What can and cannot be tracked in Russia

An important caveat. This is a review for a technical and managerial decision, not legal advice. The norms in this area changed in 2024 and 2025 and continue to change; the amounts of fines in open sources are given with discrepancies. All specific figures and formulations should be checked with the current versions of the documents before use, and decisions on legal grounds should be coordinated with a lawyer. Where the range or reservation "according to secondary sources" is indicated below, this means exactly what it says: the original source needs to be opened.

The test does not start with the sensors. It starts with three questions: on what basis do you process the data, have you filed a notification, and what exactly do you collect. If there are clear answers to these questions, the rest is details. If not, the most technically accurate system becomes a source of risk that is not comparable to its cost.

When movement data becomes personal

The definition in the law is broad: personal data is any information relating directly or indirectly to a specific or identifiable natural person. The keyword is defined. Not "is there a full name in the database", but "is it possible to understand from this data, including in conjunction with others, which person we are talking about".

Let's look at the technology.

The number of people in the room. "There are forty people in the zone now," "1200 have passed in a day." Personal data is not: there is no subject, there is no definiteness. The quietest mode, and that's why counters and sensors without an image are the best start for any object.

A cloud of radar points. Presence and position without the ability to restore the appearance. As a general rule, this is also not personal data. With two caveats: if there is one person in the room and it is known who went there, anonymity is conditional; and if the data is compared with the shift schedule or with the mark of the bracelet, definiteness appears.

Bracelet number. By itself, it is an impersonal identifier. In conjunction with the contract, subscription, phone, full name — personal data, and the entire history of movements of this bracelet.

The MAC address of the device. A controversial category. The regulator's position as a whole boils down to definiteness: unique device identifiers can relate to personal data if they allow identifying the user, and even more so in combination with geolocation and other information. Judicial practice is heterogeneous. The practical conclusion for the project is not to build an architecture on the assumption that the MAC address is not personal data - this is a position that will have to be defended. For more information, see the article about Wi-Fi, which also discusses the requirement to identify users of public networks.

Silhouette in the video. Here is the most important watershed of the whole topic, and it is explained by the regulator. In the explanations of Roskomnadzor on the issues of attributing photo and video images to biometric personal data, the logic is as follows: the image becomes biometric personal data when the operator uses it to establish identity. In other words:

• the camera counts silhouettes, images are not matched with a database of faces, identity is not established — this is the processing of personal data (a person's record), but not biometrics;
• the same camera compares the face with the database to find out who it is — biometrics with all the ensuing requirements.

This difference changes the scope of responsibilities by an order of magnitude, and that is why it should be spelled out explicitly in the terms of reference: "face recognition does not apply."

Depersonalization. Legally impersonal data are those for which it is impossible to identify the subject without additional information. Hence the main practical conclusion: "we do not store the full name" does not prove anything if there is a table linking the bracelet number with the contract. The real depersonalization is breaking the connection, not storing it in another table. The engineering side is discussed in the article about data.

Summary table of modes

What are you collecting	Personal data	Biometrics	Basic responsibilities
Number of people, employment zones	I don't	I don't	Minimal
A cloud of radar points without a link	As a rule, no	I don't	Minimum, informing on ethics
Video with counting silhouettes	Yes	I don't	Basis, notification, policy, information, timing
Video with face recognition	Yes	Yes	Special mode, see below
Bracelet events without face binding	No with real depersonalization	I don't	Minimal
Bracelet events linked to the agreement	Yes	I don't	Full set of operator responsibilities
MAC addresses of devices	Debatable, rather yes	I don't	Full set, plus requirements for public networks
Guest Application Data	Yes	I don't	Consent, policy, mailing rules
Tracking employees	Yes	Depends on the method	Plus the requirements of labor legislation

152-FZ on steps for an object with visitors

1. Processing base

Processing is allowed if there is one of the legal grounds. For an object with guests, four are practically significant.

