Who checks websites for legal compliance: Kazakhstan, Russia, Belarus, the EU, the USA

Why “nobody gets fined” only looks true

Almost everywhere website oversight works the same way: the regulator does not crawl sites itself but reacts to a customer complaint, a data leak, a competitor’s letter or material from another authority. So fines are few while the risk stays: it arrives not on a schedule but on the day someone complains.

Kazakhstan

• Authority: the Information Security Committee of the Ministry of Digital Development. It runs unscheduled checks on citizens’ complaints and other bodies’ material and handles cases under Art. 79 of the Administrative Code.
• Scale: since the start of 2024 about 11 checks, 23 cases and KZT 4.9M in fines nationwide (Digital Rights Center data; the exact period is not stated).
• Art. 79 amounts after the 10.01.2025 amendments: illegal collection and processing of data 60 MCI for small business up to 200 for large, failure to protect data 300–600 MCI, up to 2,000 if data leaked as a result.
• Consumer rights: complaints go to the Consumer Protection Committee via eOtinish, after a claim to the seller first.
• Tightening is planned: higher fines and criminal liability for mass leaks. Follow the news, these are still proposals.

Russia

• Authority: Roskomnadzor. Scheduled checks are rare (moratorium and risk categories) but unscheduled ones returned on 1 January 2025: on complaints, leaks and risk indicators.
• Since 30 May 2025 a new edition of Art. 13.11 of the Administrative Code applies (Law No. 420-FZ): higher fines, separate offences for leaks and turnover-based fines for repeats.
• Lawyers’ reviews say that since 1 July 2025 collecting Russians’ personal data using foreign databases is banned (localisation has applied since 2015). Besides a fine the site can be blocked under Law No. 149-FZ.
• Amounts and details change often, so check them against the code’s text before quoting.

Belarus

• Authority: the National Personal Data Protection Center. Scheduled checks follow a plan published in advance, unscheduled ones follow citizens’ complaints.
• Liability under Art. 23.7 of the Administrative Code since 1 March 2021. Check the amounts and offender categories against the law’s text.

European Union

• Each country’s data protection authority supervises: after complaints and on its own initiative.
• Cookies: in September 2025 France’s CNIL fined Google €325M and Shein €150M for cookies without consent and for making refusal harder than acceptance.
• Private claims: in 2022 a Munich court awarded a visitor €100 over Google Fonts loaded from Google’s servers, followed by a wave of letters demanding €100–170 from site owners.

United States

• No general data law. State laws and the FTC apply. In California the attorney general and the CPPA agency bring the cases.
• Examples: Sephora $1.2M (2022, ignored opt-out signals), DoorDash $375,000 (2024), Honda $632,500 (2025), Todd Snyder $345,178 (2025, misconfigured privacy portal and cookies).
• Accessibility: trackers count roughly 3,100 to 4,600 federal lawsuits over inaccessible websites in 2025, and over 5,000 with state courts.

What follows

Where oversight runs on complaints the real risks are an unhappy customer’s complaint, a leak, a competitor’s claim, a lawyer’s letter. Where oversight is active (EU, US, Russia) fines and lawsuits are already reality. Fixing the site early is cheaper than reacting to a complaint and protects your reputation. An Awe Check scan shows where your site is exposed.

Frequently asked

Sources

• Центр цифровых прав: проверки и штрафы по персональным данным в Казахстане с 2024 года
• CNIL: штраф Google на 325 млн € за cookies и рекламу
• CPPA: Honda, первое дело по CCPA