Is Telegram Scraping Legal? GDPR and Telegram's Rules in 2026

There is no blanket yes or no. Reading public Telegram chats is ordinary use, but once you collect people's data for business, GDPR applies if those people are in the EU. Bulk exports, mass DMs and hoarding data are where legal and ban risk concentrate. Narrow, purposeful, transparent collection is far easier to defend.

Two separate rulebooks are in play. GDPR is law: breaking it can mean regulator orders and fines. Telegram's terms are a contract: breaking them can mean a limited or banned account. A plan can pass one test and fail the other, so check both.

Telegram's rules are stricter than many scraper vendors suggest. We read the current versions on 23 September 2026. Here is what they say, in plain words.

The general Terms of Service forbid using Telegram "to send spam or scam users", and they warn that breaking the terms can lead to a temporary or permanent ban. The Terms of Service for Content Licensing go further. They prohibit access to user content "for any purpose other than ordinary, legitimate, and intended use of the Telegram platform as its user", with an exception for legitimate third-party clients, bots and Mini Apps that follow the rules. They also "firmly" prohibit scraping, indexing, harvesting or aggregating Telegram data to train, develop, benchmark or deploy AI and machine learning models. The ban reaches past training to running such models, too.

The developer terms add detail. The Bot Platform terms (section 4.3) bar collecting data "beyond what is essential" and name "scraping public group or channel contents" to build large datasets as prohibited. Bots also must not send unsolicited messages. The API terms ban actions taken on a user's behalf without their knowledge.

Enforcement usually starts with other users. According to Telegram's spam FAQ, an account reported for spam gets limited: it can only message people who saved its number or who wrote first. For a first offence that lasts a few days, and repeat offences get longer limits.

A limit hurts more than it sounds. If your sales run through one Telegram account, a spam limit also cuts you off from existing clients who never saved your number. Keep any bulk collection far away from the account you sell from, or better, skip it.

Many Telegram communities are Russian- or Ukrainian-speaking, and local law can be stricter than people expect.

In Russia, a change to Federal Law 152-FZ in force since 1 March 2021 (Article 10.1) replaced the old idea of "publicly available" data. Data a person made public can only be spread further on the terms of a separate consent. "I found it online" is weak ground there too.

Ukraine's Law "On Personal Data Protection" (2010) also requires a legal ground for processing. A new GDPR-aligned bill, No. 8153, passed its first reading in November 2024, so check its current status before you rely on the older text.

If your audience mixes EU residents with people in Ukraine, Russia or elsewhere, you rarely know who is where. The simplest safe approach is to apply the strictest set of rules to everyone: collect little, say who you are and stop on request.

Article 14 sounds bureaucratic, but in practice it fits in the first two lines of a normal reply. You say who you are, where you saw the message and why you are writing. Then you make it easy to say no.

Here is an example reply to the Tallinn post above: "Hi Olivia, I'm Jonas from a small data protection consultancy in Tallinn. I saw your post in E-commerce founders · Tallinn about your German launch. We set up privacy policies and cookie banners for online shops. Happy to share our prices, or just ignore this and I won't write again."

That message names the sender, the source and the purpose, and it offers an easy way out. If Olivia asks how you found her or what you keep about her, answer plainly. Under Article 15 she has a right to know, and a vague answer is exactly what the CNIL criticised in the KASPR case.

Leadgram is itself a collector of the kind this guide describes, so it is fair to hold it to the same rules. It reads public Telegram chats 24/7 and uses AI to score the messages it finds for buying intent. Under GDPR, that makes Leadgram responsible for what it keeps about the people who wrote those messages, and Telegram's terms apply to how it reads the chats. What you get is the result: each lead has a 0-100 score with a reason and the source message, so you can see why a person is relevant before you write. No Telegram account is needed on your side, so your own account is never the one doing the collecting.

We keep little of that data, and not for long. A lead is the message, the author's public name or handle, the source chat and link, the date, and the score with its reason. Where a phone number appears in a lead's public profile or message, Leadgram can store it; it stays out of CSV exports unless you switch it on in the export dialog. Leadgram does not export group member lists. Leads are deleted from the search index automatically 30 days after their last update.

If you wrote in a public chat and want to know what Leadgram holds about you, object to it or have it removed, write to [email protected]. A removed lead stays removed even if the same message is found again. Our data policy covers what the product stores.

A tool does not make outreach lawful for you. You decide who to contact and what to say, so under GDPR you are responsible for that step. The four questions above apply to every lead you act on. For a side-by-side view, see scraping vs AI search.