Search papers, labs, and topics across Lattice.
This study introduces TeleGapper, a dynamic analysis framework designed to evaluate the privacy practices of Telegram Mini Apps by monitoring their runtime network traffic and comparing it to disclosed privacy policies. The analysis of 278 Mini Apps reveals that a significant majority (59.4%) communicate with undisclosed third parties, and 78.8% depend solely on Telegram's generic default privacy policy, often lacking user consent mechanisms. These results highlight critical transparency and compliance issues within a rapidly growing ecosystem that has received little scrutiny regarding user privacy.
Over half of Telegram Mini Apps leak data to undisclosed third parties, revealing a shocking compliance gap in user privacy protections.
Telegram Mini Apps are Web applications embedded within the Telegram client, forming an ecosystem of third-party services within one of the world's most widely used messaging platforms. Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored. Unlike ecosystems such as WeChat, which rely on tightly controlled, proprietary execution frameworks, Telegram adopts a different model: Mini Apps run inside a WebView, combining platform-provided context with standard Web capabilities and unrestricted outbound networking. This enables applications to transmit sensitive information to analytics, advertising, tracking, or other third parties through ordinary Web requests, often with limited visibility. Privacy disclosures are therefore critical for transparency. Telegram allows Mini Apps either to define an application-specific privacy policy or to rely on a platform-provided default policy. While the latter reduces the developer's disclosure burden, it may lead to generic statements that do not accurately capture actual data practices of individual Mini Apps. In this paper, we present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps by capturing runtime network traffic, identifying third-party communications, and comparing observed data flows against disclosed privacy information. We evaluate 278 working Mini Apps collected from tApps Center, a community-driven catalogue for discovering third-party applications in Telegram. We find that 59.4% contact at least one undisclosed third party, 78.8% rely exclusively on Telegram's default privacy policy, and none provides a consent or opt-out mechanism. These findings expose a substantial transparency and compliance gap in a widely used yet understudied ecosystem.
