Does Telegram Report CSAM to Law Enforcement? What Changed.

Telegram clarified its law enforcement disclosure policy in September 2024. The platform “will now disclose IP addresses and phone numbers in response to valid requests in ordinary criminal cases.”

When Does Telegram Provide This Information?

Telegram’s Privacy Policy states that it may disclose this information “upon receipt of a valid court order naming the user as a suspect.” The terms also state that “this does not include message content; Telegram says it has not disclosed message content to third parties.”

Does Telegram Report CSAM to the National Center for Missing & Exploited Children’s CyberTipline?

Telegram is “unable to provide any information on CyberTipline reports as it doesn’t collect the data necessary to generate a report.” Similarly, Telegram does not specify how many CyberTipline reports it has filed in its transparency report, which lists fulfilled requests by country.

What Else Has Been Reported About Telegram’s Law Enforcement Cooperation?

Telegram Founder Pavel Durov’s alleged refusal to cooperate with law enforcement has raised some questions. The criminal complaint against him filed by the French prosecutor lists “refusal to communicate, at the request of competent authorities, information or documents necessary for carrying out and operating interceptions allowed by law” as one of the factors which helped make the offenses “facilitated by Telegram” possible.

However, Telegram has recently made assertions of cooperation as well. For example, in early 2025, Telegram stated that it has “banned over 890,000 abuse groups and channels.”

These developments differ significantly from Telegram’s reputation among federal investigators in the past. A January 2021 FBI training document stated of Telegram: “No message content. No contact information provided for law enforcement to pursue a court order,” noting that in confirmed terrorist investigations Telegram may disclose an IP address and phone number to the relevant authorities.

What Changed in Telegram’s Privacy Policy in September 2024?

The catalyst for Telegram’s September 2024 policy rewrite was the August 2024 arrest of CEO and founder Pavel Durov in France. According to the French criminal complaint, Durov accepted “the administration of Telegram in violation of the law” and was responsible for and knowingly participated in crimes that were facilitated by Telegram.

Telegram updated its Terms of Service in September 2024. Under the new policy, Telegram is willing to release “identifiers” (such as IP addresses and phone numbers) to law enforcement. It is, however, still unwilling to disclose content (such as messages).

What is the Trigger for Telegram’s Release of a User’s Data?

Before September 2024, Telegram had explicitly limited its disclosure to “cases of suspected terrorism.” With its newly-implemented policy, however, Telegram allows for the disclosure of “all law enforcement requests in relation to conduct that violates Telegram’s Terms of Service.”

While this appears to be a limitation that only applies to criminal cases, Telegram’s Terms of Service are extremely broad, and they govern not just criminal cases but all interactions with the platform. Violation of Telegram’s Terms of Service, such as posing as an employee of Telegram or using Telegram to deceive another person, can trigger release of a user’s data to the government.

How Often is Telegram releasing User Data in Response to Law Enforcement Requests?

According to the platform’s own data, Telegram fulfilled 900 requests from U.S. Authorities in 2024, affecting 2,253 users. Telegram’s transparency reports disclose only the requests it fulfilled; they do not state how many requests it received or denied.

Although Telegram does not disclose the content of the data released to law enforcement, Telegram fulfilled requests related to 2,253 Telegram users in the U.S. During 2024. Telegram clarified in its September 2024 policy rewrite that it does not store any information about the contents of messages and that it does not process requests from law enforcement for the contents of messages.

What Else Changed in Telegram’s Privacy Policy in September 2024?

In the September 2024 update, Telegram did several other things as well. Among them, Telegram deleted the language in its FAQ that explicitly stated “All Telegram chats and group chats are private amongst their participants. We do not process any requests related to them..”

In December 2024, Telegram joined the Internet Watch Foundation, a UK-based charity that operates a reporting hotline and provides hash datasets and tools used to detect, remove, and block child sexual abuse imagery online. Telegram joined the Internet Watch Foundation and posted “The fight against the dissemination of child abuse materials is a priority. We are glad to support IWF in its efforts in this area.”

Does Telegram Itself Send CSAM Reports to NCMEC?

