No Default Access: Telegram bots do not have automatic access to a user’s phone number or contact list. This is a fundamental privacy design choice by Telegram.
Explicit User Consent:
The only way a bot can obtain a user’s own phone number is if the user explicitly shares it via a special KeyboardButton with the request_contact=True parameter. When pressed, this button triggers a native Telegram pop-up, asking the user to confirm telegram number database sharing their number.
>Limited Shared Contact Data: If a user shares another user’s contact information via a request_user or request_chat button, the bot typically only receives the user_id or chat_id, not the shared user’s phone number directly. Phone number visibility for shared users is still subject to their personal privacy settings.
Implement Data Minimization:
Collect Only What’s Necessary: Before requesting any personal data, including phone numbers, critically assess if your bot’s core functionality truly requires it. If a user_id or username is sufficient for identification and interaction, avoid requesting a phone number.
>Purpose Limitation: If you do collect a phone number, use it only for the specific purpose for which the user consented. Do not repurpose it for marketing! analytics, or other unrelated functions.
Clear Justification: Before presenting email address data privacy: keeping your information safe the request_contact button, clearly explain to the user why your bot needs their phone number (e.g., “Share your number to verify your account! “We need your number for delivery updates”).
Privacy Policy: Have a comprehensive and easily accessible privacy policy for your bot. This policy should detail:
What data you collect (specifically book your list mentioning phone numbers if applicable).
How you collect it (e.g., via explicit user sharing).