Contract. The most natural basis for credentials: you provide a service, for this you need a tariff, visit time, additional payments. Important: the basis of the "contract" covers what is necessary for the execution of the contract, and does not cover everything that is technically possible to collect. Behavior analytics and marketing usually do not fall under it.

Consent. It is required where processing is not needed for the service: marketing, profiling, publishing images, in many cases — biometrics. Consent must be specific, informed and conscious; "consent to everything" in the rules of the visit is not such.

Legitimate interest of the operator. It is used for video surveillance for the safety and security of property, but this reason requires correlating your interest with the rights of the guest and does not work where the guest's interest obviously outweighs. That is why they cannot justify cameras in the locker room: surveillance there is not required to provide a service and disproportionately interferes with privacy.

Protection of life and health. A narrow basis applicable to specific situations, and not to constant observation "just in case".

Practical advice: for each subsystem, write out the basis separately. Turnstile and ticket office — contract. Video surveillance in the lobby is a legitimate interest. Mailing offers — consent. Face recognition is a separate conversation. This one-page tablet is the first document of the project.

2. Notification of Roskomnadzor

The notification is submitted before the start of processing. According to legal reviews, after the changes that came into force on May 30, 2025, the previous exceptions have been significantly narrowed, and almost all operators, including employers and owners of websites with forms, are required to notify. The notification form was approved by the order of Roskomnadzor (according to secondary sources — Order No. 180 dated 10/28/2022), submitted through the regulator's personal data portal, inclusion in the register takes place within about thirty days.

What this means for our project: video surveillance and visitor accounting systems are the processing of personal data that needs to be notified, indicating the categories of data and categories of subjects. If you run biometrics, this is indicated separately, and the regulator's attention to such operators is noticeably higher.

3. Processing policy and local documents

We need: a policy regarding the processing of personal data (published, including on the website), a list of processed data and purposes, an order appointing a responsible person, a list of persons with access, a threat model and security measures, logs. For an item with users, visit rules are added with an information block about monitoring and data processing.

4. Shelf life and disposal

The data is stored no longer than necessary for the stated purpose. For tracking systems, this means that the deadline must be justified: events — as long as necessary for calculations and claims; video — according to the regulations; analytics — in an impersonal form. "We keep everything forever, suddenly we need it" is a direct violation of the principle.

5. Rights of the subject

The guest has the right to find out what data is being processed about him, to request clarification, blocking or destruction, to withdraw consent. The system should technically allow you to find and delete everything one person at a time. If this is not possible without destroying the reporting, the architecture is designed incorrectly — see the article about data.

6. Assignment of processing to the contractor

If an integrator or cloud service processes data on your behalf, it must be formalized: goals, list of actions, obligation to respect confidentiality and security requirements, responsibility. You remain the operator — both in front of the guest and in front of the regulator. Hence the practical requirement for the contract with the contractor: a section on the processing of personal data, and not just the specification of equipment.

7. Data placement and foreign services

If the system stores data in a foreign cloud, two questions arise at once: the requirements for hosting data of Russian citizens and the rules for cross-border transfer. For video analytics and positioning systems, this is a practical matter of choosing a supplier: a cloud platform with servers abroad may not be applicable regardless of its quality. You need to check before purchasing.

Video surveillance: where it is possible and where it is absolutely impossible

Informing. The guest should know about the observation before he got into the frame: signs at the entrance and in the zones, mention in the rules of the visit, information in the policy. Covert surveillance in public areas of the facility is a separate and much more difficult story.

Image of a citizen. In addition to the legislation on personal data, Article 152.1 of the Civil Code applies: the use of a citizen's image (for example, in advertising materials of an object) requires his consent. This is a separate issue from the observation itself, and they forget about it when the frame from the camera gets into the presentation or social networks of the object.

