The popular spam-blocking app Truecaller is under the spotlight in South Africa following a formal complaint lodged with the Information Regulator. At the heart of the matter is the app’s “Enhanced Search” functionality, which critics allege violates the country’s Protection of Personal Information Act (Popia).
The Complaint
According to the complaint, Truecaller accesses and processes users’ address books without proper consent. This functionality, enabled by default, allegedly allows the app to upload entire contact lists to its global database, exposing personal data of non-users without their knowledge.
The complainant described the process as “deceptive,” stating that users are misled into enabling Enhanced Search, which effectively “steals” their phone diaries. Furthermore, it was highlighted that non-users are not notified of their data being collected, leaving them unable to take action to protect their privacy.
Nomzamo Zondi, senior communication manager for the Information Regulator, confirmed receipt of the complaint. “We are within the timeframe to process the complaint and allocate it to an investigator,” she said, adding that the investigation would involve both the complainant and Truecaller.
Legal Concerns
Legal experts argue that Truecaller’s practices may breach Popia in two significant ways.
Firstly, the Act prohibits the transfer of personal information outside South Africa unless the receiving party complies with stringent corporate rules or agreements aligned with Popia. Truecaller, which stores its data on international servers, raises red flags in this regard.
Secondly, critics point out the ethical dilemma surrounding non-subscribers—people whose data is uploaded to the app’s database without their consent. Ahmore Burger-Smidt, head of regulatory practice at Werksmans Attorneys, emphasised that while Truecaller’s terms and conditions shift responsibility to users, the company remains the “responsible party” under Popia.
“Truecaller cannot absolve itself of accountability simply because it collects data through user actions. It determines the purpose and means of processing and is therefore accountable under the law,” Burger-Smidt explained.
Notification Challenges
Another key issue is how Truecaller informs individuals about their data being included in its database. While the app provides an “unlist” feature, critics argue that this is inadequate for non-users who remain unaware their data has been collected.
Burger-Smidt suggested that Truecaller notify individuals via SMS or email whenever their data is added to its database. This would allow affected individuals to review its privacy policy and exercise their right to delist. However, Truecaller has yet to implement such a measure, citing the difficulty of balancing privacy with functionality.
Truecaller’s Defence
Truecaller’s global head of corporate communications, Hitesh Bhagat, has denied any wrongdoing. He clarified that Truecaller does not upload contacts without user consent and that its Enhanced Search feature is no longer available on official app stores to comply with platform regulations.
Bhagat also addressed misconceptions about the app’s access to contact lists, explaining that access is requested for features like call screening and not for data harvesting. However, he acknowledged that users who side-load the app could still access Enhanced Search by uploading their contacts.
The Broader Implications
The complaint against Truecaller underscores the growing tension between technological convenience and privacy rights. As South Africa strengthens its data protection framework, global platforms like Truecaller must navigate compliance with local laws.
For South African users, the case raises important questions about how their personal information is handled and shared. Legal experts caution users to think carefully before granting access to their contacts, as the implications extend beyond their individual privacy.
While the Information Regulator has yet to take formal action, the complaint may prompt an investigation and set a precedent for how similar apps operate in the country. Until then, Truecaller remains in the spotlight, with its practices and compliance under close scrutiny.
