Why it matters
The moment you start collecting emails or phone numbers, or paying for traffic, you fall under regulation — and the product owner is the one held responsible, not a directory service and not a contractor. Violations around personal data (Federal Law 152-FZ) and ad labelling turn into serious fines, and as the rules tighten, into turnover-based ones.
A real-world scenario. A landing page with a "leave your phone number" form, no consent checkbox and no privacy policy; traffic comes from targeted ads with no labelling and nothing filed with an ORD (advertising data operator). An inspection or a complaint arrives — and the claims (fine included) are addressed to the project owner, because he is the personal data operator and the advertiser.
What to do (step by step)
- Consent to data processing must be explicit and collected up front. An unchecked "I consent to the processing of my personal data" box with a link to the policy; a separate opt-in for marketing mailings.
- Publish a Privacy Policy covering purposes, retention periods and the data subject's rights; add a cookie notice.
- File a notification with Roskomnadzor about your data processing when your case requires it (filed as the operator).
- Label paid advertising and file the data through an ORD: get a token (erid), add the "Реклама" ("Advertisement") label and name the advertiser; reporting goes through an advertising data operator.
Creative checklist: the "Реклама" label + "erid: <token>" in a visible spot,
advertiser and contract data filed with the ORD before/within the campaign window.
- Minimise the data: collect only what the purpose requires, and keep it no longer than necessary.
- For a tricky case (cross-border transfers, special categories, minors) — talk to a specialist lawyer.
What NOT to do
- Don't collect personal data without explicit consent, and don't send mailings without an opt-in.
- Don't launch paid advertising without labelling and ORD filing.
- Don't store personal data longer or wider than the stated purpose requires.
- Don't hide the privacy policy and processing terms from the user.
- Don't assume the liability is "the agency's or the platform's" — you are the operator and the advertiser.
Self-check
- Every data collection form has an unchecked consent box plus a link to the policy.
- The privacy policy is published and up to date.
- It's clear whether my case requires a Roskomnadzor notification (and it's filed if so).
- All paid advertising carries the "Реклама" label plus an erid and is filed with an ORD.
- Data is minimised and isn't kept "forever".
Tools
- Primary sources: Federal Law 152-FZ "On Personal Data", Federal Law 38-FZ "On Advertising" (labelling), the Roskomnadzor portal.
- ORDs (advertising data operators): VK ORD, Yandex ORD, ORD-Laboratoriya and others — pick one to get your erid.
- Templates: privacy policy and data processing consent generators (adapt them to your case).
- Lawyer: a specialist consultation on data and advertising law for your specific product.
This is a reference overview, not legal advice — the rules change, so check the details and risks for your own case with a specialist lawyer.