Introduction

A Nigerian court has ruled that a single user's permission to share their phonebook does not automatically extend to the personal data of everyone listed in it. The September 2026 decision against Truecaller underscores a growing tension between popular digital services and privacy protections under Nigeria's Data Protection Act.

What Happened

A Lagos High Court case, brought by the Data Privacy Lawyers Association, argued that Truecaller processed the phone numbers of non-users without lawful basis. The company claimed user-uploaded contact lists provided implicit consent, but the court disagreed, citing sections 26 and 65 of the Nigeria Data Protection Act, which require consent to be voluntary, informed, specific, and unambiguous. The judgment rejected the idea that one person can consent on behalf of others who never signed up for the service.

Truecaller defended itself by saying its Enhanced Search feature is optional, its infrastructure sits in India, and users can request data removal. The court dismissed these arguments as insufficient to establish a lawful basis for processing non-user data.

Why This Matters

The ruling signals that digital platforms cannot rely on a user's click-through consent to justify processing data belonging to people who never agreed to terms. Privacy experts say the decision extends beyond Truecaller, affecting any app that accesses contact lists. Unlike messaging apps that keep numbers private, Truecaller makes contact information searchable, raising distinct privacy risks.

Legal analysts note the judgment also highlights gaps in Nigeria's privacy enforcement: while the court affirmed that proxy consent is invalid, it declined to award damages, finding no evidence of concrete harm. This creates a partial victory for privacy advocates.

Key Takeaways

  • One user's consent does not cover non-users' data under Nigeria's Data Protection Act.
  • The court rejected implied or proxy consent, requiring each individual's informed agreement.
  • Truecaller did not receive a damages award because claimants failed to prove measurable harm.
  • The decision may influence how other apps handle contact access and data processing.
  • Experts say the case exposes weaknesses in enforcement when harm is intangible.

Conclusion

The Truecaller ruling is a reminder that useful features do not override legal requirements. Platforms must establish independent lawful bases for processing data about people who never signed up. For users, the case reinforces the importance of reviewing app permissions and understanding how contact data may be shared. As privacy law evolves, similar challenges are likely to shape the next wave of digital regulation in Nigeria and across Africa.