Where it is impossible. Changing rooms, showers, toilets, baths and steam rooms are areas where a person has the right to expect complete privacy. The legal discussions on this issue are unanimous: the observation there cannot be justified either by the execution of the contract or by the protection of property, because it is not required to provide the service. An attempt to close thefts in the locker room with cameras is a classic mistake that turns a problem of tens of thousands of rubles into a risk of orders of magnitude more.

What to put instead. Sensors that do not form images are radars, time—of-flight sensors, thermal matrices. They give presence, number, and even posture (and hence fall detection) without an image of a person. This is a legal and technically mature way; add to it electronic locks and a deposit policy — and the task of safety is solved without cameras.

Archive. The retention period of records, the list of persons with access, the procedure for issuing records on request, and the procedure for storing materials on incidents should be described in a document. The recording of the incident is proof, and the requirements for it are higher than for a routine archive.

Biometrics: the toughest mode in the topic

This is the section where most objects don't need facial recognition.

General mode. Biometric personal data is a special category, the processing of which, as a general rule, requires separate written consent and enhanced protection measures. How to determine whether your video is biometrics is discussed above: criterion — use to establish identity.

572-FZ and the unified biometric system. A separate law established a fundamentally different architecture. According to the analysis of legal and industry sources:

• identification ("who is it") is allowed through the state unified biometric system;
• authentication ("is it the one") — through the EBS or through an accredited system of the organization that interacts with the EBS;
• organizations' storage of their own biometric databases for identification and authentication purposes outside the EBS is limited;
• a commercial organization works through integration with the EBS if it is accredited by an authorized body;
• it is impossible to force the surrender of biometrics, and a person's refusal, as a general rule, is not a reason to refuse him a service.;
• Cross-border transfer of biometrics during identification and authentication is not allowed.

All of these provisions are a retelling of secondary sources; before designing any system on persons, you need to read the law and by—laws and, most likely, involve a lawyer specializing in this.

What follows from this practically.

The face—to-face access system at the facility is a project that requires a separate legal study, and not a position in the specification next to the turnstile. For a fitness club or a thermal spa complex, this is rarely justified: a bracelet and a card solve the same problem in an incomparably simpler mode.

The module "counting unique visitors" in video analytics is the same mine that was mentioned in the article about video. Technically, it is often implemented on face recognition: in order not to count a person twice, you need to recognize him. So, in the Macroscop documentation, the corresponding module is described as working on the basis of face recognition, with the ability to exclude faces from the database (for example, employees) from counting. An innocent item in a commercial offer may turn out to be the most binding part of the project.

What to do instead. If you need unique visitors and repeat visits, this is the task of the loyalty program: the guest presents the card, bracelet, or code himself, and you count the identifiers, not the faces. If you need a stream — read impersonally.

Responsibility. According to secondary sources, the highest administrative sanctions are provided for violations in terms of biometrics among the personal data trains. The specific amounts in the reviews differ, and it is incorrect to quote them without checking with the current edition of the Administrative Code — check.

Employee tracking: Another law

Same technology, different legal framework.

The Labor Code (chapter on the protection of personal data of an employee, articles 86-90) establishes the procedure for processing employee data: the goals must be related to labor relations, the employee must be familiar with the documents defining such an order, the amount of data is not more than necessary.

A practical minimum for a personnel tracking project:

1. A local regulatory act with a description of: what is controlled, by what means, in which zones, for what purpose, who has access to the data, how much is stored.
2. Familiarization of employees under the signature, and in some cases — consent.
3. Proportionality. Process control (time on the site, presence in the danger zone) is different from tracking a person. The closer to the second, the higher the risk of a dispute.
4. Excluded zones. Rest rooms, changing rooms, bathrooms are not controlled, as well as for guests.
5. A separate solution for security monitoring. The alarm button and the control of a person in a single shift are perceived by the team differently than the production accounting — and they should be issued separately, precisely as a means of labor protection.

Judicial practice on the control of employees is replenished, and positions are changing. Before launching, you should look at the latest cases in your region.

