Privacy Limits Established: Nigerian Court Rules Truecaller Cannot Scrap Phone Contacts Without Permission

A Nigerian court has delivered a landmark judgment on digital privacy, ruling that caller-identification service Truecaller cannot use a single user's consent to harvest and process the contact details of third parties stored on their mobile phone.

The decision addresses a widespread practice among smartphone applications that require access to address books as a condition of service, exposing millions of unsaved contacts to cross-border data aggregation, according to Reuters.

For everyday smartphone users across Africa, the ruling draws a sharp legal line between individual permission and collective privacy, according to The EastAfrican. It means tech platforms operating on the continent can no longer assume that one person downloading an application gives them legal cover to index the names, phone numbers and personal details of everyone listed in that phone’s address book without those third parties explicit permission.

Addressing Privacy Limits

As reported by TechCabal, the court determined that Truecaller's existing consent mechanism fails to cover the secondary data collected from users' contact lists. While an individual downloading the application agrees to the platform's terms of service, that single agreement does not constitute lawful authorisation to collect, store or profile people who have never interacted with the service.

The platform relies heavily on crowdsourced address books to build its global directory of caller identities. When an user syncs their contacts, numbers and names are added to the wider registry, allowing subscribers to identify incoming calls from unknown numbers.

The court's decision challenges this core architecture by establishing that third-party data subjects retain their constitutional right to privacy regardless of whether their acquaintances uploaded their details.

Mounting Regulatory Pressure

African data protection authorities have systematically tightened enforcement around consent and cross-border data transfers over recent years. Nigeria's Data Protection Act mandates that personal data processing must rest on explicit, informed and freely given consent, or another recognised legal basis such as statutory obligation.

The legal finding against Truecaller creates compliance exposure for numerous digital platforms operating across West Africa that rely on phonebook scraping for growth, friend-matching or fraud detection.

Technological compliance presents significant operational hurdles. Restricting contact scraping without compromising caller-identification features would require platforms to re-architect how their databases source and verify unknown caller records.

Truecaller audit onboarding flows and strip mandatory uploads

Legal experts expect the ruling to set a persuasive precedent for data protection commissions and courts across East and West Africa, where regulators are actively reviewing how global consumer applications handle citizen data.

The decision is likely to compel consumer software developers and global technology firms operating across the region to audit their onboarding flows and strip out mandatory contact list uploads.

Data privacy advocates are watching to see whether Truecaller will appeal the judgment or introduce localized privacy controls that restrict third-party contact processing within African jurisdictions.

Related coverage: A Sudden Digital Pause: Portal Shutdown Halts Nigerian University Admissions