Nigerian Court Rules on Truecaller Contacts and Data Privacy

Truecaller solves a problem almost every Nigerian with a phone understands.
An unfamiliar number calls you. You have no idea whether it is a delivery rider, potential customer, old acquaintance or someone trying to scam you.

If Truecaller can identify the number, its caller-ID system can display a name or warn that other users have reported the number as spam. Truecaller says its services include identifying unknown callers, detecting spam and fraud, and allowing number lookups. That can be genuinely useful. But a Lagos State High Court judgment dated September 14, 2026 raises a more complicated question:

What happens when the person being identified never joined Truecaller in the first place?

Your Consent Isn't Automatically Your Contact's Consent

The case was brought by the Incorporated Trustees of the Data Privacy Lawyers Association on behalf of people who did not use Truecaller.
One applicant, Esther Odunze, said she discovered that her identity and telephone number could be found through Truecaller despite never registering for the service. The applicants argued that Truecaller had no lawful basis to process non-users' numbers merely because those numbers existed in another person's contacts.

Justice N. O. Ojuromi agreed with an important part of that argument. The court found that consent given by a Truecaller user was insufficient to establish that people stored in that user's contacts had themselves consented. The judge summarised the distinction simply: Consent to one does not equate to consent to the other.
That principle could matter far beyond Truecaller. Think about how many applications request access to your contacts. Your phonebook may contain your mother's number, your doctor's details, customers, former colleagues, business contacts and people who have never heard of the application you're installing.

You can decide what happens to your information. The judgment challenges the idea that your decision automatically gives a platform permission to process everybody else's personal information too.

But the Court Did Not Find Truecaller Liable

This distinction is important. Despite rejecting the idea that a user's consent automatically becomes a non-user's consent, the court ultimately dismissed the application.
The judge found that the applicants had not established an actual infringement of their fundamental rights with sufficient evidence. The court also noted circumstances including deletion of applicants' information following their complaints. Report on the dismissed Truecaller case
So this wasn't a judgment declaring Truecaller unlawful in Nigeria. Instead, it produced something arguably more interesting for the wider technology industry: judicial reasoning about where consent stops.

Truecaller Says Its Current App Doesn't Upload Your Phonebook

There is another important clarification. Truecaller currently says that versions distributed through Google Play and Apple's App Store do not upload users' contact lists to its servers. It says contact access happens locally on the device so the application can distinguish numbers already saved by the user from unknown callers.
Its Nigeria privacy policy makes a more detailed distinction. It says App Store and Google Play versions don't receive, store or share address-book contacts, while an “Enhanced Search” feature associated with versions obtained from other sources can accept contact information if users specifically enable it. That context matters when interpreting the case. The dispute concerned how non-user information could be processed and whether another user's permission could provide the necessary consent—not a finding that every current Truecaller installation automatically uploads an entire phonebook.

Why This Matters for Nigeria's Scam Problem

Caller identification can itself be a privacy and security tool. Someone receiving a suspicious call can see that a number has been reported as spam and decide not to answer. Truecaller says spam detection is one of the purposes for which it processes relevant information.
But there is a tension. Protecting one person from an unknown caller shouldn't automatically eliminate another person's control over their personal information.

Nigeria's Data Protection Act recognises multiple lawful bases for processing personal data—not only consent, including contractual necessity, legal obligations, vital interests, public interest and legitimate interests. Where consent is the basis, however, the Act says it must be affirmative; silence or inactivity does not constitute consent.
That makes the Truecaller judgment relevant to many other products.

• A fintech app might ask for your contacts.

• A lending application might request them.

• A social platform might want to find your friends.

• An AI application might ask you to upload emails, documents or customer records.

The same question follows: Do you actually have the authority to give that company everybody else's data?
We recently examined Nigeria's growing data-protection infrastructure after the government converted an EFCC-recovered property into the NDPC's permanent headquarters in our analysis of the NDPC and digital fraud.
The issue will become even more important as AI systems consume increasingly large amounts of information. We explored that wider problem in Data Privacy Concerns Grow as AI Continues to Advance.

The Bigger Lesson Isn't Really About Truecaller

Truecaller demonstrates the trade-off particularly well because the usefulness of caller identification is obvious. If an unknown number calls you, knowing who may be behind it can save time and potentially help you avoid unwanted or fraudulent calls.
But useful technology still needs boundaries. The Lagos judgment suggests one of those boundaries is becoming clearer in Nigeria: access to one person's device should not be treated as unlimited permission over every person represented inside it.
That principle could eventually affect far more than caller-ID applications. Our phones have become databases containing pieces of other people's identities. AI and increasingly powerful digital platforms make extracting value from those relationships easier than ever.
Nigeria's privacy debate is therefore moving beyond a simple question of whether someone clicked “Allow.”
The more important question is: Whose data did they actually have the right to allow?

Read more: Nigeria's NCC Device Management System: How IMEI Registration Could Fight Crime
Read more: Africa Needs Its Own Data Centres But There Is One Major Problem: Power