What about GDPR?
GDPR came into force across Europe on 25 May 2018, and Telegram had little to change. The regulation requires what the service was built around: not using personal data for advertising, not selling it, and keeping only what is needed to operate.
What Telegram keeps, and why
| Data | Purpose |
|---|---|
| Cloud chats | So you can reach them from any device without a third-party backup |
| Contacts you chose to sync | So you can message people you already know |
| Basic account details | So messages can be delivered to you at all |
None of it is used to target advertising, none of it is sold, and Telegram is not part of a wider group of companies pooling user data between them. That last point matters under GDPR, because "sharing within our family of companies" is how a great deal of data movement is disclosed while sounding like nothing.
Exercising your rights
- Access and portability. Settings, Advanced, Export Telegram Data produces a complete, browsable archive of what is held.
- Erasure. The deactivation page deletes the account and its contents permanently.
- Data minimisation by default. Settings, Privacy and Security lets the account delete itself after a period of inactivity.
The privacy policy names the European data protection representative and sets out the legal basis for each category of processing. It is short enough to read properly, which is not true of most.