Russia decrees that operators of messaging apps must identify all their users by verifying user data via mobile carriers; rules come into effect in 6 months
New decree means messaging services will have to check users' registration data with their mobile operator.
Context & Ripple Effects
This decree is the enforcement layer for an identity-control stack Russia has been assembling since 2016. Putin first required providers to store calls, messages and metadata under the anti-terrorism data-retention law, then in 2017 signed rules banning VPNs and ordering instant messenger operators to establish user identities — without specifying how. Today's decree answers that question: verification runs through mobile carriers, who hold the registration data.
First-order effects
- Messaging app operators have six months to build carrier-based verification into registration, turning Russian mobile operators into mandatory identity checkpoints for every account.
- Users who registered with data that doesn't match carrier records lose access unless they re-verify, collapsing anonymity on the major messengers inside Russia.
Second-order effects
- Carriers gain a new compliance role and pricing leverage over messaging services that depend on their subscriber databases, while any operator unwilling to verify faces the same choice the 2017 VPN ban already forced on circumvention tools: comply or exit.
- Verified identities make every message attributable, which strengthens the enforcement value of the earlier retention mandates — metadata now maps to a confirmed person.
Third-order effects
- If the pattern holds, identity verification migrates from messengers to all internet platforms — which is exactly what followed, with the 2023 law requiring state-approved identity checks at registration and the state-backed MAX messenger being made mandatory pre-install — pointing toward a fully state-mediated digital identity layer across Russian internet services.
The trend: Russia is hardening a layered identity-control regime in which each decree closes the enforcement gap left by the last, moving from data retention to carrier verification to state-run identity systems.