← Hall of Shame
C+

Privacy Policy Audit

Telegram

messagingencryptioncloud-storagegroupsprivacy-marketing
3,100
Word Count
12 min
Reading Time
3 min
Human Patience
5/10
Sneakiness

Translation Service

What They Say

Telegram's privacy policy is unusually short — 3,100 words — which the Bureau interprets as a sign of either exceptional honesty or exceptional omission. They explain that regular messages are stored encrypted on their servers but with keys they hold, that Secret Chats are end-to-end encrypted, and that they have disclosed minimal data to law enforcement historically. They present themselves as privacy-forward.

What They Mean

Telegram is not a privacy app. It is a cloud messaging app with an optional privacy mode. Regular Telegram chats are stored on Telegram's servers in a format Telegram can read — they hold the encryption keys. Secret Chats are end-to-end encrypted but must be manually enabled and do not work on multiple devices simultaneously. Most users use regular chats. Most users do not know the difference. The privacy brand is built on the Secret Chat feature and the founder's personal reputation. Pavel Durov's arrest in France in 2024 and subsequent cooperation with authorities revealed that Telegram's commitment to law enforcement resistance was more conditional than the brand suggested.

Worst Clause — Exhibit A

"If Telegram receives a court order that confirms you're a terrorist suspect, we may disclose your IP address and phone number to the relevant authorities. So far, this has never happened. If it does, we will include it in a semiannual transparency report published at t.me/transparency."

Bureau Translation:

The standard applied here is 'confirmed terrorist suspect,' which sounds principled until you consider that the determination of who meets this standard is made by the authority requesting the data, not by an independent standard Telegram sets. After Durov's arrest, Telegram stated they would share IP addresses and phone numbers with authorities for 'illegal activities' broadly — a significant expansion of the 'terrorist suspect' threshold the policy describes.

Evidence Tags — Data Collected

All messages in regular chats (stored on Telegram servers)Contacts list if granted permissionIP addresses and device informationUsername, profile photo, and bioGroup and channel membershipsPhone number (required for registration)

Bureau Verdict

"Telegram grades C+ despite the gap between its privacy brand and its actual architecture because the policy is honest about Secret Chats versus regular chats, and because the Bureau credits transparency about what is and isn't encrypted. The marketing-to-reality gap on privacy is significant. Signal remains the Bureau's recommended alternative for genuine end-to-end encrypted messaging."

C+

Overall Grade

Brief, Which is Suspicious

Frequently Asked Questions

Dark Patterns Documented

See the full Dark Pattern Encyclopedia for documentation of each technique.

Audited: 2026-03-20