I've used Truecaller for years to identify unknown calls and spot potential scams. But the more I thought about how the app actually does that, the stranger it started to feel: what happens when the person it's identifying never agreed to be part of Truecaller in the first place?
A Lagos High Court ruling on September 14 put that question under the spotlight. The court found that a Truecaller user's consent to upload their contacts doesn't automatically amount to consent from the people in that contact list who never agreed to have their data processed.
For now, that doesn't mean Truecaller has to stop identifying callers. The court ultimately dismissed the application because the applicants didn't establish the infringement and resulting injury required for the reliefs they sought. But the reasoning behind the decision raises a bigger question about how apps can use our contact lists.
In other words, if I give Truecaller access to my contacts, I can consent to the processing of my own data. But can I consent on behalf of everyone whose number happens to be sitting in my phone?
The court's answer to that particular question was no.
Emmanuel Umahi
Why does this matter now?
This dispute puts companies that rely on contact lists, access to address books or crowdsourced identity databases in a difficult position: whose consent actually counts when the data belongs to someone else?
From a user's standpoint, uploading a contact list feels like a normal part of using an app. But for someone who doesn't use that app, their phone number can still end up being processed without their knowledge or consent.
While how data privacy harms should be valued remains a work in progress, Nigerian courts have been cautious about awarding substantial damages where a claimant cannot show direct financial loss or a concrete consequence.
A person whose exposed phone number leads to fraud, extortion, threats, discrimination, job loss or emotional distress may therefore have a stronger claim for compensation than someone who can show only that their data was processed without valid consent.
The ruling also marks a shift from an earlier Nigerian court case involving Truecaller. In that case, the court accepted, in substance, that Truecaller could rely on users' representations that they had obtained consent from people whose numbers were in their address books. This time, the Lagos High Court declined to follow that reasoning under the Nigeria Data Protection Act 2023.
What you should do
If you use Truecaller, check your privacy settings and whether you have enabled contact-uploading or "Enhanced Search" features. Depending on the version of the app, these features can be disabled.
Subscribe for free to continue reading this article
Subscribe SubscribeAlready have an account? Log in
