Russia Moves Hotel Check-In Into Its State Messenger and Opens Digital ID to 14-Year-Olds

From 1 September 2026, Russian hotels with more than 50 rooms must be able to check a guest in through Max, the state-backed national messenger, using its Digital ID. In the same weeks, the Digital ID was opened to teenagers from the age of 14. Taken separately, each step is an administrative convenience. Taken together, they move a state messenger from something you are encouraged to install to something you meet at a hotel desk and hand to a fourteen-year-old.

What actually changes on 1 September

The obligation falls on hotels, not on guests, and this distinction is worth stating plainly because it is often reported the other way round. A property with more than 50 rooms must be able to register a guest who arrives without a physical passport, foreign passport or driving licence, using the Digital ID in Max. Guests who bring their documents keep the paper route, and the choice remains theirs. Smaller hotels, hostels and holiday bases with fewer than 50 rooms have until 1 September 2028.

Mechanically it is straightforward. The guest creates a Digital ID inside Max, with identity and photo confirmed through Gosuslugi, the state services portal. At the desk they open the passport tab, tap to present, and the app generates a one-time QR code. Staff scan it, and the registration form fills itself from state information systems rather than from a clerk typing. VK, which operates Max, expects several thousand hotels to be connected within a year.

What the Digital ID actually holds

This is the part that deserves attention, because the convenience and the concern come from the same design. The identifier carries full name, date of birth, passport data, taxpayer number, social insurance number, registered address and biometric data. Disclosure is described as selective: what the other side receives is supposed to depend on the situation in which the code is presented.

Selective disclosure is genuinely better than handing over a passport that shows everything at once. It is also a promise about software behaviour rather than a property you can verify from the outside. The guest sees a QR code, not a list of the fields that travelled.

Now open to 14-year-olds

The second change lowers the age. Russians from 14 can now create a Digital ID and use it, for example, to claim youth benefits in cultural institutions and on public transport. That is a real convenience for a teenager who would otherwise carry documents around. It also means a state-run identity credential becomes normal several years before adulthood, and it arrives on top of the age-checking system Max already runs: more than a million age verifications have been performed through the app across some 70,000 stores belonging to 18 of the largest retailers. We looked at the direction of travel earlier in Russia's age verification plan and what it means for anonymity.

Why this matters outside Russia

Digital identity in a phone app is not a Russian invention and not a Russian peculiarity. The European Union is building its own wallet, the United Kingdom is moving the same way, and app-based ID is arriving across Asia and the Gulf. The question every one of these projects has to answer is the same: is the credential a document you present, or a channel that reports back.

That is where the Russian case is instructive rather than exotic, because the same app has both roles. Max is the identity credential, and it is also the messenger that Russian regulators want reporting on network behaviour, as we described when Russian apps began detecting VPN use and the state asked for the data. Distribution shows the same doubling: Max was removed from Google Play under EU sanctions, which pushes installation onto channels the state controls. An identity system and a behavioural reporting system living in one application is the part worth watching, wherever it happens.

Which points at the honest limit of any privacy tool in this scenario. Encryption and address masking protect the channel. They do not protect an identity you have voluntarily bound to a service, and they cannot unlink a credential you presented in person. For readers in countries rolling out digital ID, the useful habit is boring and practical: know which fields a credential can release, prefer the paper route where it stays available, and treat any app that combines identity with messaging as two systems, not one.

Conclusion