Personal data in a Telegram bot, in plain words
What counts as personal data in bot conversations, why consent matters, and what a policy has to say.
This does not replace a lawyer, but it helps to know what the discussion is about if you build a bot or choose a service.
What counts as personal data
The Telegram identifier, first name and username already identify a person. Message texts count too when someone can be recognised from them.
In other words almost any bot processes personal data, even if it never asks for a passport.
What follows from that
Consent. People must understand what they agree to. In a bot that is a screen on first launch with a link to the policy and an explicit action — an “I agree” button, not fine print.
A privacy policy. What you collect, why, how long you keep it, who receives it, how to delete it. In plain language rather than a translated template.
Retention. Data is not kept forever “just in case”. Name a period and honour it — that is verifiable.
Deletion. People need a way to take their data back: a clear procedure, not an email to support.
Localisation. For Russian citizens the law requires primary processing inside the country. A server abroad is a conscious risk worth knowing about.
The practical minimum
Consent on first launch, a policy on the site, a retention period, a button to delete the account. See how we did it on the data and security page.