Responding to legal process (even for ordinary criminal cases) is not the same thing as proactively reporting CSAM to NCMEC. Federal law imposes certain statutory reporting duties on providers, such as those under 18 U.S.C. 2258A. These duties, however, apply only to providers that operate inside the United States. As discussed in the “How Telegram Operates” section of this article, Telegram is not headquartered in the United States, and its founders previously stated that it doesn’t have any physical presence in the United States.

What Are the Statutory Reporting Duties Imposed by 18 U.S.C. 2258A?

Although 18 U.S.C. 2258A imposes an affirmative duty on providers to report “apparent violations of 18 U.S.C. 2252” (or 18 U.S.C. 2258A does not explicitly state what statutory reporting duty it imposes if a provider does not have a physical presence in the United States), it imposes no affirmative duty on providers to proactively monitor, intercept, or search for material. It only imposes an affirmative duty on a provider upon “actual knowledge” of apparent violations.

Did Telegram Establish a Policy for Proactive Content Scanning in September 2024?

No, it did not. Telegram’s September 2024 Terms of Service revisions focus entirely on disclosures triggered by legal requests and content scanning violations of Telegram’s Terms of Service. The revisions are focused on disclosures in response to “valid court orders naming the user as a suspect.” There is no language in Telegram’s updated Terms of Service that establishes a policy of proactively scanning content and reporting content to law enforcement.

Does Telegram’s Policy of Scanning for Violations of its Terms of Service Mean that Telegram is Proactively Searching for CSAM?

Not necessarily. CSAM is illegal to disseminate across the Internet. Any Telegram user that disseminates CSAM on the platform is violating Telegram’s Terms of Service. Telegram has announced that it has taken steps to proactively search for CSAM on the platform, but again, it does not establish what trigger triggers these reports or what triggers will report to NCMEC.

Does Telegram Report How Many Times it Sends Content to NCMEC?

No, it doesn’t. Telegram’s transparency reports provide information about the frequency of fulfilled legal requests from law enforcement agencies, and they report how many users’ data was disclosed to law enforcement authorities. Telegram does not disclose the number of times it reported content to law enforcement authorities.

Does Telegram Report the Frequency of Moderation Content Removal on Telegram?

Yes, it does. According to Telegram’s moderation dashboard, which the company launched in December 2024, the platform blocked 707,576 groups and channels related to child abuse in 2024; Telegram did not publish comparable full-year CSAM totals for 2020 through 2023.

However, these numbers do not specify how many messages were removed. Instead, these figures reflect the total number of groups and channels that were removed. While Telegram reported banning more than 890,000 abuse groups and channels (most of which were removed because they sent CSAM) in early 2025, the figure doesn’t reveal how many reports were sent to NCMEC.

Which Telegram Messages Can the Company Actually Access?

Telegram is one of the most discussed messaging platforms on the internet because of its reported (and alleged) commitment to absolute privacy. The app claims to “protect your information more than any other app,” but Telegram’s capabilities are not as limited as the claims suggest.

The difference between the ability to scan content and the ability to read messages is an important point that users often confuse. While Telegram may scan for the presence of prohibited content using automated tools (such as cryptographic hashes and perceptual hashes, classifiers, etc.), these tools are different from human review. Telegram allows for human review of content, but not for private one-to-one chats.

Does Telegram Read Your Private Telegram Messages?

The short answer is: generally, no. However, as users will learn, they need to understand what types of messages are available on Telegram. Telegram’s main feature is cloud chats. By default, when users create messages, they are “cloud chats.” These messages, along, with messages from chats, channels, and groups, are stored on Telegram’s servers on the backend. While Telegram uses encryption, it does not use end-to-end encryption. This means that Telegram will have access to the plaintext content of cloud chats, groups, and channels.

The only time when Telegram does not have access to the content of private messages is during “Secret Chats.” These chats use end-to-end encryption that means the content is never stored on Telegram’s servers, and they will never sync across devices.

Can the Tools Telegram Uses to Scan for Prohibited Content Access Your Private Chats?

