# Telegram privacy rating

Cloud-based messenger with large groups, public channels and bots. Regular chats and groups are stored on Telegram's servers with client-server encryption; only optional one-to-one secret chats are end-to-end encrypted.

## Summary

Telegram scores 44 out of 100 (grade D) on the messengers criteria. It meets 1 of 8 criteria: no trackers or telemetry. It partly meets open source, no ads or data sales, end-to-end encrypted by default and no phone number needed. It does not meet independent audit, metadata protection and decentralized. It is based in the United Arab Emirates: Not in the Five, Nine or Fourteen Eyes.

- Website: https://telegram.org
- Source code: https://github.com/DrKLO/Telegram
- License: GPL-2.0
- Jurisdiction: United Arab Emirates. Not in the Five, Nine or Fourteen Eyes.
- Platforms: Android, iOS, Windows, macOS, Linux, Web
- Home page trackers: none found
- Category: [Messengers](https://privacyratings.com/messengers/)
- Grade: D (44/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | The apps are open source (the Android app is GPL-2.0); the server is closed source. | https://github.com/DrKLO/Telegram/blob/master/LICENSE |
| No trackers or telemetry | Yes | Exodus finds no trackers in the Android app, and the privacy policy states cookies are not used for profiling or advertising. | https://reports.exodus-privacy.eu.org/en/reports/org.telegram.messenger/latest/ |
| No ads or data sales | Partial | Sponsored messages appear in large public channels, bots and search, and by default are based only on the channel topic or search terms rather than user data. | https://telegram.org/privacy#5-6-no-ads-based-on-contents-of-chats-or-contact-lists |
| Independent audit | No | No independent audit is published. |  |
| End-to-end encrypted by default | Partial | Only secret chats, which must be started manually and do not support groups, are end-to-end encrypted; cloud chats and groups use client-server encryption. | https://telegram.org/faq#q-so-how-do-you-encrypt-data |
| No phone number needed | Partial | A phone number is required to sign up, but it can be hidden from everyone and contacts can be reached by username. | https://telegram.org/faq#q-who-can-see-my-phone-number |
| Metadata protection | No | The server stores cloud chats and sees who talks to whom. |  |
| Decentralized | No | One central service; the server code is not published. |  |

Source: https://privacyratings.com/messengers/telegram/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/messengers/telegram.md