Yandex collects an extensive range of personal data — including name, phone number, address, IP address, device information, search history, geolocation, and financial information — and operates under Russian jurisdiction, meaning it can be legally compelled to share user data with Russian government authorities. Independent security assessments have also flagged specific technical weaknesses. Here’s what’s documented, without speculation.
What Data Yandex Collects
According to privacy assessments of Yandex’s own disclosed practices, the company collects a wide range of personal information: name, mobile phone number, address, age, IP address, browser and device information, usage data, search history, geolocation, and financial information. A 2023 source code leak reportedly revealed further detail on how this data feeds into profiling and advertising.
Jurisdiction and Government Access
As a Russia-based company, Yandex operates under Russian law, which can require it to share user data with government authorities upon request. This is a structural jurisdictional fact, not a specific allegation of misuse — but it’s the same reasoning that applies to any company: the laws of the country where it’s legally based determine what it can be compelled to disclose. Yandex NV has separated its Russian and international operations, though the core search product remains tied to Russian jurisdiction.
Independent Security Findings
Cybersecurity firm UpGuard scored Yandex 690 out of 950 in one assessment, citing weaknesses including insufficient enforcement of HTTP Strict Transport Security (HSTS) and the use of outdated SSL/TLS versions in places. Separately, Terms of Service; Didn’t Read (a project that reviews and grades privacy policies) assigned Yandex its lowest possible grade, “E,” specifically flagging that the service can view browser history and shares personal data with third parties. A 2023 breach also reportedly exposed data from roughly 58,000 users of the Yandex.Eda food delivery app — a different product than the core search engine, but run by the same company.
| Category | Documented Finding |
|---|---|
| Data collected | Name, phone, address, IP, device info, search history, geolocation, financial data |
| Jurisdiction | Russia; subject to Russian government data-access laws |
| Security assessment (UpGuard) | 690/950, citing HSTS and outdated TLS issues |
| Privacy policy grade (ToS;DR) | Grade E (lowest), citing browser history visibility and third-party data sharing |
| Related incident | 2023 breach exposed ~58,000 users of the Yandex.Eda app |
Should You Use Yandex?
If minimizing data collection and third-party sharing is your priority, the documented facts above put Yandex well outside what would qualify as a privacy-focused choice by the standards used throughout this site — see our private search engine checklist for the criteria. Yandex may still be relevant for specific use cases, such as searching Russian-language content it indexes particularly well, but that’s a different consideration from privacy, and worth treating separately.
Frequently Asked Questions
Does Yandex track user search history?
Yes, according to privacy assessments and Yandex’s own disclosed data practices, search history is among the categories of personal data collected.
Can the Russian government access Yandex’s user data?
As a company operating under Russian jurisdiction, Yandex can be legally compelled to share user data with Russian government authorities upon request, the same way any company is bound by the laws of the country where it’s legally based.
What privacy grade did Yandex receive from independent reviewers?
Terms of Service; Didn’t Read assigned Yandex its lowest grade, “E,” citing that the service can view browser history and shares personal data with third parties.
Has Yandex had any data breaches?
A 2023 breach reportedly exposed data from approximately 58,000 users of the Yandex.Eda food delivery app, a separate product from the core Yandex search engine but operated by the same company.
Is Yandex good for anything specific?
It’s known for strong coverage of Russian-language content and the Russian web specifically, which is a separate consideration from its privacy practices and worth weighing independently.
