Telegram's Bot Developer Terms treat every bot and Mini App as a "Third Party App" and require its developer to delete user data on request, encrypt stored data, publish a privacy policy, and refrain from scraping public groups or channels to build datasets for machine learning or AI products. The terms contain no separate chapter on AI models, so a Telegram bot that forwards messages to a language model is held to the general data duties, and the model provider's own terms apply on top.
Key takeaways
- Bots and Mini Apps are third-party software hosted on the developer's own servers, and the developer is the party responsible for user data.
- Section 4.3 of the Bot Developer Terms bans collecting public group or channel content to build datasets, models, or AI products.
- Telegram's default bot privacy policy does not mention AI, and it promises that user data is not shared with third parties without authorization.
- The terms show no effective date and take effect as soon as Telegram posts a revision.
- Canadian privacy authorities published nine principles for generative AI on December 7, 2023, and several apply directly to chatbots.
Who the terms bind
The Telegram Bot Developer Terms define bots and Mini Apps together as "Third Party Apps," shortened to TPA. A TPA connects to Telegram through the Bot API but runs on the developer's servers, so the developer and not Telegram decides how messages are stored and processed. Section 14 says Telegram may update the terms from time to time and that changes take effect once the revised text is posted. The page shows no effective date, and Telegram suggests following its @BotNews channel for updates. The wording summarized here was read on October 27, 2026.
Telegram's own description of how bots work, including tokens, polling, and group privacy mode, is covered in a separate article on this site. This one concentrates on the contractual duties.
The data duties in plain terms
Section 4 of the terms sets out what a developer owes users. The table paraphrases the main points; the terms themselves are the authority.
| Section | Duty | What it means for an AI bot |
|---|---|---|
| 4 (privacy policy) | Every TPA must be bound by an easily accessible privacy policy describing what data is stored, how it is collected, and why | A bot that sends chats to a model provider should say so in a policy it controls |
| 4.1 | Extra data may be requested only as agreed with users, and users may not be misled to get around Telegram's data limits | Asking for contact details or files needs a clear reason |
| 4.2 | Data must be deleted without undue delay on request, when no longer needed, or when the TPA stops operating | Chat logs and prompt histories are covered |
| 4.3 | Collect only what the service needs; no scraping of public groups or channels for large datasets, machine learning, or AI products | Training a model on harvested Telegram content breaks the terms |
| 4.4 | Encrypt user data at rest, keep it apart from the encryption key, and notify users of breaches as the law requires | Stored conversation history needs real safeguards |
If a developer publishes no policy of their own, Telegram's standard policy for third-party apps applies by default. A developer whose practices go beyond that standard text must submit a custom policy through @BotFather, and the custom policy cannot conflict with the terms.
What the AI rule covers and what it leaves open
The only provision that names AI is section 4.3. It targets data collection aimed at creating large datasets, including scraping public group or channel content for machine learning or AI products. Information that users submit voluntarily may be used for such a purpose only if the developer discloses the purpose and gets explicit consent that the user can revoke.
The standard privacy policy for third-party apps is silent on AI. It says the developer requests and processes only the data needed for its features and that user data is not shared with third parties unless the user authorizes it or the law requires it. A reasonable reading is that a developer who passes chat text to an outside model provider needs either that authorization or a custom policy that explains the transfer. That is an interpretation, not a ruling by Telegram, and the terms do not address the question directly.
Conduct rules that matter for chatbots
Section 5.2 lists prohibited conduct. Several items fit chat products closely: sending unsolicited messages, impersonating Telegram or any organization that has not authorized the bot, and asking users for a Telegram password or one-time code. The same section bars circumventing rate limits or moderation. Bots that act as a chatbot inside Telegram Business must describe their services clearly, use business message data only to deliver them, and not conceal their activity from the business owner (section 5.4).
Paid features follow separate rules. Under section 6.2 of the developer terms, digital goods sold through a TPA must be paid for in Telegram Stars, and the developer must support the /paysupport command and handle refunds. Physical goods and services go through outside payment providers.
Rights users have and where Canadian guidance fits
The standard policy lets users ask for a copy of their data, request deletion, restrict or object to processing, withdraw consent, and complain to a national data protection authority. Developers must respond to such requests within 30 days under section 7.3 of that policy.
For Canadian readers, the Office of the Privacy Commissioner of Canada and its provincial and territorial counterparts issued principles for responsible, trustworthy and privacy-protective generative AI technologies on December 7, 2023. They advise telling people when they are dealing with a generative AI tool, saying whether prompt data is used for further training, and avoiding retention of prompts or secondary use unless required. The document is guidance, not a statute, and a developer's legal duties depend on location and facts. This article gives general information and is not legal advice.
FAQ
Does Telegram check what AI model a bot uses?
The terms and standard policy do not describe any review of the model behind a bot. The developer is responsible for the bot's data practices, and Telegram says it may terminate bots that mishandle data or violate their own policy.
Can a developer train a model on messages sent to the bot?
Only within section 4.3. Voluntarily submitted data may be used if the developer discloses the purpose and gets explicit, revocable consent. Scraping public groups or channels for that purpose is prohibited.
Who answers a deletion request?
The bot's developer. Under the standard policy the developer must respond within 30 days, and users can contact the developer through the details shown by the /developer_info command.
Are these terms the same as Telegram's general Terms of Service?
No. The Bot Developer Terms apply to people who build bots and Mini Apps, and section 5.2 also requires bots to comply with Telegram's Terms of Service.
Related reading
- How Telegram bots work
- Building a GPT-based Telegram chatbot
- Character-based AI chat apps
- DeepSeek, an AI chat service
More in AI Tools and Industry.
Last verified: October 2026
Sources
- Bot Developer Terms of Service, Telegram, version read October 27, 2026
- Standard Privacy Policy for Third-Party Apps, Telegram, version read October 27, 2026
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada, December 7, 2023