The Lagos State High Court has dismissed a ₦300 million privacy claim against Truecaller, ruling that the claimants did not provide credible evidence that their constitutional right to privacy was breached. The decision, delivered on September 14, 2026 by Justice N. O. Ojuromi, also means the court refused to stop Truecaller from processing the data in question or to order the company to delete information it already holds.

The case Incorporated Trustees of Data Privacy Lawyers Association & Others v. Truecaller International LLP, put Nigeria’s data-protection rules, consent, caller ID technology and public safety under the same microscope. The applicants wanted ₦200 million in general damages and ₦100 million in exemplary damages. They also sought injunctions to bar Truecaller from collecting, storing, sharing or processing non-users’ phone numbers without consent, and to force the company to permanently delete any non-user data it had.

The court was not convinced. It held that the applicants had failed to prove an actionable infringement of their rights. That finding mattered because it separated two issues: whether Truecaller had consent from non-users, and whether the applicants had actually shown a privacy violation serious enough to justify damages or orders against the company.

On consent, the court sided with the applicants in part. It rejected Truecaller’s argument that a user’s consent could automatically count as consent from a non-user whose details appeared in that user’s contacts. Truecaller had told the court that contact information may be uploaded when users voluntarily turn on its Enhanced Search feature, available in some non-store versions of the app. Users who activate it must confirm they are authorised to share their contact lists. But the court held that this was not enough, on its own, to establish implied consent from the non-user.

That point reinforces a key principle under Nigeria’s data-protection framework: consent is personal. One person cannot simply consent on behalf of another. Even so, Truecaller argued that consent is not the only lawful basis for processing. It also relied on public-interest and legitimate-interest grounds under Section 25 of the Nigeria Data Protection Act 2023, as well as the public-safety role played by caller identification, spam detection and fraud prevention.

The court considered how Truecaller’s service works. Its core model is “number-for-name”: someone searching the platform must already have a phone number before the associated caller identity can be shown. The court found this relevant to whether the applicants had shown real injury from the processing they complained about. In the end, it held they had not established the infringement needed for the remedies they sought.

Public safety was also featured in the judgment. Truecaller argued that its caller ID, spam detection and fraud screening help people spot suspicious, unsolicited or potentially malicious calls before they answer. The company said the service protects millions of Nigerians, including elderly people who are often targeted by fraudsters. The court recognised this public-safety function as one of the purposes for which the platform processes information. It also referred to Section 45(1) of the Constitution, which allows certain fundamental rights to be limited by laws that are reasonably justifiable in a democratic society in the interest of public safety and the protection of others’ rights.

A Truecaller spokesperson welcomed the ruling. “The Lagos State High Court dismissed the suit and refused the reliefs sought,” the spokesperson said. “We welcome the court’s recognition that caller identification and spam detection serve an important public-safety purpose in protecting Nigerians from scams, fraud and harassment.”

Still, the court did not give Truecaller everything it wanted. It rejected the company’s argument that an app user’s consent or representations could automatically amount to consent from people in that user’s contact list. That finding could matter for how data controllers treat contact-upload features in Nigeria.

But the court also refused the applicants’ requests for prohibitory and mandatory injunctions. It did not order Truecaller to suspend its Nigerian operations, disable caller ID, redesign its contact-upload permissions or introduce direct consent prompts for non-users. It also declined to compel the company to delete the data it holds.

Truecaller said it will continue operating its caller-identification and spam-protection service in Nigeria while meeting its privacy and data-protection obligations. The company insists it does not automatically upload a user’s address book just because the app is installed. Enhanced Search, it says, is optional and available in certain versions obtained outside major app stores. When a user activates it, the user expressly confirms they are authorised to share the relevant contact information.

For non-users who do not want their caller identity to remain available, Truecaller offers an unlisting process. A person can visit the company’s unlisting portal, enter their phone number with the country code, complete security verification and request removal. Truecaller says the number and associated identity information are permanently removed from its active searchable database within 24 hours. After that, it keeps a one-way cryptographic hash of the number. According to the company, the hash cannot be reversed to reconstruct the original number and is kept only to stop an unlisted number from being accidentally reintroduced if it later appears in an uploaded contact list. People with unlisting or other privacy problems can also use Truecaller’s grievance and data-protection channels.

Nigerian users and data subjects can direct privacy enquiries to Truecaller’s legal and privacy teams, including its designated Nigeria privacy contact.

The ruling adds to Nigeria’s growing body of privacy and data-protection case law under the Nigeria Data Protection Act 2023. Its real significance may lie in the way it separates three questions: whether one person can consent for another; whether other lawful grounds justify processing; and whether an applicant has actually proved an infringement serious enough to warrant judicial relief.

On the first, the court said no: a user’s consent is not automatically a non-user’s consent. On the last, it found the applicants had not proved their case with enough evidence. So the suit was dismissed, the ₦300 million damages claim was refused, and Truecaller was not ordered to stop processing data or delete what it holds. The company’s caller-ID service remains operational in Nigeria, while the judgment serves as a reminder that consent, privacy safeguards and clear legal bases for processing personal data still matter.