The South African Information Regulator is currently running a deep investigation into Truecaller, and the allegations are serious. It is not just about a data leak; it is about their entire business model. The investigation was triggered by a flood of complaints in mid-2025, but they didn’t come from regular people. They came from businesses.
Here is the accusation:
South African companies claim that Truecaller arbitrarily labels their legitimate business numbers as “Spam.” When these businesses try to fix it, they allege that Truecaller essentially holds them hostage. The claim is that Truecaller charges for a “Verified Business” package to remove the “Spam” tag.
- The Alleged Extortion: “Pay us, or we keep telling your customers you are a spammer.”
- The Cost: Some businesses reported being asked to pay around $590 (approx. R11,000) per month to ensure their calls went through cleanly.
For a small business, that is a death sentence. If Truecaller says you are “Spam,” nobody picks up your calls. You are effectively digitally silenced until you pay up.
The “Non-User” Trap (The Privacy Nightmare)
While the businesses are complaining about money, the Information Regulator is worried about something much bigger: POPIA (The Protection of Personal Information Act).
This is the part that affects you and me.
The core of Truecaller’s magic is Crowdsourcing. When you install Truecaller, it asks for permission to access your contacts. If you say “Yes,” it sucks up your entire address book and uploads it to their server.
- The Problem: You gave consent. But your grandmother, whose number was in your phone, did not.
- The Violation: Truecaller now has your grandmother’s name and number. She never downloaded the app. She never signed a Terms of Service. She doesn’t even know Truecaller exists. Yet, her data is being sold and monetised.
Under South African law (POPIA), you cannot process someone’s data without their consent. Truecaller’s defence has always been: “We didn’t take it. Our user gave it to us.”
The Regulator is now asking: “Is that legal?” And the answer is looking increasingly like “No.”
Truecaller’s Defence: “It’s Not Us, It’s You”
Truecaller is fighting back. Their defence relies on a legal loophole called “Enhanced Search.” They claim they do not upload contacts for everyone; they upload only for users who opt into “Enhanced Search.” They also argue that “whitelisting” a business number is free and that the paid package is only for extra branding (such as adding a logo).
But legal experts in South Africa, like those at Werksmans Attorneys, aren’t buying it. They argue that Truecaller is the “Responsible Party.” They can’t blame you (the user) for their data collection practices. You cannot legally give consent on behalf of your grandmother.
This Has Happened Before
To understand why this is a big deal, you have to look at the history. This isn’t Truecaller’s first time in the hot seat.
- Nigeria (2019/2021): The Nigerian agency NITDA (National Information Technology Development Agency) launched a similar probe. They found that Truecaller’s privacy policy was “overwhelming” and collected far more data than necessary (like IP addresses and device IDs).
- India (Dark Web Leaks): In 2019 and again in 2024, reports surfaced of massive databases of Truecaller users (and non-users) being sold on the Dark Web. Truecaller denied a breach, claiming the data was “scraped” (stolen from the screen) rather than hacked from their servers. But for the victim, the result is the same: their data is out there.
The “So What?”
If the South African Regulator rules against Truecaller, it could set a massive precedent for the entire continent.
- For Truecaller: They might be forced to delete millions of “non-user” numbers. If they do that, their Caller ID feature stops working effectively (because they won’t know who the unknown numbers are anymore).
- For You: You might finally get privacy, but you will likely lose the convenience of knowing who is calling you.
The Bottom Line:
Truecaller built an empire by solving a problem (Spam Calls). But the South African investigation suggests that in solving that problem, they became a different kind of problem: a Privacy Invader.
Right now, the Regulator is still “engaging” with Truecaller. But if they issue an Enforcement Notice, Truecaller will have to fundamentally change how it works, or leave South Africa entirely.
