A site can be live, leads coming in, ad campaigns running — and then a letter arrives from Roskomnadzor or the Federal Antimonopoly Service (FAS). Owners tend to blame the contractor. The usual cause is different: the rules a site must meet were introduced after it launched.
Who checks sites and where the fines come from
Roskomnadzor oversees personal data processing and the mandatory information a site has to carry. FAS controls advertising: its accuracy, the required markings, and the rules on placement. Violations bring a case and a financial penalty, and the first the owner hears of it is often that letter.
The common triggers are collecting personal data without consent, a privacy policy that does not meet the law, missing company details, and breaches of advertising rules. Consent is needed wherever data is collected — a contact form, a newsletter signup, a registration. The site has to state the organisation's full name, address and contact details. Online advertising has to be marked, and FAS fines for failures there.
What an audit should cover
The advice is not to wait for the regulator. Start with the data collection forms: is there consent, is the privacy policy reachable. Then check that the company information is in place. Then go through the ad creatives against the placement rules.
Compliance is not a one-off exercise. Rules change, so someone has to be responsible for keeping the site legally clean, or a lawyer brought in on a regular basis. New campaigns should be checked before they go live, and the paperwork kept: user consents, policies, contracts with contractors.
