Federal Law 38-FZ on Advertising and email marketing in Russia

If you send promotional email to people in Russia, the rule to know is Part 1 of Article 18 of Federal Law No. 38-FZ "On Advertising". Advertising over telecommunication networks is allowed only with the prior consent of the subscriber or addressee.

A second statute sits right next to it. Under Federal Law No. 152-FZ "On Personal Data", an email address is often personal data, and Article 15 of that law also demands prior consent when personal data is used to promote goods through direct contact. The two consents rest on different grounds, and you need both. Below: what counts as advertising, how to word and record consent, and what a mistake costs.

What counts as advertising

Article 3 of 38-FZ defines advertising as information distributed by any means, addressed to an indefinite group of people, and aimed at drawing attention to the advertised object, keeping up interest in it and promoting it on the market. In an email that usually means a product or service offer, a discount, a sale, or a paid event.

Service messages are not advertising in themselves: order confirmations, receipts, delivery notices, password resets, login codes. They promote nothing, and some of them a company is legally required to send. Drop a "you might also like" block into a shipping notice, though, and that block is advertising.

Newsletters and educational content are the grey area. There is no ready-made rule; it comes down to content. Links to product pages and prices pull a message toward advertising, while purely editorial text pulls it away.

Part 1 of Article 18, sentence by sentence

The core of it fits in three sentences. Advertising over telecommunication networks requires the prior consent of the subscriber or addressee. Advertising is deemed sent without consent unless the distributor proves that consent was obtained. And the distributor must stop sending advertising immediately to anyone who asks.

"Prior" means what it says: consent first, email second. A cold message asking "would you like our newsletter?" that also carries an offer is already a violation.

38-FZ does not prescribe a form of consent. A website checkbox, a signed paper form and a recorded call all work. 152-FZ is stricter about personal data: under Article 9, consent must be specific, substantive, informed, conscious and unambiguous, and since amendments in 2025 it must be set out separately from any other text the person confirms or signs.

Wording the consent

The law gives no template, so you write your own. It should make clear who is sending, what will arrive, and how to opt out. A workable version for a checkbox under a signup form, in English translation:

I agree to receive promotional and informational emails from Romashka LLC at the email address provided. I can withdraw this consent at any time via the link in any email or by writing to privacy@romashka.ru.

Next to it goes a second, separate checkbox for personal data processing, linked to your privacy policy. A single box for both will not do. They are two consents under two laws, people withdraw them independently, and 152-FZ now explicitly requires the data processing consent to stand apart.

Both boxes start unticked; a pre-ticked box proves very little about what the person chose. Keep a dated copy of the exact wording on the form. In a dispute the fact of signup is half the case; the other half is which text the person agreed to.

Proving consent

If a recipient complains, you have to prove they subscribed; they do not have to prove they never did. Part 1 of Article 18 puts the burden on the sender, and so do Articles 9 and 15 of 152-FZ for personal data.

That means a signup log. At minimum: the address, date and time, source (the form URL), IP address, and the version of the consent text shown at that moment. If the form changes, keep every version. Hold the log for as long as you email the person and for at least a year after the last message, which is the limitation period for advertising offences under Article 4.5 of the Code of Administrative Offences (CoAO).

Double opt-in is not required by law, but it makes proof much easier. A click on the confirmation link shows that the address belongs to whoever signed up and that they wanted the emails.

Opt-out

Three provisions demand an immediate stop on request: Part 1 of Article 18 of 38-FZ, Part 2 of Article 15 of 152-FZ, and Part 3 of Article 10 of Federal Law No. 149-FZ "On Information". The last one obliges anyone sending electronic messages to give recipients a way to refuse them. For email, that is an unsubscribe link in every promotional message that works without logging in, surveys or confirmation steps.

Ten business days is not "immediately", least of all with two more campaigns going out in between. A List-Unsubscribe header with one-click unsubscribe (RFC 8058) lets many mail clients show the option right next to the message.

Fines

A breach of Article 18 falls under Part 1 of Article 14.3 of the CoAO. Fines run from 2,000 to 2,500 rubles for individuals, 4,000 to 20,000 for officials, and 100,000 to 500,000 rubles for legal entities.

Cases usually start with a recipient complaining to the Federal Antimonopoly Service (FAS) with a screenshot of the email. FAS asks the sender for proof of consent, and if there is none, the law treats the email as sent without it. One complaint about one email can be enough.

Is an email address personal data?

152-FZ defines personal data as any information relating directly or indirectly to an identified or identifiable person. A mailbox like ivan.petrov1985@mail.ru points to a specific person and fits that definition. A generic info@company.ru on its own does not, but once your CRM ties it to an employee's name, the whole record becomes personal data.

Sorting a list address by address costs more than treating all of it as personal data from the start. The operator duties follow from there: publish a data processing policy on your site (Article 18.1), notify Roskomnadzor, the data protection regulator, before processing begins (Article 22), and collect a separate processing consent.

149-FZ adds one more rule. Information distributed outside the mass media must carry accurate details of the sender, enough to identify them (Part 2 of Article 10), so anonymous mailings break that law as well. Mailing EU residents brings in GDPR and the national e-marketing rules; mailing the US brings in CAN-SPAM. For the rest of the picture, see our guide to consent and personal data.

Common mistakes

• Bought lists. Buying a list does not transfer anyone's consent. People agreed, if at all, to hear from the seller, not from you.
• Partner mailings. A "we share data with partners" clause in a privacy policy is not consent to partner advertising. Whoever distributes the advertising needs the consent.
• B2B. Article 18 speaks of a subscriber or addressee and makes no exception for company mailboxes. An unsolicited offer to info@company.ru is as much a violation as one sent to a personal inbox. More on this in our cold email guide.
• Existing customers. In the EU, the ePrivacy Directive lets a seller market similar products to past customers as long as they can opt out, the so-called soft opt-in. 38-FZ has no such exception, so even a regular customer needs separate consent to advertising.

Quick checklist

• Mailing consent and data processing consent are separate checkboxes, both unticked by default.
• Every signup is logged automatically: address, time, IP, form URL, consent text version.
• Every promotional email has a one-click unsubscribe and a List-Unsubscribe header.
• Every email names the sender, with the company name and contact details.
• A data processing policy is published on the site and Roskomnadzor has been notified.

List hygiene is not a legal requirement as such: mailing a non-existent address does not breach 38-FZ. Dead addresses do pile up bounces and hurt sender reputation, though, and abandoned mailboxes can end up as spam traps.