For millions of South Africans, Truecaller is an essential daily tool, a digital bouncer that screens unwanted calls and identifies potential scammers. But now, the very service that promises to protect your privacy is under the microscope for possibly violating it. The app is facing a formal investigation by South Africa’s information regulator for potential breaches of the Protection of Personal Information Act (POPIA).
The investigation hinges on a critical question: what happens to the phone numbers of people who have never even installed the app?
The Heart of the Matter: The Non-User Dilemma
The central allegation against Truecaller is that it may be processing personal information without taking the “reasonably practical steps” required by POPIA to inform people. The problem isn’t about users who willingly signed up; it’s about everyone else in their address books.
“When you install Truecaller, it uploads your contact list to its global database. This means that if your number is on someone else’s phone, you could be in Truecaller’s system without your knowledge or consent,” explains Lucinda Botes, a senior associate at Phukubje Pierce Masithela Attorneys. “The main risk stems from the fact that Truecaller uses personal information of non-users without directly notifying them.”
This strikes at the core of POPIA’s “openness requirement,” which demands transparency about how personal data is collected and used.
The “Whitelisting Fee” Allegation and Truecaller’s Defense
Adding to the controversy are claims from some businesses that Truecaller operates a “pay-to-play” model. They allege the company charges a “whitelisting fee” to remove spam labels that can damage a company’s reputation.
Truecaller has fiercely denied this. A company spokesperson stated that even businesses that pay for its enterprise services are not immune to user-generated spam reports. “If you make calls that the customers… don’t want to receive, they’re going to mark you as spam. We don’t have control over that,” the spokesperson said. They compared their paid verification service to the “blue tick” on social media platformsa feature for legitimacy, not immunity from crowd-sourced feedback.
How Truecaller Could Justify Its Model
Despite the concerns, POPIA does provide exceptions. Truecaller could mount a defense on a few fronts:
-
Minimal Prejudice: They could argue that using only a name and phone number causes no “material prejudice” to an individual, especially since the app’s purpose is to protect users from spam and fraud.
-
Impossibility of Direct Notification: Given the global scale of its operations, Truecaller could claim that directly notifying every non-user is not “reasonably practical.”
-
Self-Service Remediation: The company points to its “unlisting” feature on its website, which allows anyone to request the removal of their number. This could be presented as a good-faith effort to balance its service with individual privacy rights.
Truecaller also challenges the technical basis of the complaint, stating that “contacts access does not equal contacts upload.” They claim the permission is used for a milliseconds-fast check to see if an incoming number is already in a user’s personal contacts, not to upload every number to a central server.
For now, South African users and businesses are caught in the middle. The outcome of the regulator’s investigation will set a crucial precedent, defining where the line is drawn between a useful digital service and the fundamental right to privacy in the modern world.
{Source: Broadband}
