new order from Roskomnadzor represents a significant shift in how internet data is managed in Russia, reflecting broader global trends towards increased regulation of digital communication and data privacy. As the date for implementation draws near, both telecom operators and users will be watching closely to see how these regulations will shape the future of internet access and privacy in the country.
