Russia still hasn’t found an effective way to curb VPNs. Now officials are considering limits on all foreign internet traffic.

On October 27, Forbes reported that Russia’s Digital Development Ministry is considering routing all foreign internet traffic through TSPU filtering equipment (TSPU is the Russian acronym for “technical means of countering threats”), effectively separating the Russian internet from the global internet at a technical level.

The measure could primarily affect people who use VPN services to bypass blocks. The plan is to cap the amount of foreign data each user can consume. The proposed limit is not yet known.

Several sources told Forbes about the proposals, which will likely be included in a bill to overhaul the telecommunications industry. The authorities have been preparing changes to telecommunications laws since the spring and are discussing specific proposals with major industry players. The Digital Development Ministry stressed that all the proposed measures “are being examined, but it is premature to say which will make it into the final amendments or in what form.”

Not quite. First, in the spring, the Digital Development Ministry wanted to limit foreign traffic only on mobile networks. Now, the proposal apparently also covers home internet connections.

Second, the earlier plan called for telecommunications providers themselves to identify and limit foreign traffic. The ministry asked them to charge users extra if they used more than 15 gigabytes of foreign data a month. BBC News Russian reported that each additional gigabyte would have cost 150 rubles. Now, the ministry plans to impose the restrictions itself using TSPU equipment.

The Digital Development Ministry intends to use this approach to combat VPNs that allow users to bypass Russian internet blocks. These services are generally based abroad, as are most of their servers. So when users connect to one of these VPNs, all their traffic becomes foreign traffic, even when they visit Russian websites.

VPN services could try to rent servers inside Russia to get around the data cap. But this summer, the authorities banned Russian hosting providers from serving them.

There are also plans to create a register of violators who have used servers in Russia to run VPNs. If caught bypassing blocks, they will be barred from signing contracts with hosting providers in Russia for a full year. In other words, using Russian hosting infrastructure will become even harder in the future.

But for now, too much about the proposal remains unknown, Sarkis Darbinyan, a digital rights lawyer and expert at RKS.global, told Meduza:

We don’t know. Most likely, by IP address. Since 2019, Russia’s communications regulator, Roskomnadzor, has required Russian holders of autonomous system numbers, which identify networks, to report their network addresses and notify the agency of any changes within three business days. Roskomnadzor can use those addresses to determine whether a given data packet came from Russia or abroad.

But under this approach, even people who don’t use VPNs could find that some traffic from Russian websites is technically classified as foreign. Much depends on whether individual components of a webpage — fonts, images, or videos — load from foreign sources and exactly how the data is routed. Even traffic from a site with an IP address registered in Russia can pass through nodes abroad. This could happen, for example, because of the particular terms of traffic-exchange agreements between telecommunications providers or because traffic takes alternative routes during network outages.

We don’t know this for certain, either. The difficulty is that TSPU equipment filters data packets that don’t explicitly identify the user they belong to. Only the source and destination IP addresses are visible. That information is not enough to limit a particular person’s foreign traffic: Different subscribers can use the same IP address at different times.

Telecommunications providers, however, have the missing information. In the spring of 2025, they were required to give Roskomnadzor comprehensive information about their subscribers, including their assigned IP addresses and the number identifying the specific TSPU device through which each user’s traffic passes.

Since December 2025, telecommunications providers have been subject to fines of 300,000 to 500,000 rubles for each failure to provide this information.

For now, we can only speculate. But requiring all foreign traffic to pass through a filter that tracks quotas would clearly make it easier to slow and ration that traffic. This would be another major step in the authorities’ campaign against independent VPNs, and users of those services would be hit hardest, Darbinyan said. Besides finding a working VPN, they would have to decide how best to use their allotted gigabytes of foreign data, choosing between videos, games, social media, and other sites and services unavailable in Russia.

Darbinyan said there could be several other consequences:

• There will be problems with updates. Updates for iOS, Windows, and games can run to tens of gigabytes. A single file could eat up a month’s allowance. “And then,” Darbinyan said, “if you can’t afford an extra international data package, you’re stuck without up-to-date software.” That creates an additional risk: Devices without updates are more vulnerable to scammers and malware, both of which are proliferating with the AI boom.
• Developers, IT workers, and remote workers will suffer. Using GitHub, Docker Hub, cloud services, Zoom, and Microsoft 365, or working with foreign clients, means using lots of foreign data. “For freelancers, students taking international online courses, and scientists, the restrictions will become an obstacle to their work. Online gaming will probably become a pastime only for the wealthy, who can afford to pay for extra gigabytes, since gaming requires enormous amounts of data,” Darbinyan told Meduza.

Still, Darbinyan believes the authorities are unlikely to impose a strict, very low cap on everyone at once: