Russia has officially compelled Apple and Microsoft to turn over users’ private communications—including voice, video, and text messages—on demand, bypassing any court-required processes. Both companies were added on October 2, 2026 to a government regulation enforcing such measures, placing them under the sway of Russia’s media regulator Roskomnadzor. Compliance now means retaining user correspondence for up to three years on servers located in Russia and immediately handing over data to security services when requested.
New Legal Requirements and Their Impacts
Once listed as “organizers of information dissemination,” Apple and Microsoft must meet Russia’s new legal standard: data localization and unfettered data disclosure. Roskomnadzor, which maintains the registry, has already used its powers in the past—demanding removal of VPN apps from Apple’s app storefronts—and now extends them into broader surveillance. All messages from Russian users must be stored locally and be accessible to state authorities without any legal hurdles.
This update continues a trend of increasing demands on tech firms operating in Russia. Earlier restrictions included fines in 2022 for Apple refusing to store iCloud data within Russia’s borders and forcing tech companies to open local offices. Apple opened its Moscow office in February 2022. At that time, Apple also ceased online sales in Russia and made its storefronts unavailable, though devices and services continue to reach users through third-party resellers.
What This Means for Apple and Users
Apple has not yet publicly responded to these new obligations. Previously, the company has made preemptive changes in certain regions when laws conflicted with its privacy policies. For example, Apple disabled its Advanced Data Protection feature in the UK in 2025 to avoid unwarranted demands for data. It also continues to limit some services, including in parts of the EU, due to regulatory differences.
Although Apple’s direct presence in Russia—via physical stores or online sales—has been limited since 2022, many of its services remained active until early 2026 through resellers and indirect channels. The inclusion in the surveillance registry marks a deeper legal entanglement: Apple must now fully comply with state control over messaging data for Russian users, even as many services were already in a gray area of regulation.
For users, this means privacy protections long promised by Apple—especially those relying on encryption and data stored off local servers—may no longer apply in Russia. Messages once shielded by legal safeguards could now be accessed without judicial review or explicit user consent. Service features depending on data storage and transmission protocols could be revised or disabled in the region to comply with state law.
This move isn’t just a localized regulatory change—it’s part of a global tension between privacy commitments and government demands over user data. As states increasingly seek access to private communications, tech companies face difficult choices between compliance and user trust. For Apple, this will likely test the limits of its public stance on privacy and could influence how it balances global data laws, technical infrastructure, and consumer expectations in increasingly assertive regulatory environments.
