Russia Puts Apple and Microsoft on Its State Surveillance Registry. Companies Must Store Users’ Records for Three Years and Hand Data to Security Services.
Russia’s communications regulator, Roskomnadzor, listed Apple and Microsoft on its registry of “organizers of information dissemination” on October 2, according to a database it maintains and a Bloomberg report published October 28.
Registered companies must retain users’ written, audio and video messages and keep records about users and their messages inside Russia for three years, and hand the data to security services on request, per Quartz citing Bloomberg. Neither company’s response appears in the coverage we reviewed.
- Oct. 2 — date Apple and Microsoft appear on the registry, per Roskomnadzor's database as cited by Bloomberg and Quartz
- 3 years — required in-Russia storage of user and message-routing records; messages themselves must also be retained · Source: Quartz citing Bloomberg; MacTech
- January — when Google and Google Meet were added to the same registry · Source: Bloomberg via Quartz
The registry covers firms that allow users to exchange messages. Under its rules, per Quartz citing Bloomberg, a listed company must retain written, audio and video messages from users in Russia, keep user and message-routing records on Russian territory for three years, and give the data to security services on demand.
Noncompliance can bring penalties and, eventually, limits on how people in Russia can reach a company’s services. Quartz, citing Bloomberg, notes that several hundred companies are on the list, and that Google and its Meet service were added in January.
Roskomnadzor can add a company when a federal national-security or law-enforcement agency asks it to. Since 2024 it can also list a company against its will after a court finds it repeatedly ignored notification obligations, per Quartz citing Bloomberg.
A Russian outlet, Mail.ru Hi-Tech, reports it is unclear whether Apple and Microsoft applied voluntarily or were listed by the regulator. We found no statement from either company, and Civic Intelligence cannot say which path applied.
What the listing does not show is whether either company has handed over any data. A registry entry creates an obligation; it is not evidence of a transfer.
The listing follows a run of friction. This past August, Russia’s anti-monopoly watchdog opened a case against Apple for failing to comply with a warning about pre-installing the state-backed MAX messaging app and a Russian app store, per MacTech. In June, MacTech reports, Apple removed several apps tied to the internet company VK, and Kremlin spokesman Dmitry Peskov said authorities would contact Apple about it.
A Reuters report carried by MarketScreener (undated in the copy we saw) also describes Russia restricting Apple’s FaceTime, with critics calling such measures censorship and a tightening of state control over private communications.
For Western readers the practical stake is exposure: data on Russian users stored in Russia and available to security services on request.
Russia has written two of America's largest software companies into a registry that requires in-country records retention for three years and handover on request. How they got on the list, and what they will do about it, has not been reported.
