Truecaller in Nigeria: the court rules your consent does not cover your contacts, but dismisses the case

When you install a caller ID app and agree to share your phonebook, you give your consent. But what about the dozens or hundreds of people saved in that phonebook, who asked for nothing? That is the question the Lagos State High Court settled in a ruling delivered in September 2026 against Truecaller, the Swedish app that displays callers’ names and filters unwanted calls.

The answer is nuanced, and that is what makes it important. On the substance, the court sided with the plaintiffs. On the outcome, it dismissed their case. For Nigerians, as for every company that processes data supplied by one person about another, the ruling draws a line.

Who sued, and why

The plaintiffs, among them the Incorporated Trustees of the Data Privacy Lawyers Association, were acting on behalf of people who do not use Truecaller. They asked the court to declare that the collection, storage and disclosure of their numbers violated the right to privacy guaranteed by Section 37 of the Constitution and by Part V of Nigeria’s 2023 Data Protection Act (NDPA).

They sought an end to the processing of non-users’ data, its deletion, and ₦300 million in damages, about $226,000.

Consent cannot be given on someone else’s behalf

On the central point, the judge was clear. The fact that a user accepted the app’s terms, or allowed their contacts to be uploaded, is not enough to establish implied consent from the people whose numbers appear in their phonebook. According to excerpts of the judgment published by TechCabal, accepting the company’s argument would empty the privacy rule, and the definition of consent laid down in the law, of their substance.

« Accepting this theory of implied consent would completely strip the privacy rule, and the statutory definition of consent, of their substance. »

Lagos State High Court, excerpt from the judgment (paraphrased)

The court also found that Truecaller acted, in this case, as both data controller and data processor, with a duty to protect this data and not to disclose it without a legitimate justification. It recalled that “legitimate interest”, another possible legal basis, reaches its limit when it encroaches on the fundamental rights and freedoms of the person concerned.

Truecaller’s defence

Truecaller did not rely on consent alone. The company invoked public interest and legitimate interest under Section 25 of the NDPA, as well as the public safety exception in Section 45 of the Constitution. Its argument: caller identification, spam detection and fraud filtering protect Nigerians against scams and phone harassment, a very real scourge in the country.

The company also described how its service works. Its search is said to be “number to name”: to see a name, you must already know the number. It would therefore not expose contact details to strangers. It says it does not upload address books automatically: according to the judgment, contacts are only shared if the user turns on an enhanced search feature, in certain versions of the app distributed outside the official stores, and confirms that they are authorised to do so.

Why the case still failed

Having ruled the consent argument inadmissible, the court turned to another question: had the plaintiffs proved, with evidence, that their constitutional right to privacy had been violated? Its answer was no. Every claim was dismissed: injunctions, data deletion and damages.

For the plaintiffs’ lawyer, Olumide Babalola, who chairs the Nigerian Bar Association’s data protection committee, the ruling does not endorse the company’s model. He told TechCabal that the only point in the company’s favour was that the plaintiffs had not attached evidence of harm, and that this did not undermine the findings on the absence of consent and legitimate interest. The plaintiffs intend to appeal on the question of harm.

Truecaller, for its part, highlights that the court recognised the value of caller ID for public safety. The company has said it will neither suspend nor change its service in Nigeria.

What the 2023 law says

Nigeria’s Data Protection Act, passed in 2023, created the Nigeria Data Protection Commission (NDPC) and set out the legal bases for processing personal data: consent, performance of a contract, a legal obligation, the vital interest of the person, a task in the public interest, or a legitimate interest. Consent, when relied upon, must be freely given, specific, informed and unambiguous. In other words, no one can consent on behalf of someone else.

The Lagos ruling applies this rule to a very common situation. It does not say that caller ID is illegal, nor that Truecaller must shut down. It says that, for non-users, the company must find a legal basis other than its customers’ consent, and that this basis, legitimate interest in particular, remains bounded by the fundamental rights of the people concerned.

The reasoning echoes debates already familiar in Nigeria. In recent years, the authorities cracked down on loan apps that harvested their customers’ phonebooks to harass their relatives when repayments were late. There too, people who had signed nothing found themselves exposed by someone else’s data. The Truecaller ruling gives this kind of challenge a firmer legal footing.

A gap in Nigerian law

The ruling highlights a gap in Nigeria’s data protection system: a company may have no legal basis to process your data, and yet you may obtain no redress, for want of proving concrete harm. Yet the harm caused by a privacy breach is often diffuse and hard to put a figure on.

Beyond Truecaller, the implications are broad. Social networks that suggest friends from your address book, messaging apps, lending services that harvest contacts to chase borrowers: all of them rely, to varying degrees, on data one person provides about another. The Lagos High Court has just said that one person’s consent does not count for another. The Nigeria Data Protection Commission (NDPC) could take this up to clarify the rules.

Pending the appeal, the message is twofold. For users, sharing a phonebook is not a trivial act: it involves other people. For companies, relying on consent “by proxy” no longer stands up before a Nigerian judge. From now on, a solid legal basis will be needed, along with a readiness to defend it.