Russia's Ministry of Digital Development has drafted amendments that would require foreign websites and apps to authorize users in Russia only by phone number, the business daily Vedomosti reported, citing the document.

The proposed changes to the Information Law would eliminate current options for authorization via the Gosuslugi state services portal, biometrics, or other information systems. Foreign platforms would also be required to store registration, authorization, and account deletion data for three years and provide it to law enforcement upon request.

The measures are part of a draft third anti-fraud package, dubbed Antifraud 3.0, which the ministry has sent to relevant agencies. A ministry representative told Vedomosti that the package is still under discussion and it is too early to discuss a final version. The government plans to submit the bill to the State Duma in fall 2026.

Maxim Ali, a partner at the law firm Comply, said the data-sharing requirement effectively means connecting to the System for Operational Investigative Measures (SORM), which would be difficult for foreign platforms to implement. He suggested a more realistic scenario would be transferring the authorization function to a Russian company.

An expert from the Na Svyazi project called the proposed measure a “severe blow to user security,” noting that phone-number authorization de-anonymizes individuals and creates additional risks. Storing data for three years, he added, increases the likelihood of leaks.

Denis Kuskov, general director of Telecom Daily, told Vedomosti that few foreign resources legally operating in Russia remain. Ali also noted that fraud is typically linked to online banks, not foreign sites, and called the proposal “another step toward internet sovereignty.”

Restrictions on authorization methods for Russian platforms have been in effect since 2023, with penalties for violations introduced in July 2026. Russian sites currently allow authorization only via a Russian phone number, Gosuslugi, biometrics, or Russian systems such as Yandex, VKontakte, or Sber ID.