59.4% of Telegram Mini Apps Contact Undisclosed Third Parties and None Offer Opt-Out

arXiv 2608.13390·medium signalXBlueskyLinkedInCopy link

TeleGapper is a black-box dynamic analysis framework that captures runtime network traffic from Telegram Mini Apps, identifies third-party communications, and compares observed data flows against disclosed privacy information. Across 278 working Mini Apps collected from the tApps Center catalogue, 59.4% contact at least one undisclosed third party, 78.8% rely exclusively on Telegram's platform-default privacy policy, and none provides any consent or opt-out mechanism. Unlike WeChat's tightly controlled proprietary runtime, Telegram Mini Apps run in a WebView with unrestricted outbound networking, which is exactly what makes the disclosure gap enforceable only by observation.