Why are bundled consents prohibited starting September 1, 2025 (Federal Law No. 156-FZ)?

As of September 1, 2025, Article 9 of 152-FZ requires consent to be documented separately from other confirmed documents. For a form, the legal basis and purpose of processing are defined. If consent is used, we provide a separate empty checkbox with a link to its text and a record of the selection. Consent for advertising is verified separately under Article 18 of Law No. 38-FZ; it must not be a condition for submitting a standard application.

What is the fine for lacking a policy or a separate checkbox?

Liability is regulated by Art. 13.11 of the Administrative Code of the Russian Federation (taking into account the tightening of rules under Federal Law No. 420-FZ). For the absence of a personal data processing policy, the fine is up to 60,000 ₽ (Part 3 of Art. 13.11). For data collection without proper consent (including bundled checkboxes under 156-FZ or auto-checked boxes), the fine for legal entities ranges from 150,000 to 300,000 ₽ (Part 1 of Art. 13.11), and in cases where written consent is required by law — from 300,000 to 700,000 ₽ (Part 2 of Art. 13.11, for repeat offenses — from 1,000,000 to 1,500,000 ₽ under Part 2.1). Please note that the 50% discount on fines under Art. 13.11 has been abolished.

Is it mandatory to submit a notification to Roskomnadzor?

Under Article 22 of 152-FZ, an operator must notify Roskomnadzor before starting data processing. Part 2 retains exceptions, including processing done exclusively without automated means. For a website that collects applications, we check the actual process, any previously submitted notification, and the accuracy of the information provided therein.

Are cookies and analytics counters considered personal data?

Cookies, IP addresses, and analytics identifiers can be considered personal data if they allow a person to be identified directly or indirectly. We verify the actual composition, purposes, recipients, and legal basis for processing. If consent is used, we delay the activation of the relevant trackers until the visitor makes a selection. The mere use of cookies does not constitute a violation or determine the amount of a fine.

What does the requirement for database localization mean (Part 5, Art. 18)?

Part 5 of Article 18 of 152-FZ establishes requirements for databases of Russian citizens' personal data during collection, taking into account statutory exceptions. The static hosting of a website and the routing of personal data are checked separately; initial recording in the RF does not in itself authorize all subsequent operations abroad. For legal entities, parts 8 and 9 of Article 13.11 of the Code of Administrative Offenses of the Russian Federation provide for 1–6 million ₽ and 6–18 million ₽ for repeat violations of localization requirements.

How does the service for standard websites differ from medical ones?

For medical organizations (clinics, dental offices, cosmetology centers), specific industry regulations apply: Decree of the Government of the Russian Federation No. 659 dated 30.05.2026 and Order of the Ministry of Health of the Russian Federation No. 118n dated 13.03.2025. They require the placement of information about doctors with accreditation, a license with a QR code, a price list, and data on supervisory authorities. We have a separate specialized compliance service for medical websites.

Traveler on a snowy mountain peak before the moon

LEGAL AND TECHNICAL COMPLIANCE

Your website
in accordance with 152-FZ

Professional bringing of websites and online stores into compliance with 152-FZ "On Personal Data". Separate consents, a smart Cookie banner with Metrica blocking, consent logging, and protection against Roskomnadzor fines of up to 700,000 – 1,500,000 ₽.

Check your website

CONSENT
FORMS
COOKIES

DOCUMENTS
LOGGING
LOCALIZATION

152-FZ turnkey audit and implementation

AUDIT
DOCUMENTS
IMPLEMENTATION

700+completed
projects

2011year of start
of studio

40+niches and business-
models

2023Google
Premier Partner status

Development,
marketing, analytics

Legal and technical compliance

Secure your website from Roskomnadzor fines of up to 700,000 – 1,500,000 ₽ and blocking

Any website that has a callback form, an e-commerce cart, a quiz, a registration, or even a Yandex Metrica counter is, by law, a personal data operator. Roskomnadzor and the prosecutor's office continuously monitor commercial websites using automated parsers.