Responsibility: what has changed in 2024-2025

Two changes, due to which the topic ceased to be formal.

Administrative responsibility. According to legal reviews, Federal Law No. 420-FZ amended Article 13.11 of the Administrative Code from May 30, 2025: leaks of personal data are separated into separate structures, large fixed fines and a turnover fine for repeated violation have been introduced. Landmarks that are repeated in several reviews:

• data leakage from 1,000 to 10,000 subjects — about 3-5 million rubles for a legal entity;
• data leakage of more than 100,000 subjects — about 10-15 million rubles;
• repeated leakage — from 1 to 3% of annual revenue, but not less than 20 million and not more than 500 million rubles.

According to the "usual" compositions (processing without grounds, lack of notification, non-compliance with requirements), the amounts in the reviews differ significantly, so they are not given here: see the current version.

Criminal liability. Federal Law No. 421-FZ of 11/30/2024 introduced Article 272.1 of the Criminal Code — on the illegal use, transfer, collection and storage of computer information containing personal data. According to the analysis, the punishment in heavy trains reaches imprisonment for long terms, and the qualifying features are, in particular, data of minors, special categories of data and biometrics. According to the Ministry of Internal Affairs, cited in the industry press, in January — October 2025, the article was applied more than nine hundred times, including to employees of organizations that had access to databases.

What follows from this for a tracking project. The main risk is not a penalty for an unanswered notification, but a leak. A system that collects guest routes linked to their phones and contracts creates an attractive array. Hence, there are three practical conclusions: collect the minimum necessary, depersonalize as early as possible, restrict access and log it. These are not legal, but engineering measures — and they also reduce the legal risk more than any document.

Artificial intelligence: what is regulated in Russia

A separate section, because the question is asked constantly.

There is no analogue of the European regulation on artificial intelligence in Russia. There are no prohibited practices listed in the law, there is no classification of systems by risk level, there are no requirements for conformity assessment for video analytics systems as such.

What is there:

• national strategy for the development of artificial intelligence, setting the framework for public policy;
• the mechanism of experimental legal regimes under which individual projects receive special conditions;
• code of ethics in the field of artificial intelligence — a document of voluntary accession;
• standards (GOSTs) on certain aspects, which are mainly advisory in nature;
• general legislation that is fully applied: on personal data, on consumer protection, labor, civil.

The main practical consequence: the responsibility lies with the operator. If the detection system missed an event or raised a false alarm, the object is responsible, not the model developer. The supplier of the model is responsible to you within the framework of the contract — and that's exactly why the content of the contract is more important than having a certificate. What exactly to record is discussed in the article about critical events.

The second consequence: explainability of the solution becomes your problem. If, based on the data of the system, you refused a guest a service, filed a claim or brought an employee to justice, you need to explain what the decision is based on. "This is how the neural network showed it" is an unacceptable argument in a dispute. Hence the requirement for the system: to store not only the output, but also the base — frame, event, timestamp, model version.

Radio frequencies and equipment

The part that is remembered after the purchase.

Short-range devices. The general framework is the decision of the State Emergency Committee No. 07-20-03-001 of 07.05.2007 "On the allocation of radio frequency bands to short—range devices" with appendices. The fundamental point is that the use of the bands specified in the applications is carried out without registration of separate decisions of the State Radio Frequency Committee and permissions to use radio frequencies for each specific user — subject to the conditions of the application.

Ultra-Wideband devices (UWB). The decision of the SCRC No. 09-05-02 dated 12/15/2009, issued as Appendix No. 16 to the above decision: band 2.85–10.6 GHz, a UWB device is a device with a channel width of at least 500 MHz. In the conditions of use, according to publications reproducing the text of the application, there are restrictions — in particular, the prohibition of use on board aircraft during climb and descent and at airport cargo terminals.

