A Lagos High Court has drawn a line that could complicate how digital platforms build products from other people’s contacts: one person’s permission to share a phonebook does not automatically give a company permission to process the personal data of everyone in it.
In a September 14, 2026, ruling seen by TechCabal, the court said Truecaller could not rely on a user’s consent to process the phone numbers of people in their contacts who had never used the app.
But it also denied damages to the people whose data was processed, creating a striking gap in Nigeria’s emerging privacy regime: a company can lack a lawful basis to process someone’s data, while that person may still receive no compensation without proving concrete harm.
The ruling is therefore both a warning to digital platforms and a test of how far Nigerian privacy laws can go in protecting people who never agreed to be part of a digital service. For companies that rely on contact lists, access to address books or crowdsourced identity databases, the decision raises questions about how they obtain lawful consent. For individuals, it raises another question: what remedy exists when their personal information is used without their knowledge, but the harm is difficult to quantify?
Originally published by TechCabal.