The phrase "law banning VPNs" keeps surfacing in headlines and search results, but it almost never means a literal ban on the technology for everyone. Here is what is actually happening with this bill in 2026: who introduced it, when it is expected to pass, and what it means for someone who simply uses a VPN to protect their data. The general criteria for a legal VPN service are already covered in legal VPN in Russia — that article is the baseline, this one is about the specific bill being discussed in fall 2026.
What "the bill banning VPNs" actually means
In reality this is not about banning VPN use — it is a new ground for harsher punishment if a VPN was used while committing a crime. That is a fundamental difference: the technology itself remains just as legal as before, and what changes is not the status of VPNs but the consequences for someone who uses one for an unlawful purpose.
The confusion comes from headlines like "the Duma is discussing VPNs" — under that phrase can hide completely different initiatives: a law on advertising circumvention services, rules for hosting providers, or, less often, hypothetical talk of a full block. The broader forecast of whether VPNs will ever be banned outright is covered in will VPNs be banned in Russia — here we focus specifically on the concrete bill actually being discussed in 2026, not on hypotheticals.
The bill on VPN use as an aggravating circumstance — what's in it
The bill makes using a VPN or AI tools an aggravating circumstance when committing a crime, and lawmakers expect to pass it in fall 2026 once the new Duma convenes. On July 28, 2026, the outlet ura.news reported this, citing Anton Tkachev, first deputy chairman of the State Duma committee on information policy, information technology, and communications.
Tkachev's direct quote: "I think the law will pass — most likely already in the fall, once the new Duma convenes. Using these technologies by itself is not a crime." That line is the key to understanding the bill's logic: it does not punish using a VPN or an AI tool as such, but the fact that someone used them while doing something unlawful — for example, viewing or distributing extremist material while trying to hide their tracks with a VPN.
What changes for people who use a VPN lawfully
For lawful VPN use, nothing changes — a court applies the aggravating circumstance only when sentencing someone for a crime that was already committed, not for an ordinary connection to a service. If you use a VPN to protect your traffic at a cafe, reach work resources, or keep your data private from outsiders, that does not constitute a crime and therefore does not trigger the aggravating circumstance.
The "Antifraud 2.0" amendment: what's proposed for hosting providers
A separate and earlier initiative targets not users but hosting providers: in April 2026 an amendment was discussed that would bar them from providing server capacity to VPN services without extra controls. On April 16, 2026, Fontanka covered this in a roundup of VPN-related initiatives.
The point of the amendment is to shift a hosting provider's status from a "technical intermediary" to a "controller": the provider would have to check its clients against blocklists rather than simply supplying infrastructure. An important caveat from the outlet itself: there was no final version of the document at the time of publication, and the amendment was still being coordinated with government agencies. That means that, as of fall 2026, there are two separate documents at different stages — one (the aggravating-circumstance bill) closer to passage, the other (the hosting-provider amendment) still a draft.
Table: what already applies vs. what's only being discussed in 2026
To avoid mixing up enacted rules with proposals still under review, here is a summary table of the status as of fall 2026.
| Document | Status | Who it affects | Expected date |
|---|---|---|---|
| Federal Law 281-FZ (advertising and distributing information about circumvention methods) | In force | Those who advertise VPN services as a circumvention tool | In effect since 2024 |
| Bill on VPN/AI use as an aggravating circumstance | Under review, passage expected | Those who commit a crime using a VPN or AI tool | Fall 2026 (forecast) |
| "Antifraud 2.0" amendment on hosting providers | Draft, no final version | Hosting providers of VPN services | Not set |
| Full VPN ban for private individuals | Not officially proposed | — | — |
When the law might take effect
According to a representative of the relevant Duma committee, lawmakers expect to pass the aggravating-circumstance bill in fall 2026, once the new Duma starts work — but that is a lawmaker's forecast, not a confirmed date. The exact timeline — introduction, readings, signing — had not been officially announced at the time of writing.
The "Antifraud 2.0" amendment has even less of a timeline: the source stresses that the document is still being coordinated with agencies and has no final wording, so naming a specific effective date would be premature. If you're interested in the broader question of whether the state could technically block VPNs completely and quickly, see the detailed breakdown in can VPNs be fully blocked.
Does this threaten the average VPN user right now?
For an average user who applies a VPN for lawful purposes, the bills being discussed change nothing — the risks arise only from advertising circumvention services (already covered by the existing 281-FZ) or from using a VPN while committing a crime (the future aggravating-circumstance law). A detailed breakdown of current fines and who they actually target is in fines for VPN use in Russia.
It's worth separating two concepts that often get mixed up in the news: the "law on VPN advertising" (liability for publicly promoting circumvention tools) and the aggravating-circumstance bill discussed here — these are different documents with different logic. The first is covered in detail in the law banning VPN advertising.
What to do: how to track the law's status without breaking it
In short: use a VPN only for lawful purposes and follow official publications rather than headlines without a cited source. A practical checklist:
- Use a VPN for privacy, protection on public networks, and access to work resources — that is lawful use and not covered by the rules being discussed.
- Don't confuse VPN technology with advertising for specific circumvention services — it's the advertising and distribution of information about circumvention that falls under 281-FZ.
- Check the status of bills against primary sources — the Duma's own site or major outlets with a named author and date — rather than retellings without links.
- Choose a service with a transparent jurisdiction and a no-logs policy — for example, LiMP VPN is billed by the Russian legal entity LLC LiMP and keeps no connection logs.
- Don't use a VPN as a tool for committing offenses — that, not the fact of connecting, is what would become an aggravating circumstance under the new law.
- For details on a specific plan and supported platforms — Android, Chrome, and Windows — see the LiMP VPN features page.
