KIEV, Ukraine — Russia is closer than ever to all-encompassing China-style control of the internet after parliament passed a law on Friday that severely restricts users' access to sites outside the Kremlin's reach.

Under the law, every site that collects Russian citizens' personal data will be forced to store that data on servers located in Russia starting in September 2016, or face being placed on a blacklist. Though the bill is ostensibly aimed at protecting Russians vulnerable to sweeping Western intelligence gathering, it gives the Kremlin the de facto authority to ban virtually any website not under its legal control.

Long the country's freest platform for political expression, the internet has attracted particular suspicion and scorn from the Kremlin since activists organized huge protests against President Vladimir Putin in 2011. Putin said in April that the internet "was and remains a CIA project" and has signed a number of laws in recent months giving the Kremlin greater control over it. Websites that challenged the Russian line on the Ukrainian crisis have been banned without a court order. Bloggers with more than 3,000 followers will be required to register with the government. Liking or retweeting something prosecutors deem "extremist" is now punishable by up to five years in prison.

Most of the law details the construction of a large new blacklist that the state communications watchdog, Roskomnadzor, will use against websites that do not give Russia access to its citizens' data. Since Russian law defines personal data as essentially any piece of information about anyone, the new regulations could potentially be used against everything from social networks to airline and hotel booking sites. Vadim Dengin, the bill's co-author, says the restrictions even extend to photographs.

Analysts say the bill's real targets, however, are large foreign internet companies that have been reluctant to comply with recent Kremlin efforts to get them to hand over data to Russian authorities and block sites on request. Recent amendments to Russia's anti-terrorism laws require foreign social networks and messaging services to make metadata — information on when and how users send messages, though not their content — on Russian servers accessible to Russian secret services for six months.

"The main goal is to force global platforms to relocate their servers to Russia or at least to make them localize their services," Andrei Soldatov, an investigative journalist who covers cybersecurity issues, told BuzzFeed. "It's not about banning, it's about intimidation mostly - companies are forced to get to the government to be told what is allowed."

Twitter, in particular, has faced the ire of Russian officials, one of whom publicly threatened to ban it "in a few minutes" if it did not comply with requests to remove accounts at will last month. Though government quickly walked back the official's comment and gave him a reprimand, the incident was widely seen as a trial balloon for expanding censorship. A clear-the-air meeting in Moscow last month between a senior Twitter executive and Roskomnadzor's leadership ended acrimoniously when the company denied Russian claims that it had agreed to block a dozen accounts.

A Twitter source told BuzzFeed that the new personal data law was among the measures Russian officials discussed at the meeting. The bill still needs to be approved by Russia's upper house of parliament and signed by President Vladimir Putin, but the speed with which it was rushed through the Duma — lawmakers voted on three readings in just ten days, with almost no discussion — suggests that will be a formality.

The law opens the door, however, to a number of cumbersome restrictions that Russia's independent communications agency says could seriously damage the economy. Online holiday bookings could become a thing of the past: even Russia's national airline, Aeroflot, uses a payment system based in the U.S., while every hotel reservation abroad would require sending data to a foreign country.

That puts the new law in line, however, with several other restrictive measures passed since Putin returned to the presidency in 2012. Though rights groups worldwide decried legislation vastly increasing criminal penalties for unsanctioned protest, creating internet blacklists, and banning "homosexual propaganda," almost nobody has actually been charged with violating those laws since. The data law appears to fall into this category because determining whether a user is a Russian citizen is almost impossible, Andrei Mima, a web entrepreneur, wrote in a column on the website TJournal.

"Right now, the amendments to the legislation are so "raw" that they're unenforceable, whatever the authorities' wish to implement them," Mima wrote. (The column can be read in English on Global Voices.) "You might consider this good news: unrealistic laws are usually enforced selectively, through manual control."

As Russia's internet crackdown continues, however, further measures to restrict Russians' access to information are likely. Parliament passed another bill Friday — rushed through even faster than the server law — that bans advertising from cable channels, a measure that critics say is aimed solely at destroying the country's only opposition TV channel, Dozhd.

Elena Mizulina, the author of the "gay propaganda" law, is pushing for providers to require users to opt out of a "clean internet" filtering system blanket blocking the open web by default. "Criminalizing murder doesn't mean that everyone will suddenly find themselves behind bars," she told the pro-Kremlin newspaper Izvestia.