We’ve written before about checking whether a bot’s requested permissions match its stated function before trusting it — but that advice only works if you actually understand what each permission does. Telegram’s permission system has more layers than most people realize, and the names Telegram uses internally (manage_topics, anonymous, manage_ranks) aren’t always self-explanatory. This is a plain-language reference for what you’re actually agreeing to.
Two different permission systems, not one
The first thing worth understanding is that “bot permissions” on Telegram actually means two separate things:
- Admin rights — the same permission system used for human group/channel admins, which a bot can also be granted if you promote it to admin.
- Message visibility (privacy mode) — a separate, API-level setting controlling whether a bot even sees the messages sent in a group at all, independent of admin status.
Most guides only cover the first. Both matter.
Admin rights, explained one by one
These are Telegram’s own defined admin permissions (the same ones you’d see if you promoted a human to admin). Any bot can request some or all of these when added to a group or channel.
| Permission | What it actually lets the bot do |
|---|---|
| Change Info | Edit the group/channel name, description, and photo |
| Post Messages | Send messages as the channel itself (channels only) |
| Edit Messages | Edit any message already sent in the chat, including other people’s |
| Delete Messages | Remove any message from the chat |
| Ban Users | Remove members and prevent them from rejoining |
| Invite Users | Generate invite links and add new members |
| Pin Messages | Pin/unpin messages at the top of the chat |
| Add Admins | Promote other users (or bots) to admin — arguably the highest-trust permission on this list |
| Anonymous | Post and act without the bot’s actions being attributed to it in the member list |
| Manage Voice Chats | Start, stop, or moderate voice/video chats in the group |
| Manage Topics | Create, edit, and close topics in forum-style groups |
| Manage Direct Messages | Handle direct messages sent to a channel |
| Manage Ranks | Assign custom admin titles to other admins |
A few of these deserve extra scrutiny. “Add Admins” effectively means the bot could promote itself or another account to full control of your group — there’s rarely a good reason a moderation or utility bot needs this. “Delete Messages”combined with “Ban Users” is standard and reasonable for a moderation bot, but the same combination on a bot with no clear moderation function is a mismatch worth questioning, exactly the kind of check we described in our guide to spotting fake or abandoned bots.
Privacy mode: the permission most people don’t know exists
Separately from admin rights, every Telegram bot has a setting called privacy mode, controlled by the bot’s own developer through @BotFather — not something you grant as a user.
- Privacy mode ON (the default): the bot only receives messages that are commands (starting with
/), replies directly to one of its own messages, or mention it by username. It does not see the rest of the group’s conversation. - Privacy mode OFF: the bot receives every message sent in the group, in full, regardless of whether it was directed at the bot.
This matters enormously for AI-powered bots specifically. A bot that summarizes group conversations or answers questions based on chat context needs privacy mode off to function — that’s a legitimate reason to disable it. But it also means that bot is processing every message in the group, not just the ones aimed at it, which is worth knowing before you or your community treats a bot’s presence as background noise.
What to do: If a group you’re in adds an AI bot, it’s fair to ask the admin (or the bot’s own documentation) whether privacy mode is on or off. This one setting is arguably more relevant to your actual privacy than most of the admin rights list above.
Permissions that exist outside Telegram’s own system
Some of the most consequential permissions a bot can request aren’t part of Telegram’s admin rights system at all — they’re requested inside the bot’s own conversation flow, typically through a linked mini app or web view.
Wallet-connect / TON Connect permissions. Crypto bots often ask you to link a wallet, which can range from read-only balance viewing to full transaction signing authority. As covered in our piece on TON’s Agentic Wallets, some newer agent-based tools request a funded, dedicated wallet with a spending budget rather than access to your primary wallet — a meaningfully different (and generally safer) permission structure than handing over full wallet control.
Contact and phone number sharing. Telegram’s Bot API allows a bot to request your phone number or contact card, but only through an explicit, visible “Share Contact” button — it cannot silently pull this data. If a bot claims to already have your phone number without you ever tapping such a button, that’s a red flag, not a feature.
Location sharing. Similarly gated behind an explicit share action — a bot cannot access your location passively.
Payments. Telegram’s Bot Payments API lets a bot request a one-time payment through Telegram’s own payment flow, which is different from — and generally safer than — a bot asking you to send cryptocurrency directly to a wallet address or enter card details into a linked website.
A practical guide: what should each bot type actually need?
| Bot type | Reasonable to request | Worth questioning |
|---|---|---|
| AI Chatbot (Q&A only) | Nothing beyond basic message access | Admin rights, wallet access, contact sharing |
| Personal Agent | Privacy mode off (for context), calendar/reminder integrations you explicitly enable | Add Admins, unexplained wallet access |
| Group & Teams moderation bot | Delete Messages, Ban Users, Pin Messages, privacy mode off | Add Admins (unless it’s specifically a co-admin management tool), Manage Ranks |
| Crypto AI bot | Read-only wallet balance, or a dedicated funded agent wallet with a spending cap | Full wallet signing authority with no spending limit, requests to send funds to “verify” or “unlock” something |
| Image/Video Generation bot | Nothing beyond the prompt you send it | Group admin rights, message history access, contact sharing |
FAQ
No. A bot only ever sees messages sent directly to it in a private chat, or messages in a group where it’s present — and even then, only according to its privacy mode setting. Bots cannot access your other private conversations.
No. Admin rights control what a bot can do going forward (delete, ban, pin, etc.) — they don’t retroactively grant access to message history from before the bot joined the group.
Not necessarily — it means the bot’s software processes those messages, typically to generate a response or summary. Whether a human ever reviews that data, and whether it’s stored, depends entirely on the bot’s own privacy policy, which is exactly why checking that policy matters as much as checking the permission itself.
Only in narrow cases — for example, a dedicated admin-management bot whose entire function is promoting and organizing your moderation team. For nearly any other bot type, there’s little legitimate reason to grant it.
