Yandex.Metrica

What is Yandex.Metrica

Yandex.Metrica is a free web analytics platform operated by Yandex LLC, the largest Russian search and technology company. It offers traffic analytics, conversion tracking, heatmaps, click maps, scroll maps, form analytics, and full session replays. Functionally it is closer to Google Analytics combined with Hotjar in a single product.

On a website, Yandex.Metrica is deployed via a JavaScript tag served from mc.yandex.ru. All data flows back to Yandex servers in the Russian Federation, primarily in Moscow region data centers.

What data does Yandex.Metrica collect

Yandex.Metrica processes the visitor IP, browser User Agent, screen resolution, current page URL, referrer, click and scroll positions, time on page, form interactions, and (when session replay is enabled) full DOM mutations reconstructing the page state. Custom events and ecommerce parameters can also be transmitted.

Cookies set on yandex.ru and the publisher domain include _ym_uid (visitor ID, 1 year), _ym_d (first visit date, 1 year), _ym_isad (ad block detection, 1 day), _ym_visorc_<counter id> (session reconstruction, 30 minutes), and yabs sid (advertising session). None of these are strictly necessary.

GDPR and Schrems II

Russia has no European Commission adequacy decision. EU to Russia transfers therefore require SCCs plus a Transfer Impact Assessment. The TIA must consider Russian Federal Law N 152 FZ on personal data localisation, FSB and other state access rights under SORM, and the lack of effective judicial remedy for EU data subjects in Russian courts. After the CJEU Schrems II ruling, this analysis is hard to conclude favourably.

Several EU DPAs and lawyers have effectively recommended against using Yandex.Metrica for EU traffic since 2022, citing both Schrems II and the EU sanctions context. For comparison, the CNIL, the Austrian DPA, and the Italian Garante issued formal warnings against Google Analytics for similar transfer concerns, and Yandex.Metrica presents a stronger case for prohibition.

Sanctions and reputational risk

Since 2022, the EU sanctions framework against Russia (Council Regulation 833/2014 as amended) has restricted various commercial dealings with Russian entities and certain Russian state owned media. Yandex itself has come under scrutiny and Yandex N.V. (the former Dutch holding) was forced to divest its Russian business. The Russian operating entity Yandex LLC is now ring fenced from the international Nebius group, but data processing for Yandex.Metrica still happens in Russia.

In addition to legal compliance, EU controllers face reputational risk by sending visitor data to a Russian processor in the current geopolitical environment.

Practical recommendations

For most EU controllers, the practical recommendation is to migrate away from Yandex.Metrica to a GDPR friendly alternative such as Matomo (self hosted or EU cloud), Piwik PRO (Germany), Plausible (Estonia), Fathom (Canada with EU adequacy), or Simple Analytics (Netherlands).

If you must keep Yandex.Metrica (for example to track a Russian language website targeting Russian users), strictly geofence the tag so that it only loads for visitors clearly outside the EU, sign the most recent Yandex DPA, capture explicit consent in any remaining EU traffic, and document the residual risk in the DPIA.

Compliance checklist

Document why Yandex.Metrica is necessary and why no EU alternative is acceptable. Sign the Yandex DPA and SCCs. Conduct and document a thorough TIA that explicitly addresses Russian Federal Law N 152 FZ, SORM, and the absence of effective EU data subject remedies. Defer the tag until explicit consent. List Yandex LLC as a processor in your privacy notice with the Russian transfer flag prominently.

Monitor EU DPA guidance and sanctions updates regularly. Be ready to migrate quickly if a DPA issues a formal warning against Yandex.Metrica similar to past Google Analytics decisions.