Truecaller has said any Nigerian can remove their phone number from its caller-identification service, following a Lagos High Court ruling that dismissed a privacy case brought by non-users of the platform.
The company told TechCabal its unlisting tool allows people who do not use Truecaller to request removal of their number and associated caller identity from its active searchable database.
“The Lagos State High Court dismissed this suit and refused all the reliefs sought,” a Truecaller spokesperson said in a statement on Monday. “We welcome the court’s recognition that caller identification and spam detection serve an important public-safety purpose in protecting Nigerians from scams, fraud and harassment.”
The response follows TechCabal’s earlier report, which examined the legal dispute over how Truecaller processes the phone numbers and names of people who have not signed up for its service.
The applicants, including the Incorporated Trustees of the Data Privacy Lawyers Association acting for non-users, had asked the court to declare that Truecaller’s collection, storage and disclosure of non-users’ phone numbers violated privacy rights under Section 37 of the Nigerian Constitution and Part V (Sections 34–38) of the Nigeria Data Protection Act (NDPA).
They also sought orders stopping the company from processing non-user data, requiring it to delete that data and award ₦300 million ($225,992) in general and exemplary damages.
The Lagos High Court dismissed the applicants’ injury claims and rejected their requests for prohibitory and mandatory injunctions, as well as damages. But the judgment, excerpts of which TechCabal reviewed, makes a distinction between the court’s treatment of consent and its final decision on whether the applicants established an actionable breach of fundamental rights.
On consent, the court rejected the argument that a user’s acceptance of Truecaller’s terms, or consent to upload contacts, automatically amounted to consent from non-users whose numbers appeared in that person’s phonebook.
“The user of the app voluntarily consented to the upload of contact details on the user’s phone to the respondent is insufficient to establish implied consent,” the court held. It said that accepting the company’s theory of implied consent “would completely eviscerate the rule of privacy and the definition of consent as provided by the Act.”
The court also said that Truecaller, as both a data controller and processor in the circumstances considered, had a duty to safeguard personal data and ensure it was not released to third parties without legitimate justification.
Olumide Babalola, chair of the Nigerian Bar Association’s Data Protection Committee and lawyer to the applicants, said the dismissal should not be read as a complete endorsement of Truecaller’s consent model.
“The only issue the court found, which helps them, is that we did not attach evidence of damages,” Babalola told TechCabal on Monday. “That does not detract from the findings on lack of consent and legitimate interest.”
Truecaller, however, argued that consent was not its only legal basis for processing the information. It relied on the public-interest and legitimate-interest provisions in Section 25 of the NDPA, as well as the public-safety exception in Section 45 of the Constitution.
The company said its caller-identification, spam-detection and fraud-screening functions help users identify suspicious and malicious calls. In its statement to TechCabal, it said the court accepted that caller identification could serve a public-safety purpose and that its operations could be justified under lawful grounds beyond implied consent.
“The court’s recognition that caller identification and spam detection serve an important public-safety purpose” was central to the outcome, the spokesperson said.
However, the court’s reasoning, as reflected in the excerpts, did not state that public interest or legitimate interest automatically overrides a data subject’s privacy rights. The judgment noted that legitimate interest under Section 25(1)(b)(v) is limited where it overrides the fundamental rights, freedoms and interests of the person whose data is being processed.
The court then turned to a separate question: whether the applicants had proved, with credible evidence, that their constitutional right to privacy had been infringed.
Truecaller’s defence was that its search function is a “number-for-name” system. In other words, a person seeking an identity must already have the phone number before a name can be displayed. The company argued that this did not expose private contact details to unknown third parties.
The company added that it does not automatically upload users’ address books. According to the court ruling, contact information is uploaded only if a user activates an optional Enhanced Search feature in certain non-store versions of the app and confirms they are authorised to share the contacts.
Truecaller said it will not suspend or redesign its Nigerian service as a result of the decision. It argued that the court had rejected requests to halt processing of non-user data and to compel deletion of data already held by the company.
“Moreover, we empower every individual who is not a user and does not want their caller ID to be available on the service to be able to unlist themselves on their own by visiting the Unlisting portal: truecaller.com/unlisting and unlist their number,” the company said.
It said it keeps a one-way cryptographic hash after unlisting to prevent a deleted number from being accidentally re-uploaded when an active user synchronises a phonebook. The company said that hash is non-reversible.
“Anyone, whether or not they use Truecaller, can remove their number from our service at any time through our unlisting page,” the spokesperson said. “We take our obligations under the Nigeria Data Protection Act seriously and will continue to engage constructively on these issues.”
The ruling ends the case at the Lagos High Court for now, but Babalola said the applicants plan to appeal the court’s treatment of injury arising from privacy violations. The case, therefore, leaves important questions about remedies under Nigerian data-protection law unresolved.
The court found that consent from an app user was not enough, on its own, to establish implied consent from a non-user. It also emphasised that legitimate interest cannot override fundamental rights. Yet it dismissed the claim after finding that the applicants had not established a constitutional privacy violation with sufficient evidence.
That distinction is likely to shape future disputes involving apps that rely on contact lists, caller-identification services, social discovery and other systems built on data supplied by one person about another.
True scale demands moving beyond surface-level integrations to robust execution. We’ve filtered the noise out of Moonshot 2026, optimising the conference strictly for high-calibre connections between startup founders, global financial operators, enterprise leaders and individuals rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.