RFID band UHF. In Russia, the working band is 866-868 MHz, the conditions depend on the power: according to the text of the decision, up to 100 MW is allowed in the band 866.6–867.4 MHz without assigning radio frequencies when using the "listen before transmission" mode, for more powerful readers, assignment is required in the prescribed manner. Hence the main purchase warning: the equipment in the version for the USA and Canada works in the band 902-928 MHz and is not applicable in Russia; the European version is needed.

Bluetooth and Wi-Fi. The 2.4 and 5 GHz bands are massive, the use, subject to power restrictions, does not require individual permissions.

Confirmation of compliance. The equipment must have documents of compliance with the requirements of the EAEU. This is not only a formal issue: during the inspection or during the investigation of the incident, the lack of documents for radio equipment is a separate problem.

What to do before purchasing: request from the supplier in writing the working bands and capacities of specific models, compliance documents, and confirmation that your application does not require frequency assignment or registration of electronic means. It is mandatory to check the current editions of the SCRC decisions: documents have changed, and there are discrepancies in open publications.

Technology, mode, documents

Technology	Legal regime	What to issue
Counters, presence sensors without an image	As a rule, outside of personal data	Ethics information; compliance documents
RFID wristband, impersonal analytics	Personal data in the accounting loop	Basis (contract), notification, policy, terms, depersonalization of analytics
Bluetooth tags	As above	The same; check the capacity of the equipment
UWB	As above	The same plus checking the bands on the GKRCH
Wi-Fi, connected clients	Personal data	Requirements for public networks, user identification, notification
Wi-Fi, service request collection	Controversial and binding	Separate legal assessment before implementation
Video, counting silhouettes	Personal data, not biometrics	Foundation, information, signage, archive dates, entry "face recognition does not apply"
Video with face recognition	Biometrics, special mode	Separate study, consent, the issue of EBS and accreditation
Guest Application	Personal data, consent	In-app policy, mailing rules
Personnel tracking	Personal data plus labor law	Local act, familiarization, proportionality

Checklist "starting tracking legally"

1. We wrote out the goals for each subsystem and the processing basis for each.
2. We checked that no subsystem collects more than it needs for its purpose.
3. Submitted a notification to Roskomnadzor before the start of processing, with the correct categories of data and subjects.
4. Published the processing policy and updated the rules of the visit.
5. Appointed a person responsible for the organization of processing, identified a list of persons with access.
6. Installed information signs about video surveillance at the entrance and in the surveillance areas.
7. We made sure that there are no cameras and there will be no cameras in locker rooms, showers, bathrooms, baths and steam rooms.
8. We wrote down in the terms of reference whether face recognition is used — and if not, we recorded it explicitly.
9. We have defined the retention periods for each type of data and configured automatic deletion and depersonalization.
10. We checked that the system is able to find and delete data at the request of the subject.
11. We issued a processing order to the contractor and the cloud service, checked where the data is physically stored.
12. For the staff: a local act was issued and the employees were familiarized.
13. We checked the radio frequency part: bands, power, compliance documents, the need for frequency assignment.
14. We have drawn up the rules of access to the video archive and the procedure for working with incident records.
15. They described how the decision made with the participation of automation is explained, and what is saved in the log.

Sources

Sources

• Explanations of Roskomnadzor on the attribution of photo and video images to biometric personal data - a criterion for establishing identity
• Roskomnadzor: requirements for public Wi-Fi networks — identification of users and equipment
• GKRCH Solution No. 07-20-03-001 with applications (Garant), revision to CNTD — bands for short-range devices, UWB-devices, RFID
• Reviews of amendments to Article 13.11 of the Administrative Code from 05/30/2025, table of compositions — guidelines for amounts (secondary sources, check with the current edition)
• Analysis of Article 272.1 of the Criminal Code of the Russian Federation and application practices, composition analysis
• The procedure for submitting a notification to Roskomnadzor — form, deadlines, registry (secondary source)
• Macroscop: The unique visitor counting module is an example of a facial recognition function
• ConsultantPlus: a selection of materials about the MAC address as personal data