Russia's 150-Ruble Mobile VPN Tax: How Roskomnadzor Is Pricing VPNs Out (2026)

Russia has pioneered a new approach to VPN suppression: instead of banning them outright, tax them to death. As of early 2026 mobile operators are charging 150 rubles per gigabyte (~$1.60 USD) for international mobile traffic exceeding 15 GB per month. Because VPN traffic is routed through servers abroad by definition, this surcharge falls almost exclusively on VPN users. Combined with 469 outright VPN-service blocks and TSPU protocol-level drops, the cumulative effect is a quieter but potentially more effective VPN crackdown than outright criminalization.

Policy mechanics

• Threshold: 15 GB of international traffic per month, per SIM.
• Surcharge: 150 RUB per GB over the threshold.
• Classification:"International" is defined by the destination IP's geolocation, as determined by the mobile operator's routing tables — which are derived from TSPU classifications.
• Proposed user fines: Up to 30,000 RUB (~$300) for accessing banned resources via VPN.
• Proposed legal-entity fines: Up to 700,000 RUB (~$7,000) per violation.

Why the economic strategy works

Outright VPN bans have a fundamental enforcement problem: the state has to catchusers in the act and prosecute them individually. The 30,000 RUB fine is large in Russian terms but still requires identification of the user, documented use of a banned resource, and a legal process. The mobile surcharge has none of these constraints. The charge is applied automatically by the carrier's billing system the moment a threshold is crossed. No prosecution, no evidence, no appeal.

It also creates an unfortunate incentive structure for users. Heavy VPN users — journalists, NGO workers, dissidents — pay the highest surcharges. Casual users who rarely use VPNs are barely affected. The policy imposes cost exactly on the demographic the Kremlin most wants to discourage, without any of the headline risk of mass prosecutions.

TSPU's role in enforcement

TSPU (Technical Means of Countering Threats) is the ISP-level DPI infrastructure installed under Russia's 2019 Sovereign Internet Law. It is what makes the 15 GB threshold technically feasible: TSPU can classify each packet as domestic or international in real time and tag it in the billing pipeline. Without TSPU, carriers would need to infer traffic destination from NetFlow logs after the fact — far less accurate and much harder to bill in real time.

TSPU has also been used to directly block specific VPN protocols. Since December 2025, Roskomnadzor has blocked SOCKS5, L2TP, and the VLESS protocol family. WireGuard traffic from residential networks is throttled to sub-usable speeds rather than blocked outright. By late February 2026, 469 commercial VPN services were at least partially blocked in Russia.

What still works in Russia (2026)

• AmneziaWG — obfuscated WireGuard whose initial handshake packet shapes are randomized to evade pattern-based DPI.
• REALITY / Xray VLESS— TLS camouflage that mimics real websites' handshakes.
• Cloudflare WARP — intermittently blocked but resurfaces periodically.
• Tor via obfs4 bridges — still functional, though bridge turnover is high.

The detection angle

For detectors on the receiving end of Russian VPN traffic — fraud teams, content licensing, sanctions compliance — the policy changes the traffic mix in a few useful ways:

• Russian residential users appearing from cloud VPSes in Helsinki, Amsterdam, or Frankfurt are increasingly common. Hetzner AS24940 is the most over-represented ASN in Russian VPN-exit traffic as of 2026.
• AmneziaWG handshakes have a distinct initial packet shape that differs from vanilla WireGuard, and vendors with protocol fingerprinting can flag it with high precision.
• Russian behavioral signals (browser language `ru-RU`, Yandex DNS, timezone `Europe/Moscow`) from a Dutch or German IP is a strong VPN tell. See the tz_mismatch and lang_mismatch signals in the IPLogs API docs.

References

• Meduza / Zona.media, "Russia's internet censorship in 2026", April 2026.
• The Moscow Times, "As Kremlin Cuts Off the Internet, VPNs Become a Way of Life", April 2026.
• Human Rights Watch, "Russia: Digital Iron Curtain Falls", March 2026.
• ACF (Anti-Corruption Foundation), "Access Denied: How the Kremlin Controls the Internet", March 2026.