Telegram is a cloud-based messaging service whose privacy policy discloses collection of metadata such as IP addresses, device identifiers, and username history, and whose default "Cloud Chats" (including all group chats) are stored on company servers rather than end-to-end encrypted, a design choice the company itself documents and that competitors have publicly criticized. In September 2024, following the arrest and indictment of co-founder and CEO Pavel Durov in France on charges tied to platform moderation, Telegram updated its privacy policy to expand the circumstances under which it may disclose user IP addresses and phone numbers to law enforcement, and its corporate structure spans multiple offshore jurisdictions (British Virgin Islands, Dubai, London) with limited public disclosure of ownership stakes.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
16 ON FILE
COLLECTION
Telegram's privacy policy states that to improve account security and prevent spam/abuse it may collect metadata such as IP address, device information, and history of username changes.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow you to permanently delete your personal data? — Yes, using an automated mechanism.
UK Companies House filings for Telegram Messenger Inc. and Telegram Messenger LLP list corporate officers administered through Vistra (BVI) Limited, a corporate services provider based in Road Town, Tortola, British Virgin Islands.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Is the policy's history made available? — Yes, with revisions or a changelog.
Telegram Group Inc.'s Legal Entity Identifier registration lists its registered address as care of a trust company in Road Town, Tortola, British Virgin Islands, rather than a publicly disclosed operating headquarters with transparent ownership percentages.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow third-party access to private personal data? — Yes, all parties specified (only to critical service providers).
In September 2024, Telegram updated its privacy policy so that upon a valid order from judicial authorities confirming a user is a suspect in a case involving criminal activity that violates Telegram's Terms of Service, the company may disclose that user's IP address and phone number to authorities.
Prior to the September 2024 update, Telegram's privacy policy limited disclosure of IP address and phone number to cases where a court order confirmed the user was a terror suspect.
Following the September 2024 privacy-policy change, Telegram reported fulfilling roughly 900 U.S. government requests and sharing phone number or IP address information for 2,253 users, a sharp increase from the 14 requests affecting 108 users it had fulfilled previously under the narrower terror-suspect standard.
In August 2024, French prosecutors indicted Telegram co-founder and CEO Pavel Durov on multiple charges, including complicity in offenses tied to child sexual abuse material and drug trafficking, which prosecutors attributed to insufficient content moderation and cooperation with law enforcement on the platform.
Starting in August 2024, the European Commission's Joint Research Centre opened a technical investigation into whether Telegram had understated its number of EU users in order to avoid designation and stricter obligations as a Very Large Online Platform under the Digital Services Act.
WhatsApp's head publicly criticized Telegram's proprietary MTProto end-to-end encryption implementation as not independently verified and noted it is not enabled by default and unavailable for group chats.
Telegram's default "Cloud Chats," which include all group chats, are not end-to-end encrypted, which reporting on the service's architecture states gives Telegram technical access to message content.