Truecaller says Nigerians can remove their phone numbers from its caller-identification service following a Lagos High Court ruling that dismissed a privacy case brought by people who do not use the platform.
The company said its unlisting tool allows non-users to request the removal of their phone numbers and associated caller identity from its active searchable database.
“We welcome the court’s recognition that caller identification and spam detection serve an important public-safety purpose in protecting Nigerians from scams, fraud and harassment,” a Truecaller spokesperson said in a statement on Monday.
The statement comes after a legal dispute over how the company collects and processes the phone numbers and names of people who have never signed up for Truecaller.
The case was brought by the Incorporated Trustees of the Data Privacy Lawyers Association on behalf of non-users. The applicants argued that Truecaller’s collection, storage and disclosure of their phone numbers violated their privacy rights under Section 37 of the Nigerian Constitution and Part V of the Nigeria Data Protection Act (NDPA).
They asked the court to stop Truecaller from processing the data of non-users, order the company to delete the information and award ₦300 million in general and exemplary damages.
The Lagos High Court dismissed the applicants’ claims and rejected their requests for injunctions and damages.
However, the judgment drew an important distinction between consent and whether the applicants had provided enough evidence to establish an actionable violation of their fundamental rights.
Court rejects implied consent argument
One of the key issues before the court was whether Truecaller could rely on the consent given by its users when those users uploaded contacts containing the phone numbers of people who had never joined the platform.
The court rejected that argument.
It held that a Truecaller user’s decision to upload contacts did not, by itself, amount to consent from the people whose information appeared in those contacts.
The court said relying on such implied consent would undermine the meaning of privacy and consent under Nigeria’s data protection law.
The judgment also stated that Truecaller, in the circumstances considered by the court, had responsibilities as both a data controller and processor. This included protecting personal data and ensuring it was not disclosed to third parties without a legitimate basis.
Lawyers say the ruling does not settle the consent question
Olumide Babalola, chair of the Nigerian Bar Association’s Data Protection Committee and lawyer to the applicants, said the dismissal should not be interpreted as a complete endorsement of Truecaller’s approach to consent.
According to Babalola, the court’s decision was influenced by the applicants’ failure to provide sufficient evidence of damages.
“The only issue the court found, which helps them, is that we did not attach evidence of damages,” Babalola said. “That does not detract from the findings on lack of consent and legitimate interest.”
Truecaller, however, maintains that consent is not the only legal basis for processing the information.
The company relied on provisions of Section 25 of the NDPA relating to public and legitimate interests, as well as the public-safety exception under Section 45 of the Nigerian Constitution.
Truecaller said its caller-identification, spam-detection and fraud-screening features help people identify potentially suspicious or malicious calls.
The company also said the court recognised that caller identification can serve a public-safety purpose and that its processing activities may be supported by lawful grounds beyond implied consent.
Nigerians can request removal
Despite the court’s dismissal of the case, Truecaller says people who do not use its service can still request that their information be removed from its searchable database.
This means Nigerians who do not want their phone numbers and associated caller information displayed through Truecaller can use the company’s unlisting option to request removal.
The development comes as questions around consent, privacy and the use of personal data continue to receive greater attention in Nigeria following the implementation of the Nigeria Data Protection Act.
Truecaller said the court’s recognition that caller identification and spam detection can serve a public-safety purpose was central to the outcome.
But the judgment did not say that public interest or legitimate interest automatically takes precedence over an individual’s privacy rights.
The court noted that legitimate interest under Section 25(1)(b)(v) of the Nigeria Data Protection Act has limits, particularly where processing would override the fundamental rights, freedoms and interests of the person whose data is being used.
The court then considered a separate question: whether the applicants had provided enough credible evidence to prove that their constitutional right to privacy had actually been violated.
How Truecaller says its search system works
One part of Truecaller’s defence focused on how its search function operates.
The company described it as a “number-for-name” system. This means a person must already have a phone number before using the service to find the name associated with it.
Truecaller argued that this does not give strangers access to private contact details they did not already have.
The company also disputed the idea that it automatically uploads users’ entire address books.
According to the court’s ruling, contact information is uploaded only when a user activates an optional Enhanced Search feature on certain versions of the app distributed outside official app stores and confirms that they are authorised to share the contacts.
Truecaller will keep operating in Nigeria
Truecaller said the ruling does not require it to suspend or redesign its service in Nigeria.
The company pointed to the court’s rejection of requests to stop it from processing non-user data and to force the deletion of information already held on its systems.
It also highlighted its unlisting option, which allows people who do not use Truecaller to remove their numbers from the service.
“Anyone, whether or not they use Truecaller, can remove their number from our service at any time through our unlisting page,” the spokesperson said.
People can make the request through Truecaller’s unlisting portal.
After a number is removed, Truecaller said it retains a one-way cryptographic hash to prevent the same number from being accidentally added again if an existing user later synchronises their contacts. The company said the hash cannot be reversed to recover the original number.
Truecaller said it takes its obligations under the Nigeria Data Protection Act seriously and will continue engaging with stakeholders on data privacy issues.
The case may not be over
Although the Lagos High Court has dismissed the case, the dispute may continue.
Babalola said the applicants plan to appeal the court’s treatment of injury arising from privacy violations. This leaves some questions about the remedies available to people whose personal data is processed without their consent unresolved.
The ruling nevertheless establishes an important distinction.
The court found that a Truecaller user’s consent to share contacts was not, by itself, enough to establish implied consent from people whose numbers appeared in those contacts. At the same time, it held that the applicants had not provided sufficient evidence to establish a constitutional privacy violation in the circumstances of the case.
That distinction could become important in future disputes involving apps and services that rely on contact lists, caller identification, social discovery and other systems where one person provides information about another.
