In short: On 3 August 2026 Russia's Big Data Association (ABD) sent an appeal to the Ministry of Digital Development asking to let companies process Russians' personal data without their consent — for developing, training and running artificial intelligence. The initiative is backed by Sber, Yandex, VK, HeadHunter, Rostelecom, Avito and about a dozen other firms. The proposal talks about "anonymised" data, but anonymisation can be reversed, and that is exactly what makes it controversial for privacy.
What happened
According to Russian media, the ABD asked the ministry to soften the "On Personal Data" law: to let companies use information about citizens with the help of "privacy-enhancing technologies" (anonymisation, differential privacy and the like) without a separate consent from each person. The stated conditions are a minimal risk of identification, processing on Russian soil by Russian companies, and use strictly for AI purposes. We break down how datasets like this usually work in the LiMP VPN blog.
The timing is what stands out. The law recently moved in the opposite direction: since 1 September 2025 consent to process personal data must be a separate document and can no longer be buried inside a contract or a user agreement. Against that backdrop, big tech's request looks like a step back the other way.
What "anonymised" data really means
Anonymisation strips out obvious identifiers — your name, phone number, exact address — so a record no longer points at you directly. The catch is that it is rarely a one-way door. Researchers have shown for years that "anonymised" datasets can often be re-identified by cross-matching them with other data: a handful of data points about your location, purchases or app usage can be enough to single you out. When many such datasets are pooled to train a model, the combined picture can be far more revealing than any single "anonymised" table looks on its own.
There is a second, subtler risk: models can memorise. Large models trained on personal data have, in documented cases, reproduced fragments of their training data verbatim, meaning fragments of real records can in principle surface in a model's output. "Anonymised at intake" is not the same as "impossible to recover at output."
What it means for your data
If the amendment passes as requested, the default would flip for a large class of processing: instead of asking you first, companies could feed your de-identified data into AI pipelines and you would find out, at best, after the fact. You would keep formal rights, but the practical control — the moment where you say yes or no — would move upstream, out of your hands. For a privacy-minded user the honest takeaway is that you cannot rely on consent screens alone; you have to limit how much data you generate in the first place. That mindset runs through our privacy tools section.
How to shrink your digital footprint
You can't unpublish data you already handed over, but you can reduce what future datasets contain about you:
- Give apps and services the minimum. Every optional field, permission and linked account is one more signal that can end up in a training set later.
- Audit consents and permissions. Revisit what you agreed to; revoke app permissions you don't use and unlink accounts you no longer need.
- Separate identities where you can. Use different emails for different services so your activity is harder to stitch into one profile.
- Protect the network layer. A no-logs LiMP VPN app won't change a company's data policy — that is out of your hands — but it encrypts your traffic on public and untrusted Wi-Fi so intermediaries can't quietly log the sites and services you use, and because of the no-logs policy the VPN itself keeps no record of your activity to hand over or leak.
Keep the layers separate: lawmakers and companies decide the rules for the databases they hold, while good hygiene and a VPN reduce how much you personally expose along the way. For more, see our plans.