Lagos Court Rejects Truecaller’s Reliance on Proxy Consent for Contact Data

A Lagos High Court has ruled that Truecaller cannot rely on a user’s consent to process the phone numbers of people who never used the caller-identification application.

The decision, dated September 14, 2026, rejected the argument that one person can provide consent on behalf of everyone whose contact details appear in that person’s phonebook under Nigeria’s Data Protection Act.

Applicants challenged processing of their numbers

The case was brought by the Incorporated Trustees of the Data Privacy Lawyers Association and members of the association who said they had never used Truecaller. They argued that the company harvested, stored and disclosed their telephone numbers without consent, contrary to their privacy rights and the Nigeria Data Protection Act of 2023.

The applicants said the processing exposed non-users to risks including unsolicited messages, surveillance, identity theft, loss of control over personal information and distress. They sought declarations, orders preventing further collection and processing, deletion of non-user data, and ₦300 million in general and exemplary damages.

Truecaller told the court that users could voluntarily upload contact information through an optional Enhanced Search feature available in certain versions of the application. The company said users represented that they were authorised to share the information and had obtained the necessary consent.

Truecaller also said its caller-identification and spam-detection services served public-safety purposes and were available whether or not a user activated the optional contact-upload function. In court filings, the company stated that it had no Nigerian office, server or operational facility, and that its technical infrastructure was located in India.

Court addresses consent requirements

The ruling referred to Sections 26 and 65 of the Nigeria Data Protection Act. Consent under those provisions must be voluntary, informed, specific and unambiguous, with the data controller required to demonstrate that valid consent was obtained.

Olumide Babalola, counsel for the applicants, said the judgment confirmed that consent cannot be inferred for people who did not know their information was being processed. “You cannot use consent by implication or consent by proxy,” he said in an interview about the decision.

Babalola said the court had found that Truecaller could not treat a user’s consent as the consent of non-users in that person’s contacts. He also argued that the judgment did not identify a lawful basis for processing the data, although that interpretation was presented as the applicants’ counsel’s view and does not establish what future operational changes Truecaller must make.

The ruling itself did not specify the exact technical or operational steps Truecaller must take. Truecaller has said users can disable the optional contact-upload feature and that non-users can request deletion of their data. The company has also said that, after deletion, it retains only a one-way hash intended to prevent the data from being accidentally reintroduced.

No damages awarded

The court did not award damages. According to Babalola’s account of the ruling, the applicants did not provide sufficient evidence that they had suffered material harm from disclosure of their numbers.

The decision therefore separates the question of whether consent was valid from the evidence required to support a substantial compensation claim. Babalola questioned whether intangible harms such as loss of control, autonomy and dignity should also be considered in privacy cases.

The case was decided under the Nigeria Data Protection Act, which came into force in June 2023. It differs from an earlier Federal High Court case involving Truecaller that was decided under the 2019 Nigeria Data Protection Regulation. In that earlier matter, users who uploaded phonebooks were treated as controllers of non-users’ data and were held responsible for obtaining consent.

The ruling could raise wider questions for digital services that request access to contact lists, address books or other crowdsourced identity databases. It remains unclear from the available information whether Truecaller will appeal, what changes it may make, or how broadly the decision will apply to other platforms.