INVESTIGATIONS / SURVEILLANCE — OCTOBER 26, 2026 — For years, Telegram cultivated an image as the messaging service least inclined to cooperate with governments. But a document newly surfaced in federal court makes that reputation harder to accept at face value: in one specific investigation, Telegram supplied U.S. authorities with identifying account information—including a phone number, a numeric user ID, and a timestamped internet address.
The document was brought to public attention in an October 16, 2026 investigation by 404 Media journalist Joseph Cox, produced with the independent court-records project Court Watch. The significance is not that the public had never heard that Telegram cooperated with police. Its own transparency figures already established that. This time, reporting describes what an actual response looked like. Read the original reporting at 404 Media.
1. The letter: three pieces of data and a much larger privacy question
According to the portion of the 404 Media article available publicly, newly filed court documents include a Telegram letter furnishing a phone number, Telegram user ID, and IP address for a particular user. Follow-up reporting describes the IP address as carrying a date-and-time entry, and describes the correspondence as a brief, case-specific response. The full underlying filing was not independently available for this report; those additional details are attributed to the outlets that examined or summarized it.
An account ID gives investigators a stable reference for one Telegram account. The phone number may help them connect that account to telecommunications records or other evidence. The IP address identifies an internet connection used at a particular time; paired with a sufficiently precise timestamp, it can provide an investigative lead for seeking subscriber or connection information from an internet provider. None of these three fields, by itself, establishes who physically held a device or wrote a particular message.
We are deliberately not reproducing the individual’s phone number, account identifier, or IP address. The accountability issue is what Telegram was willing and able to furnish, not the exposure of one user’s private identifiers to a wider audience.
2. Did Telegram obey a court order—or volunteer the information?
404 Media says the records show Telegram providing information following a court order. A follow-up summary of the filing reports that Telegram also described its response as voluntary and reserved its legal position about U.S. jurisdiction. Those descriptions are not necessarily contradictory: a company can choose to provide information after reviewing judicial process while declining to concede that every court has unlimited authority over it.
The distinction still matters. A legal request, a search warrant, a court order, a company’s voluntary cooperation, and a disclosure compelled by an enforceable ruling are not interchangeable legal events. The publicly accessible material does not permit an independent determination of precisely which assertions Telegram would have contested in court or what would have happened had it refused.
Secondary coverage places the document in a federal criminal case in Louisiana. That reported case context does not imply the account holder committed a crime, and the provision of subscriber data is not a verdict about the person identified. The reported filing should be read as evidence about one disclosure, not proof of a universal disclosure practice.
3. What Telegram’s privacy policy actually promises
Telegram’s published privacy policy says that after receiving a valid order from relevant judicial authorities confirming that a user is a suspect in criminal activities violating the platform’s terms, Telegram conducts a legal analysis and may disclose the user’s IP address and phone number. The wording allows disclosure; it does not promise that all requests will be approved.
This broader formulation dates to Telegram’s September 2024 policy change. Earlier language focused on terrorism-related orders. The company expanded the circumstances under which it might provide metadata after the arrest of Telegram founder Pavel Durov in France in August 2024, amid disputes involving platform misuse and cooperation with investigations.
The court letter therefore appears consistent with a category of cooperation that Telegram publicly acknowledged more than two years ago. What is newly illuminating is the concrete, document-level example—not an unexpected announcement that all private messages are now accessible.
4. The 2,253-user figure: exactly what it means
The number highlighted in the supplied material—2,253 affected users—comes from Telegram’s reported 2024 U.S. transparency figures, publicized in January 2025. It should not be presented as a fresh total for October 2026. Reports from 404 Media, TechCrunch, and BleepingComputer recorded 900 fulfilled U.S. requests affecting those 2,253 users during 2024.
| Reporting period | Fulfilled U.S. requests | Affected users reported |
|---|---|---|
| January–September 2024 | 14 | 108 |
| October–December 2024 | 886 | 2,145 |
| Full year 2024 | 900 | 2,253 |
| Full year 2025 (independent aggregation) | 1,706 | 4,807 |
This table shows the dramatic change in reported cooperation after September 2024. The numbers count fulfilled requests and users affected by those requests, not convictions, proven crimes, or copies of complete conversations. One request can involve more than one user; a count of “affected users” should not be mistaken for an independently verified list of distinct individuals over every time period.
An open-data project maintained by security researcher Te-k compiles Telegram transparency-bot results contributed across countries. It reports 1,706 fulfilled U.S. requests affecting 4,807 users for 2025. Because that archive is crowdsourced and the bot is accessed through country-specific Telegram accounts, the source and limitations must travel with the number.
5. Why a phone number and IP address can be powerful without the messages
People often imagine surveillance as someone reading the text of a secret conversation. But metadata can reveal useful details even when content is unavailable. A phone number may connect an account with other registration records. A timestamped IP address can potentially link an account session to a network or internet provider. Investigators may then seek additional evidence from that provider, another service, or a seized device.
