Telegram and data privacy: The risks users face

For a long time, Telegram was considered a secure alternative to WhatsApp and similar apps. The reason: you don't need to provide a phone number to use Telegram. Furthermore, the messenger introduced encryption long before WhatsApp did. As a result, users felt they were on the safe side, and Telegram experienced a real hype.

However, the enthusiasm waned as radical groups increasingly used the messaging service to connect and plan criminal activities. Since then, Telegram's image has been crumbling. Criticism regarding data protection is also growing louder. In this article, you will learn about the current state of data privacy on Telegram.

Do you need legal support regarding data protection on the internet? Our team consists of data protection experts who are happy to advise you on your individual concerns. Contact us for a non-binding initial consultation.

Protecting data: secure and simple

Users are generally not fully aware of the extent to which data is collected and stored. Consequently, data protection cannot always be guaranteed. We are happy to advise you on data protection issues.

Key takeaways

• Telegram only encrypts between the device and the server. Comprehensive end-to-end encryption is only guaranteed for secret chats.
• Data stored in the cloud can be accessed by Telegram and third parties at any time. This also applies to the German Federal Criminal Police Office during criminal investigations. 
• Telegram stores about as much data as WhatsApp, but due to a lack of encryption, this data is less protected.
• Illegal content is not being removed by the provider at all or not quickly enough, even after repeated reports. Furthermore, the messenger does not cooperate with government authorities and thus provides radical groups with a platform.

What is Telegram?

Telegram is a messenger app for Android and iOSthat, much like WhatsApp, enables communication between two or more people. The free, cloud-based instant messaging service offers classic chat features that allow users to exchange (voice) messages, photos, and documents, or make internet-based calls. In addition, it is possible to join channels on specific topics and independent groups to found.

Since WhatsApp was acquired by the Meta group and now officially belongs to Meta (like Facebook), many have switched to Signal and Telegram due to privacy concerns. Yet Telegram in particular—a giant among messenger services with around 500 million users worldwide—is repeatedly subject to harsh criticism regarding its lack of security and data protection. Is this justified?

Telegram and data privacy: How secure is the app?

One thing is certain: like other messenger services, Telegram collects a large amount of data about its users. While this is intended to prevent abuse of the platform, this data collection can also come with a certain security risk and a threat to your personal privacy .

Furthermore, the messenger automatically reads private chatsto prevent spam. If there is a suspicion of spam, the chat is reviewed again by so-called Telegram moderators monitored. In addition, files and attachments that users leave behind while using the app are stored.

The following data is stored by Telegram:

• IP address
• Device details
• Username changes
• Metadata (used to create movement profiles)
• Phonebook/synchronized contacts
• Channel and group memberships

Telegram retains this user data for up to 12 months long—at least according to the communication service's own statements. To this end, a blanket consent is obtained from users, as they cannot use the app without agreeing to this data storage.

Security vulnerabilities on Telegram

From a data protection perspective, it remains particularly problematic that it is still unclear who exactly operates the Telegram servers and where they are actually located. This determines which law applies in specific cases and whether German authorities may potentially access data to investigate criminal offenses.

Although Telegram's corporate headquarters are officially in Dubai, any search for specific server locations or other relevant information is in vain. Transparency looks different.

A closer look is also required regarding the encryption of communications: unlike other messenger services, Telegram chats are not automatically end-to-end encrypted. Encryption only applies to communication between the user and the server. Once on the cloud server, Telegram has access to the data again—and third parties could also easily gain access.

While there is an option to manually set up end-to-end encryption, this is only available for secret chats and must be actively enabled by the user for each individual chat. Such encryption is also reportedly available by default for voice calls within Telegram. However, manual, additional encryption is not possible for group chats or other features within the app.

In short: The encryption of communication on Telegram does not remain intact across the entire transmission path. This makes it easier for third parties to gain access to sensitive content and private chats via the source code. Experts generally agree: communication on Telegram is insufficiently encrypted.

The Federal Criminal Police Office (BKA) has been investigating criminal activities on Telegram for some time. Due to the lack of security measures, the BKA does not rely on cooperation from Telegram. As a result, it can relatively easily access relevant data on individual suspects.

Alternatives to Telegram: Which apps are more secure?

For those who value secure communication and trustworthy companies is a priority, you should avoid the messaging app Telegram if possible. Due to many ambiguities and a lack of transparency , the app does not offer sufficient data security for privacy-conscious users.

Many people are looking for an alternative to the market leader WhatsAppto avoid sharing their data with Meta, so they switch to Telegram. However, switching to Telegram does not offer any real advantage. Furthermore, anyone who uses Instagram and Facebook is already providing their data to Meta.

A popular alternative is the paid communication service Threema . For a reasonable price, users can benefit from the secure chat provided by the Swiss company . Threema offers a password-protected app with encrypted chats and local servers. Calls within the app are also encrypted. Furthermore, the app is anonymized and can therefore be used without a mobile phone number.

German users also trust the free messenger Signal, which also offers encrypted chats and is therefore considered secure. Most recently, Signal was even recommended by the famous whistleblower Edward Snowden . Here, every single message is encrypted individually, meaning hackers would have to go to the trouble of cracking individual messages to access the encrypted chat.

Does Telegram threaten national security?

In addition to the lack of data protection, Telegram is also criticized for other issues: due to its few and barely verified terms of use , the messenger has become a hub for radical groups, conspiracy theorists and criminals developed.

It seems as if Telegram is a lawless space, where no rules apply and anyone can share inhumane or dangerous content without having to fear consequences .

The legal situation is clear: criminal laws also extend to statements and actions on the internet and in messenger services like Telegram. Anyone who does not abide by the law must expect sanctions – even if the perceived anonymity creates a false sense of security.

However, the platforms themselves must also take actionif legal requirements are to be enforced on the internet. The problem: illegal or even misanthropic content is rarely deleted because messages are not even checked for content by the services.

Telegram provides radical groups with a space to spread dangerous theories or illegal content – and, in doing so, potentially radicalize others. When criminal acts are planned or even carried out via the messaging service, it increasingly becomes a real threat to our security.

Conclusion

In terms of data security, Telegram performs worse than WhatsApp. If you do not want your data stored by the Meta corporation, you should look for an alternative and use trusted apps like Threema or Signal instead.

If users wish to continue using Telegram, they should make sure to enable end-to-end encryption for every chat and avoid sharing sensitive information or supporting illegal activities via the app.

However, it remains problematic that many data protection aspects cannot be verified due to a lack of transparency on the part of the company. Another reason against using Telegram as a messaging service is that it provides a platform for hate speech, criminal acts, and calls for violence because content is not moderated. Telegram does little to nothing to combat hate speech and radical ideologies, thereby providing a breeding ground for extremism and violence.

Do you have questions about data protection? We are happy to provide you with legal and technical support in implementing data protection requirements. Please feel free to contact us at any time.