Clause 6.2.2.6 of the updated agreement now covers the transfer of information from "documents confirming the identity of a Russian citizen or other documents issued by state bodies," The Moscow Times reported. The specific list of such documents is not defined.
The clause previously allowed only information about a person's "status" to be passed to commercial organizations — for example, that they are a student, an adult, or a member of a large family. That transfer took place when users authenticated through a digital ID at banks, hotels, shops and other organizations.
Leonid Yuldashev, a project coordinator at the digital rights group eQualitie, said organizations would receive data from state systems — Gosuslugi and the Unified Identification and Authentication System (ESIA). According to him, this is possible only if the user has a digital ID, which is issued after an account is confirmed in ESIA.
Lawyer Dmitry Kuteinikov noted that the transfer of data is assumed to take place at users' request rather than automatically. At the same time, the user cannot choose which data to share. It is still possible to refuse a digital ID, but the state is consistently expanding the scope of its use, he added.
Kuteinikov assessed that concentrating a large set of data in a single service increases the risks of security incidents and their consequences. "Now a potential hacker has more interests, and the price of compromise for an ordinary person grows: their documents could potentially be used. Not just a passport number or date of birth, but specifically a digital ID," The Moscow Times quoted him as saying.
Vladimir Putin signed the law on creating a "sovereign messenger" in June 2025. After that, the Russian authorities blocked Telegram and WhatsApp and began using administrative leverage to promote Max. School, student and building chats, as well as correspondence between officials and employees of state companies, were moved to the state messenger, which was also integrated with the Gosuslugi service.
Various experts have repeatedly called Max spyware. Mikhail Klimarev, head of the Internet Protection Society, pointed out that its privacy policy explicitly provides for the transfer of data on request to the FSB, the Interior Ministry, the Federal Tax Service and the Bank of Russia. Researchers on GitHub, after analyzing the app's APK file, found that it tracks processes on the device, collects geolocation and a full list of installed programs, and can record audio, video and entered text.
According to the researchers, the messenger can also determine a user's real IP address when a VPN is enabled and uses a built-in device identifier that cannot be reset even after deleting the app or restoring the phone to factory settings.