Truecaller controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile7 entries
2021
Indian privacy litigation and data-use allegations
Reports about a public-interest petition in the Bombay High Court alleged unauthorized use or sharing of user data and named Truecaller among the respondents. Truecaller said it had not received formal communication at the time of its statement, denied selling user data and maintained that it followed data-minimization and privacy practices.
2019
iOS advertising SDK transmitted data before privacy-policy acceptance
Truecaller acknowledged that one advertising SDK in its iOS application transmitted certain device and advertising-related information before users accepted the privacy policy. The company said it investigated the matter, removed the problematic behavior and submitted a corrected version to the App Store.
2019
Application security vulnerability reported by Ehraz Ahmed
A researcher identified a vulnerability that could expose user, system and location-related information through the application’s API. Truecaller confirmed the issue and implemented a fix. The episode contributed to broader scrutiny of the security risks associated with a large caller-identification database.
2019
Accidental UPI registration activation in India
A Truecaller update in India unintentionally triggered an SMS-based bank-verification process for some users, causing complaints that people had been enrolled in the payments service without adequate consent. Truecaller attributed the incident to a software bug and released a corrective update. The company later stated that it discontinued UPI services in March 2021.
2013
Website cyberattack and unauthorized access
Truecaller disclosed that its website had been compromised in a July 2013 cyberattack. The company said that attackers accessed authentication tokens, which it reset, and stated that passwords and credit-card data were not stored or exposed. The incident nonetheless raised concerns about the security of a service built around a large telephone-number database.
Privacy controversy surrounding contact-data collection
Truecaller has faced continuing public and legal criticism over the way its directory may contain information about people who have not directly registered for the service. The controversy concerns contact synchronization, number identification, the rights of non-users and the allocation of controller and processor responsibilities under data-protection law.
Nigerian litigation concerning non-user data
Nigerian proceedings have examined whether Truecaller’s collection, storage and processing of information about non-users interferes with privacy rights under Nigerian data-protection rules. Truecaller has argued in litigation that users whose address books are involved may be the data controllers and that Truecaller can act as a processor, while the legal characterization has remained a matter of dispute.