There are limits. IP addresses may be shared by households, workplaces, public Wi-Fi networks, cellular carriers, or network-address-translation systems. People may change networks or use privacy tools. A phone number can be reassigned, borrowed, compromised, or registered in someone else’s name. Technical attribution requires multiple independent pieces of evidence, not a simple leap from an account identifier to guilt.
The publicly described Telegram letter did not establish that Telegram handed over message text, contact lists, or a complete account history in that instance. Nor does an absence of those items in one disclosed letter prove that no other data could ever be obtained in another investigation. It shows what the accessible reporting documents for this case.
6. “Encrypted” does not describe every Telegram conversation the same way
Telegram operates two distinct types of private chats. Ordinary Cloud Chats are encrypted between clients and Telegram’s servers and stored within Telegram’s cloud infrastructure, allowing synchronization across devices. Optional Secret Chats are end-to-end encrypted; Telegram says only the participating devices hold the keys necessary to read them, and Secret Chat contents are not stored as readable messages in its cloud.
That distinction is easy to miss in popular discussions of “encrypted messaging.” Using Telegram does not mean every chat is protected by end-to-end encryption by default. At the same time, learning that Telegram supplied account metadata does not show that Secret Chat encryption was broken or bypassed. Both facts can be true. Telegram’s policy explains the difference.
End-to-end encryption is chiefly a protection for message contents, not a guarantee that a service holds no phone number, account identifier, connection information, or other operational records. People who need strong confidentiality should distinguish between protection of message text, protection of metadata, security of their devices, and how recipients handle information after receiving it.
7. What changed after the founder’s arrest?
In August 2024, French authorities arrested Telegram founder Pavel Durov as part of an investigation concerning alleged criminal activity facilitated through the service and its responses to authorities. In September, Telegram widened the language of its law-enforcement data policy. Its U.S. disclosure statistics then increased sharply in the final quarter of 2024.
The timing supports a conclusion that the company’s public cooperation posture changed. But the figures by themselves do not show which individual requests would have been approved under the previous rules, whether the mix of investigations changed, or what investigative value each response delivered. A visible jump is not a complete explanation of every decision.
8. Privacy and legitimate investigations are not mutually exclusive questions
Messaging services can be used for ordinary conversations, journalism, activism, business, private family communication, and coordination of crimes. There are serious reasons authorities seek evidence in investigations, including cases involving exploitation, fraud, or violence. There are equally serious reasons to demand narrow legal process, safeguards against surveillance overreach, and accurate attribution before innocent people are accused.
A responsible assessment asks whether a request was specific and lawful, whether Telegram reviewed it independently, what categories of information were actually delivered, and how the receiving agency stored, accessed, and used the data. The fact that an application has a privacy-focused reputation is not an adequate substitute for understanding these procedures.
9. What the company still does not reveal through a headline number
Quarterly or annual transparency totals rarely explain every legal basis, the full number of demands rejected, whether requests were contested, the retention periods for account and connection records, or how many disclosures later proved mistaken. One public letter provides an additional window but cannot answer all these questions for Telegram’s global operations.
Stronger transparency would show the categories of process served, how often requests are denied or narrowed, how many users are notified when lawful, and how account-connection data is retained and audited. Independent courts and journalists should be able to scrutinize both a government’s authority to demand information and a platform’s justification for granting access.
10. What readers should take away
A sensible reading of the evidence reaches three conclusions. First, Telegram has in fact supplied user account metadata to U.S. authorities, and the October 2026 court reporting gives a concrete example. Second, the 2,253-user count belongs to the 2024 transparency reporting period and is not the latest total. Third, disclosure of phone numbers and connection information is different from proof of government access to Secret Chat message contents.
For someone assessing privacy tools, the useful questions are practical: Which chats use end-to-end encryption by default? What identifying data is required for registration? What information does the provider retain? Under what legal processes can it be disclosed? Can the company access message contents? How often does it publish meaningful transparency statistics?
Apep Bar’s question
When a messaging app promises privacy, does that promise protect what you say, who you are, where you connect from—or only some of those things?
Question. Investigate. Reconsider.
Sources and further reading
404 Media / Court Watch investigation (October 16, 2026) · Related YouTube Short supplied by reader · Avenews: court-letter summary · Anoni.net: independent coverage and limitations · 404 Media’s earlier reporting on the policy change · BleepingComputer: 2024 transparency figures · Crowdsourced Telegram transparency dataset · Telegram privacy policy and chat types.
Editorial transparency: The 404 Media article’s full text and the underlying court filing were not independently available without access restrictions. The document-level facts are based on 404 Media’s public excerpt and attributed secondary coverage. The supplied YouTube Short could not be independently transcribed. No private account identifiers or message contents are reproduced here. The featured photograph is an illustration, not the Telegram letter itself. Featured image: Franck / Unsplash.
