TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps

2026-08-13

AI Summary

This study addresses the pervasive lack of transparent and accurate privacy disclosures in Telegram Mini Apps, which predominantly rely on platform-default policies that fail to reflect actual data collection and sharing practices, thereby posing significant privacy risks. To systematically evaluate their privacy compliance, this work proposes TeleGapper—the first dynamic black-box analysis framework tailored for WebView-embedded lightweight applications. By monitoring runtime network traffic, identifying third-party domains, and cross-referencing disclosed privacy policies, TeleGapper reveals substantial discrepancies between stated practices and observed behavior. An evaluation of 278 Mini Apps shows that 59.4% transmit data to undisclosed third parties, 78.8% solely adopt Telegram’s default policy, and none implement user consent or opt-out mechanisms, marking the first empirical evidence of a severe disconnect between privacy disclosures and actual data flows in this ecosystem.

Abstract

Telegram Mini Apps are Web applications embedded within the Telegram client, forming an ecosystem of third-party services within one of the world's most widely used messaging platforms. Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored. Unlike ecosystems such as WeChat, which rely on tightly controlled, proprietary execution frameworks, Telegram adopts a different model: Mini Apps run inside a WebView, combining platform-provided context with standard Web capabilities and unrestricted outbound networking. This enables applications to transmit sensitive information to analytics, advertising, tracking, or other third parties through ordinary Web requests, often with limited visibility. Privacy disclosures are therefore critical for transparency. Telegram allows Mini Apps either to define an application-specific privacy policy or to rely on a platform-provided default policy. While the latter reduces the developer's disclosure burden, it may lead to generic statements that do not accurately capture actual data practices of individual Mini Apps. In this paper, we present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps by capturing runtime network traffic, identifying third-party communications, and comparing observed data flows against disclosed privacy information. We evaluate 278 working Mini Apps collected from tApps Center, a community-driven catalogue for discovering third-party applications in Telegram. We find that 59.4% contact at least one undisclosed third party, 78.8% rely exclusively on Telegram's default privacy policy, and none provides a consent or opt-out mechanism. These findings expose a substantial transparency and compliance gap in a widely used yet understudied ecosystem.

Problem

• privacy policy
• Telegram Mini Apps
• third-party tracking
• data disclosure
• transparency gap

Innovation

• Telegram Mini Apps
• privacy policy analysis
• black-box dynamic analysis
• third-party tracking
• data transparency