Google Analytics ban from July 1, 2025: Fines up to 18 million and migration plan for business
From July 1, 2025, the screws in the field of personal data protection (PD) have been tightened completely. New amendments to Federal Law No. 152-FZ “On Personal Data” came into force, and the courts began to make real, rather than preventive, decisions.
The main blow fell on the corporate sector and e-commerce: the use of foreign trackers like Google Analytics (GA4) and Google Tag Manager (GTM) is now classified as illegal cross-border transfer of personal data.
In this analysis, the NBM-IT web analytics team explains why counters can no longer be “hidden” behind a cookie banner, what fines legal entities face, and how to correctly migrate to legitimate systems.
The essence of the problem: Why GA4 is now illegal in the Russian Federation
Historically, Google Analytics works on the principle of direct collection: script gtag.js is loaded in the user’s browser (located in the Russian Federation) and immediately sends a data packet (IP address, Client ID, User Agent) to Google’s American or European servers.
According to the new edition of 152-FZ (taking into account the current clarifications of Roskomnadzor for 2025), this violates the basic principle primary localization of databases:
“The collection of personal data of citizens of the Russian Federation should initially be carried out using databases located on the territory of the Russian Federation.”
Even if the site does not have registration forms, Roskomnadzor has long recognized the combination “IP address + Cookie ID + geolocation” as personal data, since they allow you to uniquely identify a user on the network.
Price of Risk: Fines 2025
If earlier Roskomnadzor was limited to regulations, now the practice has become strict.
- For primary violation of PD localization: fine for a legal entity from 2,000,000 to 6,000,000 rubles (part 8 art. 13.11 Code of Administrative Offenses of the Russian Federation).
- For repeated violation (if the RKN issued an order to remove the code, but you did not comply with it or simply commented it out): a fine from 6,000,000 to 18,000,000 rubles (part 9 art. 13.11 Code of Administrative Offenses of the Russian Federation).
Sites in the following areas are especially strictly monitored:
- Medicine and clinics.
- E-commerce and online clothing stores.
- Financial and legal services.
- Websites of government contractors and SROs.
Popular misconceptions among marketers
Myth 1: “If we use GTM without Google Analytics, we are safe.”
This is not true. GTM itself is a data parser. GTM script initiates HTTP requests to domains googletagmanager.com, exchanging system tokens. For inspection authorities, the presence of a GTM script in <head> - this is a “red rag”.
Myth 2: “We enabled Server-Side Tagging in Google Analytics.” Yes, you can deploy a GTM container on a Russian Yandex Cloud server, clean data from personal data and send trimmed hits to Google. Technically this is legitimate, but in practice it is extremely difficult to prove to the RKN inspector the subtleties of server routing. Courts often make a decision based on the very fact of the presence of Google domains in the browser's network logs.
Action plan: What to change Google Analytics to
We at NBM-IT have already transferred dozens of clients to Russian and Self-Hosted systems. Here are proven alternatives:
1. Yandex Metrica (Basic scenario)
The absolute leader of the Runet. Servers in the Russian Federation, complete legitimacy.
- Pros: Free, Webvisor, integration with Yandex Direct, e-commerce module.
- Cons: The data is stored by Yandex. Monopoly in the market.
2. Matomo / Piwik PRO (Self-Hosted script)
Ideal for corporations, banks and companies with strict NDA. Matomo is installed on your own VDS server in a Russian data center.
- Pros: 100% control over data (Data Ownership). The interface is as similar as possible to the good old Universal Analytics. No one except you has access to raw logs.
- Cons: Requires server capacity (approximately 4-8 GB of RAM for medium-sized sites) and DevOps skills to configure and update.
3. Roistat / Calltouch (In-depth end-to-end analytics)
Russian systems that cover not only web metrics, but also cohort analysis, ROI, call tracking and integration with 1C/CRM.
Free project cost estimate
Answer 4 questions and we will send you a range of prices to suit your needs.
1. What type of corporate website do you need?
Checklist: How to properly disable the Google ecosystem
Simply removing the script from the site header is not enough. You need to do a full migration:
- Export old data. GA4 will delete the project if you stop using it. Upload key reports to BigQuery (via Russian proxies) or CSV.
- Transfer of UTM markup. Make sure that your campaigns on VKontakte and Direct are not tied to macros that only Google understands.
- Privacy Policy Update. In the document on the website, be sure to remove references to Google LLC and add YANDEX LLC and other current processors.
- Removing authorizations (OAuth). Check whether you have configured user authorization on the site through Google accounts. In some cases, this may also fall under the interpretation of the transfer of personal data.
Conclusion
The ban on Google Analytics is not a temporary technical drawdown, but a new legislative reality of the sovereign Internet. The sooner you transfer your analytics to Russian servers, the more historical data for retargeting you will accumulate in the new system for the high season.
If you need help with a technical site audit, secure transfer of goals, setting up e-commerce in Metrica, or deploying your own Matomo server, please contact NBM-IT engineers.
Free SEO audit of your website
Leave a request and our specialists will find areas of search traffic growth.