Truecaller faces backlash in South Africa amid privacy violations probe

The popular caller ID app, Truecaller, is currently under investigation in South Africa following several complaints that it may be breaking the country’s data protection law, the Protection of Personal Information Act (POPIA).

The country’s regulator, the Information Regulator (South Africa), has launched an inquiry following accusations that the app wrongly labels some businesses as spam and demands payment for removal. Truecaller has denied these claims, insisting it does not charge for “whitelisting” and that its contact permissions comply with POPIA.

The app, known for identifying unknown numbers and blocking spam calls, argues that access to users’ contacts is essential for its main function, not for collecting or misusing personal data.

Why Truecaller and its data practices raise privacy red Flags

Despite Truecaller’s defence, privacy experts are still sceptical. Lucinda Botes, a senior associate at Phukubje Pierce Masithela Attorneys, explained that Truecaller’s ability to display information about non-users, people who have never downloaded the app, poses a potential legal risk. She emphasised that this concern remains valid even if the company does not technically upload contact lists.

Botes expressed concern that the app’s data practices may conflict with the core principle of the Protection of Personal Information Act (POPIA), which emphasises “openness.” This principle requires organisations to inform individuals about how their personal information is collected and used. The key issue is that individuals whose phone numbers are included in other people’s contact lists have not consented to have their data shared by the app.

Beyond personal privacy, the law also empowers businesses to safeguard their reputations and request clarification or removal if their details appear in databases like Truecaller’s.

Also read: Beyond caller ID Truecaller now lets you know why somebody is calling using AI

Truecaller maintains that its system is built to protect users, not exploit data. The company highlights its “unlisting” feature, which lets anyone remove their number from its database, and argues that individually notifying every non-user would be technically and logistically impossible.

The outcome of this investigation could set an important precedent for how tech platforms handle user and non-user data in South Africa. As the digital economy grows across Africa, the Truecaller case could become a defining moment in finding a balance between innovation and privacy, a test of how far convenience can stretch before it crosses the line of consent.