Discuss a project
+7 (812) 507-81-30 hello@rupor.agency
152-FZ

Making your website 152-FZ compliant

We handle the technical side of Russia’s personal data law: consents are stored the way inspectors will ask for them, trackers don’t load before consent, and forms can’t be sent without a checked box. Works with WordPress, MODX and Laravel.

Since 2025, fines for personal data violations have increased several times over, and Roskomnadzor (Russia’s data protection authority) now inspects ordinary websites: online stores, landing pages with a request form, corporate sites running Yandex Metrica. Formally, it already counts as a violation if Yandex Metrica or the VK Pixel loads before the visitor has given consent.

We make websites that serve users in Russia technically compliant with Federal Law No. 152-FZ (Russia’s personal data law), so that you have proof of who gave consent, when and to which version of the policy, and so that no tracker fires too early. You or your lawyer prepare the policy and consent texts; we make sure the site follows them to the letter.

When clients come to us

You’ve received a Roskomnadzor inquiry or compliance order

You need to resolve the findings quickly and provably: the banner, consent storage, tracker blocking, form checkboxes. We treat it as a priority and deliver an implementation report.

You’re launching a website or store

It’s easier to build compliance in from the start than to rework the site before an inspection. We install a ready-made module for your CMS and set up consent categories for the services you use.

Your cookie banner is just for show

A “we use cookies” bar with no choice of categories, no consent records and no script blocking doesn’t protect you. We replace it with mechanics that actually work.

Lots of forms, services and integrations

CF7 forms, WooCommerce checkout, chats, call tracking, ad pixels, CRM. We take stock of everything that collects data and put it under consent control.

What’s included

Website audit

We find every point where personal data is collected: forms, checkout, sign-up, chats, call tracking, analytics, ad pixels, embedded maps and videos. We map what is sent where, and why.

Cookie banner with categories

Necessary, functional, analytics and advertising. Users choose; you get a detailed consent record. We adapt the design to your site; the texts are yours.

Trackers blocked until consent

Yandex Metrica, Google Analytics, the VK Pixel, Top.Mail.Ru, ad network pixels and any third-party scripts physically don’t load until there’s consent for their category.

Consent on forms

Checkboxes with links to the policy and the consent text on every form — inquiries, sign-up, checkout. A form can’t be sent without the box checked, and the consent is saved together with the submission.

Consent storage and export

Every consent is stored on your server with the date, IP address, categories and policy version. CSV export when Roskomnadzor asks. Updated your policy? Consent is requested again.

Implementation report

We document what was done and how: the list of collection points, the blocking setup, where consents are stored. Useful for internal control and for answering a regulator’s inquiry.

What’s not included

The privacy policy, the consent to personal data processing and the notification to Roskomnadzor about the processing are the legal part — you or your lawyer prepare them. We’re responsible for the technical part: making sure the site follows your documents to the letter and can prove it.

How we work

  1. 1

    Audit

    We go through the site the way an inspector would: what data is collected, which scripts load before consent, what state the forms and the policy are in. You get a list of findings.

  2. 2

    Module installation

    We install our 152-FZ Compliance module for your CMS — WordPress, MODX or Laravel — and set up the categories for your services.

  3. 3

    Forms and integrations

    We add consent to every form and to checkout, put trackers, chats and pixels under the banner’s control, and check what data goes to the CRM.

  4. 4

    Testing and report

    We test the scenarios: refusal, partial consent, withdrawn consent, a new policy version. You get an implementation report.

Technologies and systems

WordPressWooCommerceContact Form 7MODX RevolutionLaravelYandex MetricaGA4VK Pixel

152-FZ Compliance

A cookie banner with 4 categories, consent records with the date and policy version, and scripts and forms blocked until consent. Ready for WordPress, MODX and Laravel. Prefer to implement it yourself? The plugin is available as a standalone product.

More about the plugin

Case studies for this service

Miaowser — Asian-style clothing brand, from a quick-launch store to two live sites and a third underway
E-commerce

Miaowser

Years of work with an exclusive Asian-style clothing brand: a quick stock-theme launch, a redesign, integrations, a fork for Russia, and a Korean site underway.

WordPressWooCommerceRobokassaCDEK

All case studies

FAQ

What exactly does Roskomnadzor check on a website?

Whether there’s a personal data processing policy and whether it’s easy to find, consent on forms, the cookie banner and whether trackers load before consent, data transfers to third parties (analytics, CRM, chats), and proof that consents were actually obtained and are stored. We cover all of it except the texts of the documents.

Is a simple cookie notice enough?

No. A notice with no choice of categories, no script blocking before consent and no record of the consents themselves doesn’t prove that consent was obtained. You need mechanics that work: categories, blocking, storage with the date and policy version.

Can we do it ourselves?

Yes — for WordPress, MODX and Laravel we have a ready-made module, 152-FZ Compliance, that you can install yourself. The service is for when the site has many forms and services, runs on a non-standard CMS, or you need to resolve a Roskomnadzor compliance order quickly and with a report.

Will we lose Yandex Metrica stats?

Some visitors will decline analytics cookies, so the stats on them will be incomplete — that’s expected, and it’s the same for everyone who follows the law. Necessary cookies and server-side metrics keep working; e-commerce goals and orders are counted in the CRM.

What about data we’ve already collected and old consents?

New consents are collected from the moment of implementation. Existing customers can be asked for consent again on their next visit or order — we set up that scenario. What to do with the data you’ve already accumulated is a question for your lawyer; we’ll take care of the technical side.

How long does implementation take?

For a typical WordPress or MODX site, a few days, including the audit and the report. For a store with dozens of forms, integrations and ad pixels, 1–2 weeks. We give the timeline after the audit.

Related services

Tell us about your task

We’ll estimate the scope and propose a solution and a timeline. No strings attached.

Discuss a project