Truecaller Nigeria Court Ruling Limits Contacts Data Use

In Short

• A Lagos High Court ruled that Truecaller cannot use one person’s consent to justify processing phone numbers pulled from that user’s contact list.
• The decision covers people who have never used the app.
• The court declined to award damages, raising questions about remedies under Nigeria’s privacy framework.

What Happened

Truecaller is a caller ID and spam-blocking app that helps users identify unknown numbers. In practice, apps like this often build large phone number databases by asking users to grant access to their contacts.

In a September 14, 2026 ruling, a Lagos High Court said Truecaller could not rely on a user’s consent to process the personal data of other people found in that user’s phonebook. The court’s view is simple, your consent covers your data, not everyone else’s.

This matters because phone numbers are personal data under modern privacy rules. Once collected, numbers can be processed, which means stored, matched, labelled, and used to power features like “who is calling” results.

However, the same court declined to award damages to the affected people whose numbers were processed. That highlights a practical gap in enforcement, even when a company is found to lack a lawful basis, individuals may still struggle to get compensation unless they can show measurable harm.

Why It Matters

For consumer and enterprise apps in Nigeria, the ruling is a warning about “contacts-based growth.” If a product depends on uploading address books, it may need a clearer lawful basis than one user’s click-through permission.

For operators, the decision could push more privacy-by-design choices, like asking users to manually add numbers, limiting contact syncing, or hashing numbers (turning them into scrambled codes) before matching. Hashing can reduce exposure, but it still counts as processing in many privacy regimes.

For regulators and lawmakers, the lack of damages raises a bigger question, what is the remedy when privacy is breached but the user cannot quantify losses? That debate will likely shape how Nigeria’s data protection rules are interpreted in future cases.