C September 1, 2025 Article 9 of Law No. 152-FZ requires separate processing of consent from other documents to be confirmed. According to Article 13.11 of the Code of Administrative Offenses of the Russian Federation, liability depends on the composition of the violation: for legal entities, part 2 provides for 300,000–700,000 ₽ for violating requirements for mandatory written consent, part 2.1 provides for 1,000,000–1,500,000 ₽ for a repeated violation. Any defect in a checkbox does not automatically mean the application of these sections.

We take on the full cycle: from legal expertise and drafting customized policies to coding smart cookie banners, segmenting forms, and setting up a consent recording system in the database.

For medical clinics: Additional strict requirements from the Ministry of Health (Order No. 118n and new rules No. 659) apply to clinics, dental offices, and cosmetology centers. Go to medical compliance →

Audit of all site forms, carts, quizzes, and pop-ups for 152-FZ compliance
Separate unchecked checkboxes for Personal Data processing and marketing mailings
Smart Cookie banner: blocking Yandex Metrica and advertising pixels until consent
Individual document package: Personal Data Processing Policy, consent texts, and Cookie Policy
Software logging of consent evidence (IP, time, User-Agent) in a database or CRM

up to 1.5 million

Repeated violation of requirements for mandatory written consent (part 2.1 Art. 13.11 of the Code of Administrative Offenses of the Russian Federation)

up to 6–18 million

Fine for non-localization of databases on servers in the Russian Federation (Parts 8 and 9 of Art. 13.11 of the Code of Administrative Offenses of the Russian Federation)

156-FZ

Separate arrangement of consent; empty checkboxes for informed choice

2026

Support guarantee: elimination of remarks and legal protocol for Roskomnadzor inspections

Why is a link in the footer no longer sufficient?

Inspecting authorities evaluate not just the presence of 'Privacy Policy' text at the bottom of the site, but the data collection mechanic: whether checkboxes are checked automatically, whether an electronic consent log is saved, whether cookies are transmitted to third-party services before user consent, and whether database servers are localized in Russia.

Article 18.1 of Law No. 152-FZ requires providing access to the policy, including data collection pages. Part 5 of Article 18 regulates the use of databases of citizens of the Russian Federation during collection, and Article 22 concerns notification of Roskomnadzor and exceptions. We verify requirements by following the data path; placing all site static content in the Russian Federation does not automatically follow from these norms.

Compliance Anatomy

6 key risk areas on a commercial website

Where businesses most often make critical violations and how we fix them.

Federal Law No. 156-FZ (from 01.09.2025)

Ban on 'bundled' consent

You cannot combine consent for personal data with a user agreement, offer contract, and marketing newsletters into one general statement.

Solution: we move consent to a separate unchecked checkbox, and consent for advertising to a second separate item.

Federal Law No. 152-FZ, Art. 6, 9

Cookies and trackers

Analytics counters (Yandex Metrica, Google Analytics, VK Pixel) collect IP and digital fingerprints of users, which constitutes the collection of Personal Data.

Solution: we implement a Cookie banner with a technical delay in executing external trackers until consent is given.

Federal Law No. 152-FZ, Art. 9 p. 1

Proof of consent

In case of an inspection, the burden of proving consent lies with the operator. If the fact of consent is not recorded, it may be difficult for the operator to prove its receipt; the absence of one type of log does not in itself prove the absence of consent.

Solution: the script logs the date, time, IP address, User-Agent, and consent text hash into the database upon form submission.

Federal Law No. 152-FZ, Art. 18 Part 5

Database localization in the Russian Federation

Initial collection and storage of personal data of Russian Federation citizens must occur on servers physically located within Russia.

Solution: server environment audit, migration of databases to Russian clouds, and disabling foreign collector widgets.

