THE Lagos State High Court, Eti-Osa Judicial Division, has rejected Truecaller’s claim that consent by its users authorises it to access and process the phone numbers on the users’ phones.
In the landmark ruling at Court 6J.I.C Court House, Igboshere, on Monday, September 14, 2026, the judge, N. O. Ojuromi, held that such practice would enable Truecaller to do whatever it wishes with people’s data in its custody.
The suit No. LD/2021MFHR/2025 was between Incorporated Trustees of Data Privacy Lawyers Association (for and on behalf of its members who are non-users of the Truecaller app, including Esther Odunze and Ilashe E. Nike and Truecaller INT. LLP.
A lawyer, Olumide Babalola, appeared with H. Jofi for the applicants, while T.O.Apalando was present for the respondent, as contained in a certified true copy (CTC) of the judgment obtained by the ICIR.
The ICIR reports that Truecaller is a mobile application offering call identification, call blocking and call recording. To use the app, users must register their mobile number and grant the app access to the phone contact list, whether or not those contacts are themselves users of the app.
The litigants approached the court after alleging that their phone numbers were made accessible to the public by Truecaller.
A deponent to the affidavit submitted to the court, Odunze, stated that in or around March 2025, a random vendor, with whom she had no prior dealings, told her he had discovered her identity and telephone number on the Truecaller app.
According to her, she had never submitted her number to, or registered on, the app. She therefore became anxious as to how the app had obtained it.
Odunze consequently contacted the app, which is based in India, to delete her contact from its server. She stated that the respondent replied that it relied on the consent of its users to process non-users’ telephone numbers.
She thereafter approached the court with other Nigerians with similar experiences to seek redress. They believed their fundamental rights to privacy as enshrined in Section 25 of the Nigeria Data Protection Act 2023 and Section 37 of the Constitution of the Federal Republic of Nigeria, 1999 had been violated.
According to the applicant, the respondent neither sought nor obtained her consent, or that of other non-users, before collecting, storing and using their telephone numbers. She said she never consented to her number being shared with the respondent and put the respondent to strict proof of any such consent; and that the respondent has no other lawful basis for processing non-users’ numbers, on which it was similarly put to strict proof.
According to Odunze, Truecaller’s mode of operation is to harvest the telephone numbers of non-users through the phones of its users, and that at the time of deposing, Truecaller had harvested the numbers of about 450 million people. She added that the app is a paid, globally accessible service, such that numbers harvested through it can be published to an indeterminate number of people.
She argued that by the unauthorised collection and disclosure of non-users’ numbers to third-party users of the app, non-users have been exposed to the risk of unsolicited messages, surveillance and privacy intrusion; that their constitutionally guaranteed privacy had been contravened through intrusion and the unauthorised harvesting, storage and publication of a private fact, namely their telephone numbers. She added that their privacy of telephone conversations had likewise been contravened, since third parties and unauthorised persons already had access to their numbers and identities.
She itemised the injuries said to have been suffered by her and other non-users as breach of their privacy right through the harvesting and exposure of their numbers and identities without lawful basis; loss of control over their personal data; intrusion and distress; the risk of misuse, identity theft and other privacy harms; and a lack of transparency and redress.
By the originating motion dated August 13, 2025, the applicant prayed the court for the following orders: a declaration that the unauthorised harvesting, collection, disclosure and/or otherwise use of the applicants’ telephone numbers by the respondent’s through its Truecaller app contravened the applicants’ right to privacy guaranteed by section 37 of the Constitution of the Federal Republic of Nigeria, 1999; and a declaration that the unauthorised harvesting, collection, disclosure and/or otherwise use of the applicants’ telephone numbers by the respondent’s through its Truecaller app lacks a lawful basis under Section 25 of the Nigeria Data Protection Act 2023 and thereby violates the non-users’ privacy guaranteed by Section 37 of the Constitution of the Federal Republic of Nigeria, 1999.
The reliefs include a declaration that by virtue of Sections 25 and 26 of the Nigeria Data Protection Act 2023, in the absence of any document establishing consent of non-users, the respondent cannot rely on the consent of users of the Truecaller app as a lawful basis for the collection of the telephone numbers of non-users; a declaration that the respondent does not process telephone numbers for personal and household purposes and therefore cannot rely on the exception in Section 3(1) of the Nigeria Data Protection Act 2023.
They also sought an order of prohibitory injunction restraining the respondent, its agents, representatives, and associates from further collecting, storing, sharing, or otherwise processing non-users’ telephone numbers without first seeking and obtaining their valid consent; an order of mandatory injunction compelling the respondent to immediately and permanently delete all telephone numbers and any other personal data of non-users and to furnish a report under affidavit confirming such deletion within seven days of delivery of the judgment.