The answer depends on the type of chat you are using. Telegram can use a variety of different tools to scan for prohibited content. These tools include:

• Cryptographic hashes
• Perceptual hashes
• Image and video classifiers
• Human review

These are very different tools. While all of these methods can reach content in Telegram’s groups and channels, the reach of each tool is different. As explained above, cryptographic hashes and perceptual hashes can find content in cloud chats, but they cannot read information from end-to-end encrypted Secret Chats. Similarly, classifiers and human reviews only scan public content on Telegram, such as public groups, public channels, and search results.

What Other Information Can be Found in Your Telegram Account?

The French criminal complaint against Pavel Durov stated that investigators have obtained court approval for remote access searches of Telegram’s servers. So, as far as we know, the information that can be found in a Telegram account depends entirely on the legal process that has been approved.

This is the point at which most people call a lawyer. Spodek Law Group takes federal criminal defense cases nationwide from its New York and Los Angeles offices.

How Do Police Trace a Telegram Account to Someone?

Connecting a Telegram account to a person is not as difficult as it seems. One of the first things users should understand is that, even though users can set a username, Telegram requires a phone number to register. As such, Telegram stores your phone number.

Can Federal Agents Use a Preservation Request to Access Information?

Federal law imposes two statutory duties on Telegram in the event that federal agents are attempting to trace a Telegram account. 18 U.S.C. 2703(f) allows for the preservation of records on request for 90 days. The record preservation request is a separate tool from the record disclosure request, and it has no provisions for record disclosure.

The second statutory mechanism is the record-disclosure process under 18 U.S.C. 2703. That statute permits the government to require disclosure through specified subpoenas, warrants, or court orders.

A dynamic IP reassignment is another reason why a preservation request is critical in a federal investigation. Since Internet Service Providers (ISPs) reassign IP addresses quickly, you must preserve the information. If you don’t, you’ll never know who was using a particular IP address at a particular time.

How Do Federal Agents Use a Preservation Request to Trace an IP Address to Your Internet Service Provider?

Once again, the tool that federal agents use to trace an IP address to an ISP is a preservation request. An ISP is required to preserve records upon receiving a preservation request. After that, federal agents will issue a subpoena. The subpoena will ask the ISP to identify the subscriber (your information) using the subscriber’s IP address.

Does a Preservation Request Give Federal Agents Access to My Computer or Phone?

No, a preservation request does not give federal agents the ability to seize your phone or computer, access files on your phone, or access files in your cloud accounts. To seize a device or a cloud account, federal agents will need a warrant.

What Evidence Can a Federal Agent Access Without Telegram’s Cooperation?

If federal agents have a warrant, they do not need Telegram’s cooperation to access information. If they have a warrant, they can seize your phone and computer, and then they can pull Telegram data directly from your devices. In other words, as long as they have access to your phone or computer, they have access to your Telegram messages and communications, even if the messages are sent via a Secret Chat and are end-to-end encrypted.

If a User Files a CyberTipline Report against Me, Does that Give Federal Agents All the Evidence They Need to Trace Me?

No. A CyberTipline report may include an account ID and IP address, among other information. To uncover your identity, investigators will first need to identify the IP address’s ISP, and then find a match between your subscriber records and the IP address. This process requires a series of requests, subpoenas, and court orders and requires evidence from both Telegram and your ISP.

Can Police Recover Deleted Telegram Messages or Accounts?

The answer to this question is yes. Users can try to cover their tracks by deleting chats, deleting their account, or wiping their device, but as discussed above, the devices you use to access Telegram can serve as a goldmine of evidence for investigators.

If a User Deletes a Telegram Chat, Can Federal Investigators Recover the Chat?

When a user deletes a Telegram chat, the chat is deleted from the server, but it remains on the device. As long as investigators can seize the device, they can potentially recover deleted data.

Forensic investigators use tools that can recover deleted files. As long as the space that the file occupied has not been overwritten, federal investigators can potentially uncover deleted chats, images, videos, and other data.

If a User Deletes a Telegram Message for Everyone, Does that Preclude Recovery?

Deleting a Telegram message for everyone will remove the message from the cloud chats, groups, and channels where it was sent. However, the message may be preserved in another form. This is true even if the other party’s account is banned, and even if the user has no record of the message. To this extent, the deletion of the message may not prevent federal agents from proving the existence of the message.

