Lagos Court Draws a Line Between Contact Access and Consent in Truecaller Case

Lagos Court Rules That Truecaller Users Cannot Consent for Non-Users

A Lagos State High Court has rejected Truecaller’s argument that a user’s consent can establish consent for people whose phone numbers are stored in that user’s contacts. But the same court dismissed the privacy case because the applicants did not prove an infringement that entitled them to the reliefs they sought.

Justice N. O. Ojuromi delivered the ruling on September 14 in Data Privacy Lawyers Association v Truecaller International LLP. The decision draws a useful line in Nigerian privacy law: giving an app access to a phonebook is not automatically the same as every person in that phonebook consenting to the processing of their data.

The court rejected consent by proxy

The applicants, including non-users Esther Odunze and Ilashe E. Nike, said Truecaller had processed their phone numbers even though they had never registered for the service. Their case relied on Section 37 of Nigeria’s Constitution and the Nigeria Data Protection Act 2023.

Truecaller argued, among other points, that users voluntarily grant access to contacts and that consent connected to those users could support the processing.

The court rejected that reasoning. It found that a user’s permission to upload or make contacts available could not, by itself, establish implied consent from a non-user who had never accepted Truecaller’s privacy policy or terms.

That principle reaches beyond caller-identification apps. Services built around uploaded contacts, address-book matching or social discovery still have to distinguish between permission from the person operating a device and the privacy interests of people represented in the data. A similar consent problem appears with technologies such as smart glasses, where one person’s use of a device can involve data belonging to people who never chose to use it.

Why the applicants still lost

The judgment did not find Truecaller liable for a proven privacy breach. The court noted that Truecaller had deleted the applicants’ numbers and associated data after they complained. It also held that the applicants had not produced sufficient evidence to establish the alleged infringement of their fundamental rights. The application was dismissed, including claims for ₦200 million in general damages and ₦100 million in exemplary damages.

That makes the result more nuanced than either “Truecaller won” or “Truecaller breached privacy.” Truecaller defeated the claims for relief while losing an important argument about whether one person’s consent can stand in for another’s.

Olumide Babalola, who appeared for the applicants, says the decision also departs from reasoning in an earlier Federal High Court case under Nigeria’s previous data-protection regime, where Truecaller had been permitted, in substance, to rely on users indicating that they had permission to provide non-users’ information.

What current Truecaller users should understand

The judgment should not be read as proof that every current Truecaller installation uploads an entire phonebook. TechView Africa’s earlier review of Truecaller examined how its caller-identification system works, including what the company says about contact access and privacy.

Truecaller’s current Nigeria privacy policy says versions downloaded through Apple’s App Store or Google Play do notreceive, store or share contact information from a user’s address book. It describes different handling for its Enhanced Search feature when the app is obtained from other sources.

The wider significance is therefore legal, not merely technical: access to personal data and lawful consent to process that data are separate questions.

Our Recommendation

For Nigerian apps, contact permission should not be treated as a blanket legal shortcut for processing other people’s information. For users, granting contact access remains a meaningful privacy decision, but it does not transfer the privacy rights of everyone saved on the device.