April 7, 2026

The Task is to Find VPN. Ministry of Digital Development Developed Guidelines for Marketplaces to Detect VPNs on Buyers' Phones. We Explain What This Will Lead To

The Ministry of Digital Development has sent a guide to major internet companies on detecting VPNs among users and demands to restrict access to services when they are used. Platforms are essentially offered to integrate a spyware module into their users' smartphones. Cyber advocate Sarkis Darbinyan warns that such measures could undermine trust in services, lead to sanctions from app stores, and user outflow. The main points about the ministry's new guide are in the material by 'Novaya-Europe'. Photo: Ramil Sitdikov / Reuters / Scanpix / LETA. Guide: The Ministry of Digital Development sent a guide to major Russian internet companies on detecting VPNs on users' phones, RBC found out. As journalists learned, the document was sent after meetings of the Ministry of Digital Development with more than 20 internet platforms: Sber, Yandex, VK, Wildberries, Ozon, Avito, X5, and others. At these same meetings, the head of the ministry, Maksut Shadaev, instructed to restrict access to internet services for users with VPN enabled by April 15. Otherwise, companies would lose their IT accreditation, which grants the right to be on white lists. The Ministry of Digital Development proposes to detect VPNs primarily on Android and iOS, because they are used by more than half of users. Three stages are allocated for verification: Determine the device's IP address and compare it with Russian IPs, as well as with the list blocked by Roskomnadzor; Check the use of blocking circumvention tools through the company's own application (if installed on the device); Determine the use of VPN on devices with operating systems other than Android and iOS (e.g., Windows, macOS). The guide states that implementing the second stage of verification on iPhones is difficult, as 'access to system parameters is significantly limited on iOS'. The fact is that iOS does not allow third-party applications to collect or modify information stored in other applications. On Android, any application can request active network parameters and determine if traffic is going through a VPN. At the same time, the document recommends not to monitor VPN constantly, as 'this will negatively affect traffic consumption and battery power consumption' on the user's device. The guide also describes situations where it will be difficult for companies to detect the presence of a VPN: when it is installed on routers or 'in virtual machines', when users use proxy servers and split tunneling mode, as well as CDN (content delivery networks). In addition, it is difficult for companies to track new VPN services, as 'they appear faster than reputation databases of IP addresses are updated'. Photo: Alamy / Vida Press. Consequences: Cyber advocate and co-founder of 'Roskomsvoboda' Sarkis Darbinyan explains that marketplaces will be able to implement VPN control as indicated in the guide. 'Most likely, platforms have been proposed to integrate the MAX spyware module, which has already been implicated in this, into the source code of applications used by Russians. The module can check for the presence of a VPN connection, and also systematically send requests to certain Russian and foreign servers, including Telegram servers (main.telegram.org) and WhatsApp servers (mmg.whatsapp.net),' the expert noted. Thus, it will be able to check the availability of these resources on the user's device. According to Darbinyan, if the module detects availability, it can then block full or partial access to the same Ozon or Wildberries application. At the same time, the introduction of such technology will significantly affect the business itself. As the interlocutor of 'Novaya-Europe' notes, the guide 'literally instructs domestic IT companies on what spyware modules they should develop or integrate into their mobile applications'. According to him, this is an unprecedented step for business applications, which could finally undermine user trust in Russian software and services. 'It is unlikely that businesses will be able to hide such cooperation, as security researchers and specialists will inevitably carefully study the behavior of applications, and any trace of such cooperation will become the subject of a public scandal and audience departure,' Darbinyan emphasizes. As a result, these companies' applications may be permanently removed from the AppStore and PlayMarket for violating privacy policies. In such a case, developers themselves may have their licenses revoked for gross violation of privacy rules. In that case, they will not be able to upload their applications to other app stores, even in other countries. As Darbinyan believes, RuStore is not popular enough 'to survive on it alone': - This will inevitably lead to a loss of audience, and consequently, to companies' profits. I think companies will try to do everything to sabotage the guide and not rush to implement the proposed innovations.