Besides, they demanded N200,000,000 as general damages and N100,000,000 as exemplary damages. They sought post-judgment interest at the prevailing CBN rate until full and final liquidation of the judgment debt, and consequential order(s) that the court could grant in the circumstances.
The motion was brought on six grounds and supported by a 17-paragraph affidavit deposed to by Odunze. It was supported by a statement of facts and a written address.
Meanwhile, the respondent filed a 16-paragraph counter-affidavit, deposed to by Emmanuel Matuluko, a lawyer in the firm representing the respondent and a user of the Truecaller app in Nigeria.
Matuluko posited that Truecaller is an entity registered and carrying on business exclusively in India, with no office, server, infrastructure or operational facility in Nigeria, all of its technical infrastructure being located in India.
Contrary to the applicant’s account, the counsel said Truecaller does not itself collect, extract or transfer contact data from its users; rather, the app functions as a dialler requiring access to a user’s own on-device phonebook, and no data is transmitted to the app unless the user takes a separate, voluntary step to upload it either by downloading a version of the app available from sources other than the Google Play Store or Apple App Store.
The respondent further contended that the 2nd and 3rd applicants had suffered no harm by having their numbers on the app. It was stated that the 2nd applicant’s telephone number was publicly available on the internet, being displayed on two Instagram profiles associated with her.
He also said the 3rd applicant’s number appeared to be a business number, which might make it inaccessible to the public. He contended that whoever owns it loses whatever private character it might otherwise have and falls outside the personal data which the NDPA protects.
Matuluko questioned the competence of the court in handling the matter, arguing that Truecaller does not have a physical office in Nigeria but in India. The defendant further stated that the app does not permit a name-for-number search, but only a number-for-name search. Therefore, a user must already possess a non-user’s number before the app can supply a matching name.
He said all data received is processed on its Indian servers in accordance with India’s Digital Personal Data Protection Act 2023.
He urged the court to strike out the suit for want of a competent fundamental-rights claim and for want of territorial jurisdiction, or, in the alternative, to dismiss it on the merits with substantial costs against the applicants.
The ICIR also reports that there were arguments over who a data processor and controller is. While Truecaller attempted to push the responsibility of data processing to its users, the applicants contended that the app both processes and controls its users’ and non-users’ data.
The judgment
In his ruling, the judge held that the privacy of citizens as guaranteed under Section 37 of the 1999 Constitution includes the right to protection of personal information, personal communication and personal data, making the case fall under the Fundamental Rights Enforcement Procedure Rules. He said the court had the jurisdiction to hear and determine it.
The court observed that any person who alleges that any of the Fundamental Rights provided for in the Constitution or African Charter on Human and Peoples Rights (Ratification and Enforcement) Act and to which he is entitled, has been, is being, or is likely to be infringed, may apply to the court in the State where the infringement occurs or is likely to occur, for redress.
He referred to the case of ATOYEBI v. BARCLAYS BANK PLC (2026) 10 NWLR (PT. 2049) 377 where the Supreme Court held that “There is nothing in the provision of Section 6 of the Constitution of the Federal Republic of Nigeria, 1999, that expressly forbids a court in one State from adjudicating on a cause of action that arose over a party resident in another State.”
Ruling on issue two, which is on whether the 1st applicant can institute an action on behalf of other non-users, the judge held that Section 46(1) of the Constitution of the Federal Republic of Nigeria, 1999, as amended, makes the following provision: “Any person who alleges that any of the provisions of the chapter has been, is being or likely to be contravened in any state in relation to him may apply to a High Court in that state for redress.”
He submitted that the Nigerian Constitution welcomes public interest litigation, which could be filed by individuals, groups, activists, lawyers, among others.
“The argument of the respondent that the 1st applicant, having failed to list out all the names and phone numbers of its members who are non-users, does not have a cause of action fails. It is for all the foregoing reasons that I hold that a joint application can be brought under the provisions of the Fundamental Rights (Enforcement Procedure) Rules 2009. Therefore, the 1st applicant can bring an application of this nature under the Fundamental Rights (Enforcement Procedure) Rules 2009,” the judge ruled.
He also determined the third issue, which bothered on whether the collection and processing of the 2nd and 3rd applicants’ information could violate their constitutional right to privacy under Section 37 of the 1999 Constitution and the Nigeria Data Protection Act (NDPA) 2023.
He reasoned, “It is safe to say the right to ‘privacy of citizens’ as guaranteed under the Section includes the right to protection of personal information, personal communication and personal data. In EMERGING MARKETS TELECOMMUNICATIONS SERVICES LTD v ENEYE (2018) LPELR-46193(CA), the Court of Appeal held that by giving unknown persons and organisations access to the respondent’s Etisalat GSM phone number to send unsolicited messages to, the appellant breached the respondent’s right to privacy guaranteed by Section 37 of the 1999 Constitution.