Federal Law No. 152-FZ, Art. 22

Notification to Roskomnadzor

According to Article 22 of Law No. 152-FZ, the operator notifies Roskomnadzor before starting processing, except for exceptions listed in part 2. Applicability is checked based on actual processes.

Solution: we prepare an electronic notification based on operator data according to the Roskomnadzor form and assist with its registration.

Roskomnadzor Order No. 179

Destruction of data by act

Upon reaching the collection goal or withdrawal of consent, data must be irrevocably destroyed with the creation of a formalized act and log export.

Solution: storage regulations and data destruction certificate templates for your internal documentation.

Stages of work

How is it going aligning the website with 152-FZ

Clear regulations from audit of leaks to script implementation and filing documents with Roskomnadzor.

Legal and technical audit

We inspect all data input points on the site: lead forms, contact forms, subscriptions, authorization, checkout, online chats, and external scripts.

Development of documents

We compose an individual Personal Data Processing Policy, texts of consents for processing and advertising, a Cookie usage policy, and data destruction regulations.

Cookie banner installation

We implement an adaptive pop-up notification that blocks the initialization of analytics trackers until user consent is obtained.

Re-coding website forms

We separate checkboxes on the site: consent for Personal Data separately, advertising separately. We remove default checks and bind clickable links to the policy.

Consent logging setup

We connect a software module for consent recording: when a request is sent, the date, time, IP, and document version are recorded in the DB/CRM.

Registration with Roskomnadzor

We help draft and send an electronic notification to Roskomnadzor to enter your company into the official Register of personal data operators.

Compliance stack

Technological security modules

Reliable software solutions that integrate with any CMS (Bitrix, WordPress, Tilda, custom frameworks).

Smart Cookie Consent

Adaptive lightweight JS-module. Manages cookies, blocks advertising pixels and counters until consent, and saves the selection status in LocalStorage.

Audit Logger (DB / CRM)

Server-side script for logging electronic consents. It records an evidentiary base (IP, date, text of consent) every time a form is submitted.

Forms with 156-FZ validation

Adaptive form layout with separate empty checkboxes, frontend validation, and a ban on form submission without explicit consent.

— COST AND RATES

Pricing
152-FZ

Engagement models: from free express audit to comprehensive legal and technical turnkey implementation.

Capabilities and scope of work	Express Audit Initial check of 10 key risk points 0 ₽ Duration: 24 hours Check for free	POPULAR CHOICE Detailed audit + Technical requirements Full audit, legal document package, and TS for the programmer 25 000 ₽ Duration: 2-3 working days Order for 25 000 ₽	Turnkey implementation Audit + documents + we implement all changes on the site ourselves 65 000 ₽ Duration: 5 working days Order for 65 000 ₽
Checking all site forms, cart, and pop-ups	✓ Up to 3 main forms	✓ All site forms and quizzes	✓ All site forms and quizzes
Checking the mechanism for Cookie collection and analytics operation	Express check	✓ Full technical audit	✓ Full technical audit
Individual document kit (Policy, Consent, Cookies)	—	✓ Ready-made custom texts	✓ Ready-made custom texts
Step-by-step TS for a developer on re-layout of forms	—	✓ Detailed technical specification with code	✓ Performed by our programmers
Programming a Cookie banner with tracker blocking	—	Implementation guide	✓ Installation and debugging on the site
Separating checkboxes (Personal Data separate, advertising separate)	—	Implementation guide	✓ Full re-layout of all forms
Consent logging setup (IP, time, revision)	—	Implementation scheme	✓ Programming in database / CRM
Preparation of notification for the Roskomnadzor operator register	Consultation	Template and instructions	✓ Full form completion for Roskomnadzor

— QUESTIONS AND ANSWERS

FAQ
about 152-FZ law

Don't know if your website is subject to Roskomnadzor sanctions? Leave a request — we will conduct a free express analysis of your forms and counters.

Ask an expert a question

Why are bundled consents prohibited starting September 1, 2025 (Federal Law No. 156-FZ)?

