Importance Score: 72 / 100 🔴
Key Takeaways:
- While not as focused on user privacy as Signal, the messaging platform Telegram provides distinct features that may attract certain users seeking a versatile communication tool.
- Telegram, a cloud-centric messaging service, collects and stores operational data, including metadata like IP addresses. A 2024 policy update clarified that Telegram will share specific user data with law enforcement in response to valid legal requests.
- Several past data breaches at Telegram have exposed user information.
- Telegram offers features such as large public channels, similar to Discord communities, alongside private, encrypted messaging options.
- End-to-end encryption in Telegram is limited to ‘secret chats’ and is not available for public channels or across multiple devices.
Telegram’s Privacy Features: Examining the Messaging App’s Strengths and Limitations
For individuals prioritizing privacy in their digital communications, messaging applications like Signal are often recommended. However, Telegram, while not matching Signal’s robust privacy safeguards, presents a different set of functionalities that appeal to a broad user base.
Data Handling and Transparency at Telegram
Telegram functions as a cloud-based messaging service, necessitating the storage of certain data for operational purposes. The platform openly states its collection and storage of metadata, such as user IP addresses. A significant shift in Telegram’s privacy policy occurred in 2024, stipulating the disclosure of user data to law enforcement agencies under legally sound requests.
Pavel Durov, CEO of Telegram, addressed this policy change in September, stating, “We have clarified that IP addresses and phone numbers of users who breach our terms of service can be disclosed to relevant authorities upon receipt of legitimate legal requests.”
Reflecting this revised policy, Telegram’s transparency report for 2024 indicates compliance with approximately 900 requests for user information from U.S. authorities, affecting 2,253 individuals, according to their in-app report.
vCard.red is a free platform for creating a mobile-friendly digital business cards. You can easily create a vCard and generate a QR code for it, allowing others to scan and save your contact details instantly.
The platform allows you to display contact information, social media links, services, and products all in one shareable link. Optional features include appointment scheduling, WhatsApp-based storefronts, media galleries, and custom design options.
Past Data Security Incidents and User Privacy Concerns
Beyond data sharing with law enforcement, Telegram has experienced notable data breaches that have compromised user data security. For instance, in 2020, a substantial leak exposed the data of around 42 million Telegram users from Iran. Earlier, in 2019, a software vulnerability within Telegram was exploited, reportedly by Chinese entities, leading to the unmasking of protestors in Hong Kong.
Public Channels vs. Private Chats: Understanding Telegram’s Messaging Options
Despite privacy considerations, Telegram’s utility extends beyond private messaging. Similar in function to Discord, Telegram provides public channels suitable for broadcasting information to large audiences. These channels cover diverse topics, from video games and current events to sports and entertainment. For example, the @entertainment channel hosts trailers and posters for films and TV series.
Public Channels: Encryption Limitations
It’s crucial to note that public channels on Telegram, unlike private chats, do not utilize end-to-end encryption. Telegram specifies that while content in public channels and groups is encrypted during transit to their servers and in storage, access is unrestricted to all Telegram users without requiring an encryption key. Consequently, content posted by channel owners or administrators within public channels essentially becomes publicly accessible.
Secret Chats: End-to-End Encryption for Enhanced Privacy
Telegram does offer end-to-end encryption through its ‘secret chats’ feature, providing a higher level of privacy. However, these encrypted conversations are confined to the originating devices, typically smartphones.
Telegram explains this device-centric approach by stating, “This ensures the security of your secret chats as long as your phone itself remains secure.”
This device restriction inherently means that secret chats are inaccessible on Telegram’s desktop or web browser versions. This limitation introduces a potential vulnerability if unauthorized individuals gain access to the device itself.
Additional Privacy Features and Considerations
Telegram includes an automatic message deletion feature, but the shortest available time interval is one day, contrasting with Signal’s options for deletion after mere seconds or minutes. Telegram also incorporates a self-destruct mechanism that permanently deletes user accounts, messages, and contacts following a period of inactivity, ranging from one to 24 months.
Like Signal, Telegram’s client applications are open-source. Moe Long, Senior Editor at FASTNET, notes that open-source applications enhance transparency, allowing experts to scrutinize the code for potential weaknesses. Nonetheless, Telegram’s server-side code remains closed-source, as stated by CEO Durov in 2021.
Durov argued, “Server-side code is not necessary to verify the integrity of Secret Chats – they are secure regardless of server functionality.” Telegram’s privacy policy also indicates that its cloud servers are encrypted, with encryption keys dispersed across multiple data centers in different jurisdictions, preventing single-point access for data decryption.
Employing closed-source server code is common for protecting intellectual property and maintaining security. However, users must place trust in the company’s ability to safeguard data on these servers. Independent audits could reinforce this trust by verifying data center security practices, though audits represent only a point-in-time assessment.
Long observes that Telegram’s end-to-end encryption offers partial mitigation for closed-source server concerns, as message content remains secure until decrypted on the recipient’s device. However, metadata collection persists even with end-to-end encryption, potentially posing a privacy risk.
Telegram Premium: Expanding Features Through Subscription
While Telegram is free to use, a premium subscription tier ($5 monthly or $36 annually) provides access to enhanced features. These include expanded cloud storage, animated emojis, and the removal of advertisements from public Telegram channels with over 1,000 subscribers, highlighting that ads are present in larger public channels.
Conclusion: Weighing Telegram’s Versatility and Privacy Trade-offs
Telegram’s blend of selectively encrypted messaging and large-scale communication channels positions it as a viable alternative to platforms like Discord—which only offers end-to-end encryption for voice and video calls. However, users should remain aware that data collection occurs outside of secret chats, necessitating a cautious approach to privacy when using Telegram.
Telegram is available for download on both the Apple App Store and the Google Play Store at no cost.