Truecaller says Nigerians who do not want their phone numbers listed on its caller-identification platform can have them removed, following a Lagos High Court decision dismissing a privacy lawsuit brought on behalf of non-users.
The company told TechCabal that its unlisting system is available to anyone, including people who do not use the application themselves. Through the tool, individuals can request that their phone number and associated caller identity be removed from Truecaller’s active searchable database.
Lagos court rejects privacy claims
The legal dispute centred on how Truecaller handles phone numbers and identities belonging to people who have never registered for the service.
The applicants, including the Incorporated Trustees of the Data Privacy Lawyers Association acting for non-users, argued that the collection, storage and disclosure of such information breached constitutional privacy protections and provisions of the Nigeria Data Protection Act.
They asked the court to stop Truecaller from processing non-users’ information, order the deletion of data already held and award ₦300 million in general and exemplary damages.
The Lagos High Court rejected the applicants’ claims for damages and declined to issue the requested prohibitory and mandatory orders.
Court draws a line between user and non-user consent
One significant aspect of the judgment concerned the question of consent.
The court rejected the argument that when a Truecaller user agrees to the company’s terms or uploads contacts, that action automatically establishes consent from people whose information appears in the user’s address book.
The court found that a user’s voluntary agreement to upload contact information was not, by itself, sufficient to establish implied consent from non-users.
It warned that accepting such an interpretation could undermine the privacy protections and consent requirements established under Nigerian data-protection law.
Legitimate interest remains subject to privacy rights
The judgment also considered the legal grounds Truecaller relied on to justify processing information.
The company argued that it could process data under legitimate-interest and public-interest provisions of the Nigeria Data Protection Act, rather than relying solely on consent.
Truecaller also pointed to constitutional provisions concerning public safety, maintaining that caller identification, spam detection and fraud screening can help protect people from scams, harassment and malicious calls.
However, the court’s reasoning also indicated that legitimate interest is not unlimited. Under the relevant provision of the data-protection law, legitimate interest is restricted where it overrides the fundamental rights, freedoms and interests of the individual whose information is being processed.
Applicants failed to establish actionable privacy injury
The court’s dismissal ultimately turned on a separate issue: whether the applicants had provided sufficient evidence to establish an actionable infringement of their constitutional privacy rights.
Olumide Babalola, chair of the Nigerian Bar Association’s Data Protection Committee and counsel to the applicants, said the judgment should therefore not be interpreted as a complete validation of Truecaller’s approach to consent.
Babalola told TechCabal that the finding that assisted Truecaller related to the applicants’ failure to provide evidence of damages. He maintained that this did not remove the court’s findings concerning consent and legitimate interest.
Truecaller defends its caller-identification model
Truecaller has maintained that its service operates primarily as a “number-for-name” system.
Under this model, a person searching for an identity must already possess the relevant phone number before a name can be displayed. The company argued that this differs from exposing private contact information to an unknown third party.
The company also disputed the suggestion that it automatically uploads users’ entire address books.
According to the judgment excerpts reviewed by TechCabal, contact information is uploaded only when a user activates an optional Enhanced Search feature in certain versions of the application outside app stores and confirms that they are authorised to share the contacts.
Company will keep operating in Nigeria
Truecaller said it does not intend to suspend or redesign its Nigerian service following the court’s decision.
The company pointed to the court’s rejection of requests that would have stopped the processing of non-user information or required previously held data to be deleted.
At the same time, it said individuals who do not use Truecaller can independently remove their numbers through its unlisting portal.
Unlisting is available to non-users
Truecaller said the opt-out process is open to anyone, regardless of whether they have an account with the service.
The company said that after a number is removed, it retains a one-way cryptographic hash designed to prevent the same number from being accidentally reintroduced if an active user later synchronises a phonebook.
According to Truecaller, the hash cannot be reversed to recover the original number.
Legal battle may continue on appeal
Although the Lagos High Court has dismissed the case, the dispute may not be over.
Babalola said the applicants intend to appeal the court’s treatment of injury arising from alleged privacy violations.
The case has consequently left several broader questions about privacy remedies under Nigerian data-protection law open for further consideration.
Ruling could influence future data-privacy disputes
The judgment highlights a legal distinction that could become increasingly important as digital services rely on information supplied by one person about another.
The court found that consent given by an application user does not, on its own, establish implied consent from a non-user. It also indicated that legitimate interest cannot simply override fundamental rights.
At the same time, the applicants’ failure to establish an actionable constitutional privacy violation with sufficient evidence resulted in the dismissal of their claims.
Those distinctions could become relevant in future disputes involving contact-list applications, caller-identification platforms, social-discovery services and other technologies that process information about people who may never have directly signed up for them.
