Russia Mandates Apple Store Communication Data on Local Servers
State Surveillance Registry Addition Forces Apple Into Compliance Review
Apple faces strict Russian data retention and disclosure requirements after being added to the country’s state surveillance registry, Bloomberg reports, as detailed by Hartley Charlton. The obligations cover correspondence and messages containing audio or video. Companies must keep information identifying users and recording the transmission of their communications within Russia for three years.
-
The Tech TL;DR:
- Russian authorities added Apple and Microsoft to a state registry of online communication services on October 2, 2026, with the decision becoming public on October 29.
- The rules mandate storing user data on local servers within Russia and surrendering access to security services without separate court approval.
- Mandated retention periods span three years for user identification records and communication transmission logs.
Russia Requires Communication Data on Local Servers
The regulatory directives managed by Roskomnadzor, Russia’s communications regulator, require affected firms to store communication data on servers physically located within Russia. William Gallagher notes that this data must be turned over to the country’s security services as required. Neither Apple nor Microsoft has yet commented publicly on the new requirements, and authorities can demand access to text messages, audio communications, and video messages without a separate court approval process.
Messaging platforms such as WhatsApp and Telegram already appear on the same registry, while Russia blocked Apple’s FaceTime service in 2025.
Regulatory Precedents and International Sanctions Complications
Apple has faced Russian regulatory demands before. In 2022, authorities fined the company for failing to store iCloud information on local servers. Russia subsequently introduced rules requiring major foreign technology businesses to establish local offices, prompting Apple to open an office in Moscow in February 2022, though the company suspended its online product sales in Russia following the invasion of Ukraine.
International sanctions further complicate operations. In March 2026, Apple’s Irish division reported potential sanctions issues involving Russian App Store subscriptions to British regulators. UK authorities concluded that Apple had breached sanctions requirements and imposed a financial penalty, leading Apple to stop allowing the affected subscriptions to continue. Similar jurisdictional conflicts occurred in 2025 when Apple withdrew Advanced Data Protection availability in the United Kingdom during a separate dispute.
Unresolved Privacy Questions and Enforcement Uncertainty
The latest requirements create significant challenges for companies that prioritize user privacy, and it is unclear whether Apple has supplied any requested communications or how it will address potential conflicts with its existing privacy protections. It is not established whether an iCloud Advanced Data Protection backdoor has been demanded or supplied.