Legal and technical requirements for the use of videos on Russian websites

Videos on a website are not just a way to explain a product or talk about a company. It may be related to the processing of personal data and the public publication of materials. These actions are regulated by law and require attention from website owners, marketers, HR teams, and developers. To avoid mistakes, it is important to understand which requirements apply in Russia and which scenarios are considered legally significant.

Personal information and videos

In Russia, the processing of personal data is regulated by Federal Law No. 152-FZ "On Personal Data". Personal data refers to information that can be used to identify a person. Videos fall under this rule if they allow you to identify a person by their image or voice.

If interviews, reviews, demonstrations of employees or customers are posted on the site, publication requires the consent of the data subject. Consent is given prior to posting and must be informed and unambiguous. When the subject applies, the data must be deleted or access to it must be terminated.

Videos and Forms: where legal liability appears

By itself, playing a video on a website does not create legal obligations under 152-FZ. The question arises when, after or with the video, a person leaves contacts, asks a question, submits an application, sends a resume, or files an appeal. These actions are considered personal data processing and require:

• availability of a personal data processing policy;
• obtaining consent;
• correct data storage;
• respect for the rights of subjects.

These are the scenarios found in marketing, hiring, customer support, and training.

Biometric data

Videos and photos may refer to biometric data. The law treats this category strictly: if a person's face or voice allows identification of a person, a separate consent is required. This is especially true for HR materials, corporate videos, and company public pages.

Cookies and analytics

There is no separate cookie law in Russia. If cookies are used only for technical purposes, no consent is required. However, if cookies or analytics are associated with user identification, this is considered personal data processing. Then the requirements are the same: policy, consent, and correct data processing.

Video tools that record views, screenings, and clicks can also collect data related to the user. If this data allows identification or is related to a form, personal data standards apply.

Content rights

The public posting of video materials is regulated by copyright. The site owners must have the rights to:

• the video itself;
• music and audio;
• images of objects;
• fragments of other people's works;
• logos and trademarks.

This is important for companies that use user-generated content, live interviews, and presentation videos.

Auto-play and technical limitations

There is no requirement in Russian law prohibiting autoplay videos. But browsers limit this functionality technically: auto-play with sound is often blocked. Therefore, sites use auto-start without sound or launch by user action. This affects the UX, but it does not create legal risks in itself.

Data storage and localization

The Law on Personal Data requires that the primary processing of personal data of citizens of the Russian Federation take place on the territory of Russia. This applies to any services that collect applications, feedback, resumes, and feedback. If the site works through external forms or CRM, it is important to make sure that the processing and storage of personal data meet the requirements.

What role does QForm play in the legal part?

The complexity of 152-FZ lies in the obligation of the PD operator to notify Roskomnadzor and comply with processing procedures. This applies to most sites that use feedback forms, applications, resumes, or feedback collection, even if the site itself is not engaged in sales.

The site owner does not have to become an operator. You can use a service that is already listed in the register of operators and performs data processing functions in accordance with the law. QForm is included in the Roskomnadzor registry as a personal data operator. This means that:

• the collection, processing and storage of personal data are carried out within the framework of 152-FZ;
• the data is technically and organizationally protected;
• the responsibility for processing formally lies with the operator;
• The service user does not need to notify Roskomnadzor on their own.

This approach makes it easier to work with the legal part. The site can use video images with forms, HR pages, marketing requests, or customer requests without registering as an operator.

Video + form: an example of a bundle

The video widget explains the meaning and shows the scenario. The form after the video captures the action: response, application, consultation request, resume, comment or task. It is the form that creates the legal part of the process. When using QForm, this zone is closed by the personal data operator.

Result

The use of videos on the site is subject to legal and technical requirements if, after viewing, the user interacts with the form, submits data, or becomes identified. In Russia, this is regulated by 152-FZ and the practice of Roskomnadzor. QForm covers part of the obligations due to the status of a personal data operator, which simplifies the work of website owners, agencies, HR teams and product services.