“Also, in INCORPORATED TRUSTEES OF DIGITAL RIGHTS LAWYERS INITIATIVE & ANOR v NIMC (2021) LPELR-55623(CA), the Court of Appeal held as follows: ‘The kernel of both the provision of Section 37 of the Constitution and these illuminating decisions is, to my mind, that privacy of a citizen of Nigeria shall not be violated. From these decisions, privacy, to my mind, can be said to mean the right to be free from public attention, or the right not to have others intrude into one’s private space uninvited or without one’s approval. It means to be able to stay away or apart from others without observation or intrusion. It also includes the protection of personal information from others. This right to privacy is not limited to his home but extends to anything private and personal to him, including communication and personal data.”
The judge held that personal data protection as provided in the National Data Protection Regulations generally falls under the fundamental right to privacy, which is guaranteed by Section 37 of the CFRN. However, he added a caveat. The rights are not absolute. They can be curtailed by the appropriate authorities where there are grounds for doing so.
“The Constitution of the Federal Republic of Nigeria, 1999, recognises certain circumstances when the fundamental rights of citizens can be curtailed. Section 45(1) of the 1999 Constitution provides that: (1) Nothing in Sections 37, 38, 39, 40 and 41 of this Constitution shall invalidate any law that is reasonably justifiable in a democratic society (a) in the interest of defence, public safety, public order, public morality or public health; or (b) for the purpose of protecting the rights.”
Similarly, Section 45 provides that all fundamental rights can be circumscribed in the interest of defence, public safety, public order, public morality or public health or for the purpose of protecting the rights and freedom of other persons.
The judge further averred that unwaivable rights are common in consumer protection laws to prevent sellers, who have much more negotiating power, from forcing consumers to contract away the right granted by statute, thus making the statutes meaningless.
Ruling on the data collected by Truecaller, the judge said, “It is to my mind that the respondent has a purpose for the numbers of its users and non-users. As a dialler app with many important functions, one being the Public Safety function, it is clear the respondent is in a more dictating position than its users to determine the purpose of the personal data of users and non-users. With the consent and voluntary granting of access by the users, the objective of the respondent is achieved. This makes the respondent a data controller to its users as prescribed in the Nigeria Data Protection Act 2023.
He said the processing of personal data by the respondent is the responsibility of a data processor by virtue of Section 65 of the Nigeria Data Protection Act 2023. This, he stated, could generally be seen as an infringement of a data subject’s privacy.
He ruled that accepting the respondent’s theory of implied consent would completely weaken the rule of privacy and the definition of consent as provided by the Act. “The critical question with respect to implied consent is whether the parties whose contact details were uploaded to the server of the respondent had adequate notice of this. That the user of the app voluntarily consented to the upload of contact details on the user’s phone to the respondent is insufficient to establish implied consent.
“This court does not find that non-users who are not subject to the respondent’s Privacy Policies and Terms of Service have impliedly consented to the respondent’s interception of their phone numbers and contact details. The applicants have adequately alleged that they have not explicitly or implicitly consented to the respondent’s access to their contact details. Consent to one does not equate to consent to the other.”
Ruling on breach of fundamental rights
The court explained that the applicants’ allegations were predicated upon searching their phone numbers on the respondent’s app and finding that their names were associated with their telephone numbers even as they claimed they were not users of the app.
The judge said the applicants reached out to the respondent, who complied with the instruction to delete their telephone numbers and data attached to the app from the respondent’s server.
Ruling on the applicants’ demands, the judge said, “The law is settled that where a person approaches a court of law by way of an application for redress of a breach or contravention of any of his guaranteed rights under Chapter IV of the Constitution, as the person or party making the assertion or allegation against another person or party, the legal burden of initial proof of the assertion is placed on him by the law, unless or except the assertion was expressly or by necessary implication or presumption, admitted by the other person or party.”
The judge reasoned that “Can the respondent (sic) truly argue that his privacy has been breached where his number is already known by the user of the respondent application? The public safety function is one that operates on a number-for-name search, meaning the phone number must already be known and available to the searching user.
“Personal data breach according to Section 65 of the Nigeria Data Protection Act 2023 means a breach of security of a data controller or data processor leading to or likely to lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
“The mere misappropriation of personal information, without a resultant economic harm or any damage or injury as claimed by the respondent in their statement of defence, for example, in the form of being deprived of the ability to monetise that information, is neither damage nor injury.
“Following from the above, I agree in totality and hold that the applicants failed to establish by cogent and credible evidence the allegation of infringement of their rights. In view of the above findings, this application is hereby dismissed.”
Marcus bears the light, and he beams it everywhere. He's a good governance and decent society advocate. He's The ICIR Reporter of the Year 2022 and has been the organisation's News Editor since September 2023. Contact him via email @ mfatunmole@icirnigeria.org