As of September 1, 2025, Article 9 of 152-FZ requires consent to be documented separately from other confirmed documents. For a form, the legal basis and purpose of processing are defined. If consent is used, we provide a separate empty checkbox with a link to its text and a record of the selection. Consent for advertising is verified separately under Article 18 of Law No. 38-FZ; it must not be a condition for submitting a standard application.
What is the fine for lacking a policy or a separate checkbox?

Liability is regulated by Art. 13.11 of the Administrative Code of the Russian Federation (taking into account the tightening of rules under Federal Law No. 420-FZ). For the absence of a personal data processing policy, the fine is up to 60,000 ₽ (Part 3 of Art. 13.11). For data collection without proper consent (including bundled checkboxes under 156-FZ or auto-checked boxes), the fine for legal entities ranges from 150,000 to 300,000 ₽ (Part 1 of Art. 13.11), and in cases where written consent is required by law — from 300,000 to 700,000 ₽ (Part 2 of Art. 13.11, for repeat offenses — from 1,000,000 to 1,500,000 ₽ under Part 2.1). Please note that the 50% discount on fines under Art. 13.11 has been abolished.
Is it mandatory to submit a notification to Roskomnadzor?

Under Article 22 of 152-FZ, an operator must notify Roskomnadzor before starting data processing. Part 2 retains exceptions, including processing done exclusively without automated means. For a website that collects applications, we check the actual process, any previously submitted notification, and the accuracy of the information provided therein.
Are cookies and analytics counters considered personal data?

Cookies, IP addresses, and analytics identifiers can be considered personal data if they allow a person to be identified directly or indirectly. We verify the actual composition, purposes, recipients, and legal basis for processing. If consent is used, we delay the activation of the relevant trackers until the visitor makes a selection. The mere use of cookies does not constitute a violation or determine the amount of a fine.
What does the requirement for database localization mean (Part 5, Art. 18)?

Part 5 of Article 18 of 152-FZ establishes requirements for databases of Russian citizens' personal data during collection, taking into account statutory exceptions. The static hosting of a website and the routing of personal data are checked separately; initial recording in the RF does not in itself authorize all subsequent operations abroad. For legal entities, parts 8 and 9 of Article 13.11 of the Code of Administrative Offenses of the Russian Federation provide for 1–6 million ₽ and 6–18 million ₽ for repeat violations of localization requirements.
How does the service for standard websites differ from medical ones?

For medical organizations (clinics, dental offices, cosmetology centers), specific industry regulations apply: Decree of the Government of the Russian Federation No. 659 dated 30.05.2026 and Order of the Ministry of Health of the Russian Federation No. 118n dated 13.03.2025. They require the placement of information about doctors with accreditation, a license with a QR code, a price list, and data on supervisory authorities. We have a separate specialized compliance service for medical websites.

Regulatory primary sources

Sources verified October 26, 2026.

Law No. 152-FZ, Article 9: consent to data processing — Separate arrangement of consent, confirmation of its receipt, and cases of mandatory written form.
Law No. 152-FZ, Article 18.1: duties of the operator — Organizational measures and access to the personal data processing policy, including their collection pages.
Law No. 152-FZ, Article 18: collection and localization of data — Part 5: requirements for databases of citizens of the Russian Federation during collection, taking into account the exceptions established by law.
Law No. 152-FZ, Article 22: notification of Roskomnadzor — Notification before the start of processing; exceptions are listed in part 2 of the article.
Code of Administrative Offenses of the Russian Federation, Article 13.11: violations of data processing — Different violation compositions and sanctions; part 2 concerns consent that is mandatory in written form.
Law No. 38-FZ 'On Advertising' — Articles 18, 18.1 and 24: newsletters, internet advertising and advertising of medical services.

Applicability of norms and liability depend on the activity, data composition, and circumstances of the violation. Before making changes, check the current version of the document.

Your website
in accordance with 152-FZ