Lagos Court Rejects Truecaller’s Use of Proxy Consent for Non-Users’ Numbers

The Lagos High Court has ruled that Truecaller cannot rely on the consent of one user to process the phone numbers of people saved in that user’s contacts who did not use the caller-identification service.

The decision, delivered on September 14, 2026, rejected the idea that a person can provide consent on behalf of everyone in their phonebook under Nigeria’s Data Protection Act.

Applicants challenged contact-data processing

The case was brought by the Incorporated Trustees of the Data Privacy Lawyers Association and members who said they did not use Truecaller. The applicants alleged that the company harvested, stored and disclosed their telephone numbers without consent, in breach of their privacy rights and the Nigeria Data Protection Act.

They sought declarations against the processing, orders preventing further collection and use of their data, deletion of non-user information and damages. The applicants claimed ₦300 million in general and exemplary damages.

The court’s ruling was made under the Nigeria Data Protection Act, which came into force in 2023. The decision differs from an earlier Federal High Court case involving Truecaller that was decided under the Nigeria Data Protection Regulation of 2019.

Truecaller relied on optional feature

Truecaller told the court that users could voluntarily upload contact information through an optional Enhanced Search feature available in certain versions of the app. The company said users represented that they were authorised to share the information and had obtained the required consent.

The company also said it did not itself extract contact data from phones in Nigeria. According to its court position, users could disable the upload feature, while its caller-identification and spam-detection services served public-safety purposes. Truecaller further said non-users could request that their information be deleted.

Truecaller said it had no Nigerian office, server or operational facility and that its technical infrastructure was located in India. The source does not establish whether the company has appealed the ruling or what operational changes it may make.

Court rejects consent by proxy

Sections 26 and 65 of the Data Protection Act require consent to be voluntary, informed, specific and unambiguous, according to the report. The court found that consent given by a Truecaller user could not automatically extend to people whose numbers appeared in that user’s contacts.

Olumide Babalola, who explained the ruling, said: “You cannot use consent by implication or consent by proxy.”

He said the court had rejected the argument that the consent of users could be treated as consent from non-users. “Some non-users do not even know that anything called Truecaller exists. So how can they give implied consent to an entity that they do not know exists?” he said.

Babalola also stressed that permission for one form of processing does not necessarily cover another. “If I just say I give you consent to collect, you cannot use consent to collect as consent to share,” he said.

No damages awarded

Although the court rejected Truecaller’s reliance on the consent argument, it did not award damages to the applicants. Babalola said the court found insufficient evidence of concrete or material harm resulting from the disclosure of their numbers.

He said the ruling raised broader questions about whether privacy harms such as loss of control over personal data, autonomy, dignity or emotional distress should support compensation. The source says the legal treatment of those intangible harms remains unsettled in Nigerian privacy litigation.

The decision could affect other services that request access to contact lists, address books or crowdsourced identity databases. However, the report notes that such features do not all operate in the same way or expose data in identical ways.