If a User Deletes their Telegram Account, Will Federal Investigators Still Be Able to Recover Data in the Account?

Deleting your account does not retroactively make records unavailable. If federal investigators already secured your IP address and phone number, they will still be able to trace the Telegram account to you. They will also still be able to access any files they pulled before the account was deleted.

If a User Wipes Their Device After Finding Out that Federal Agents Are Investigating Them, What Consequences Can the User Expect?

Deleting files from a device after learning of a federal investigation is a federal crime. The crime is criminal obstruction, which carries a penalty of up to twenty years. 18 U.S.C. 1519 expressly prohibits destruction and mutilation of records in criminal investigations, and the case against the Telegram founder, Pavel Durov, explicitly cites obstruction.

As we have already discussed above, wiping a device is not guaranteed to erase all information. A factory reset can be ineffective if the keys are still present, and this is another type of digital evidence that federal investigators are routinely successful in recovering.

If Telegram Bans a Channel, Does Telegram Give Federal Investigators Access to the Membership of that Channel?

If federal investigators have obtained the identity of a user who banned a channel, Telegram may be compelled to disclose the membership of the channel. This is also true for deleted channels. While Telegram only reports the total number of channels it banned each year, banning a channel doesn’t necessarily prevent federal authorities from accessing records that show who is on the channel.

Can Telegram Metadata Alone Prove a Federal CSAM Charge?

In federal CSAM cases, the government must prove that a person knowingly possessed and/or distributed CSAM. Simply possessing a file on a computer is not enough. The key is “knowing” possession.

Membership in a group or access to a channel can support an allegation of distribution. This, however, is far more serious than possession. A conviction for distribution under federal law carries a five-year mandatory minimum sentence, while a first-offense possession charge carries a sentence ranging from zero to ten years, with no mandatory minimum.

Why Isn’t Just Membership in a Telegram Group or Access to a Telegram Channel Enough to Prove Knowing Possession?

While membership in a Telegram group or access to a Telegram channel that distributes CSAM is evidence, it is not enough on its own. Federal courts require specific evidence that shows knowledge, intent, and actual knowledge of possession. Without evidence that specifically meets these standards, prosecutors are unable to prove that you knowingly possessed or received CSAM.

Are Distribution Charges Under Federal Law Subject to a Ten-Year Mandatory Minimum?

A federal distribution charge generally carries a minimum five-year sentence and no mandatory minimum of ten years. A possession charge generally carries no mandatory minimum. There are other charges, though, that can carry ten-year mandatory minimums. In these cases, a person is likely to be charged with sending CSAM over the internet (or making CSAM available), and, in these cases, the federal statute may impose mandatory minimums.

What is the Maximum Penalty for Federal CSAM Charges Under 18 U.S.C. 2252?

The maximum penalty under 18 U.S.C. 2252 varies depending on the specific conduct that led to charges. In cases that involve distribution, the maximum penalty is 20 years. In possession cases, the maximum penalty is ten years. As we’ve discussed above, distribution charges often involve higher mandatory minimums than possession charges, and prosecutors will try to support these charges in cases involving Telegram data.

What is the Maximum Penalty for Federal CSAM Charges Under 18 U.S.C. 2252A?

Under 18 U.S.C. 2252A, the maximum penalty is also dependent on the conduct that constitutes the alleged violation. If the crime involved distribution and communication of a CSAM, the maximum penalty is 30 years. Again, similar to distribution charges under 18 U.S.C. 2252, distribution and receipt charges carry a five-year mandatory minimum, while first-offense possession carries no mandatory minimum.

Does Acceptance of Telegram’s Terms of Service Amount to Consenting to a Search for Government/Law Enforcement Authorities?

No. While Telegram’s Terms of Service make clear that consent to search in civil litigation cases, the Terms of Service do not address searches related to criminal prosecution. By accepting Telegram’s Terms of Service, you are agreeing to have your data stored on their servers in the cloud. You are not agreeing to have your data stored for the purpose of a warrantless search. This is an important point for individuals who may face charges under federal law.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.