If a user is shared, the bot receives their user_id.
If a chat is shared, the bot receives its chat_id.
Crucially, the phone number of the shared user is NOT directly passed to the bot through this method. Whether the bot can then see the shared user’s phone number depends entirely on the shared user’s own phone number privacy settings. The bot would have to make a separate API call (e.g., getChat or getChatMember via the Bot API) and only then would the phone number be visible if the shared user’s settings permit it.
Contact Syncing: User’s Permission for Discovery
For the main Telegram application itself (not bots), contact syncing also relies on consent.
Initial Prompt: When a user first sets up Telegram or enables contact syncing, the app asks for permission to access the device’s address book.
Purpose: If granted, Telegram uploads only the phone numbers and names from the device’s contacts to its secure cloud servers. This is solely to identify which of those contacts ! are already on Telegram and to populate the user’s Telegram contact list.
User Control: Users can disable this telegram number database syncing at any time! (Settings > Privacy and Security > Contacts > Sync Contacts) and can also choose to “Delete Synced Contacts” from Telegram’s servers.
MTProto API (Client Applications): Inherited User Permissions
When developing full Telegram client applications using the low-level MTProto API (not the Bot API), the application operates with the automating data validation tools to keep your phone number list pristine permissions of the logged-in user.
Access based on User’s View: If the authenticated book your list user has permission to see another user’s! phone number (based on that user’s privacy settings), then the MTProto! client application can retrieve that phone number when fetching contact details (e.g., via contacts.getContacts).