How Truecaller puts your privacy at risk

By Tefo Mohapi

Truecaller, the caller ID and call-blocking app, has gained popularity worldwide since its initial release in 2009. The Swedish-owned company behind the service, True Software Scandinavia AB, reports that it now has over 3 billion telephone numbers in its database and over 100 million Google Play Store downloads for its Android app alone.

Having raised over $100 million in funding to date, the company recently announced that it is currently scouting for new offices across Afrika given that it has over 50 million users on the continent.

"The tremendous growth we’ve had across Africa the past two years has truly been amazing and yet we feel it is still only the starting point of what is about to come," said Ted Nelson, Chief Commercial Officer at Truecaller.

According to Truecaller, South Africa, Nigeria, Kenya, and Egypt rank among the top 20 countries globally which are being "plagued" by unwanted spam calls.

There is no denying what value Truecaller adds to those who use the app, but have you ever wondered how your telephone number is available on Truecaller despite you not having ever installed the app?

Permission-based crowdsourcing

The concept behind Truecaller is easy to understand. It is essentially a global telephone directory that allows its users to have caller ID service despite not having the caller's telephone number in their phone's address book. Added to the caller ID feature, another popular feature on the Truecaller app is the call blocking one. This allows a user to block calls from specific telephone numbers you don't want to receive or ones that have been labeled as spam by other users of the service.

However, there is something quite interesting about the Truecaller app which you typically observe when you call someone who doesn't have your number on their address book but they have the Truecaller app. Despite you not having ever used the app, as soon as you call a Truecaller user, your telephone number appears on their screen along with your name. This is possible because one of the ways Truecaller collects data to populate its database is through what they call "permission-based" crowdsourcing. This is a process where anyone who installs their app also has an option that gives the Truecaller app the option to upload their entire address book to the Truecaller database.

"There are several different ways that Truecaller gets its data. On a daily basis, there are over 350.000 new registered users that comes [sic] onboard on Truecaller that creates [sic] a profile. We have a very large user base that helps with contributing information by tagging and suggesting name to numbers, but also spam reporting. We have created a service that is built by a vibrant community that contributes and adds information so the rest of the community can benefit from it," explained Ted Nelson, Chief Commercial Officer at Truecaller, to iAfrikan.

As part of the Truecaller app's Terms of Service and Privacy Policy, you as a user have to give it access to your entire address book, which is in turn added to their global database of people's contact details. Crowdsourcing is not the only method by which Truecaller collects people's and organizations' contact details as Nelson further explained to iAfrikan.com.

"We also gather, and organizes [sic] phone numbers from different sources including white and yellow pages across the world, and social media channels.
Once the information is gathered, Truecaller runs it through different layers of verification (our proprietary algorithms) to make sure that the contact information we organize is accurate."

That's correct, through various methods Truecaller is able to integrate to various social media platforms and refine the data it already has uploaded on its contacts database. This can include things such as matching a name to a telephone number, uploading a profile photo, specifying a location, etc.

This is partially covered under section 1.1 of their Privacy Policy which states:

Truecaller may supplement the information provided by You with information from third parties and add it to the information provided by You e.g. demographic information and additional contact information that is publicly available.

The details of this data refinement process are not publicly available. Once you have uploaded your address book to Truecaller and it has been refined, those details are now available on their database. Throughout this process, you will note, that you (as a non-Truecaller user) are not notified that your personal contact details have been uploaded without your permission.

It gets even more interesting when you read section 1.2 of Truecaller's Privacy Policy, which further emphasizes that Truecaller will have "access to device address book":

When You install and use the Services, Truecaller will collect personal information from You and any devices You may use in Your interaction with our Services. This information may include e.g.: geo-location; Your IP address; device ID or unique identifier; device manufacturer and type; device and hardware settings; SIM card usage; applications installed on your device; ID for advertising; ad data, operating system; web browser; operator; IMSI; connection information; screen resolution; usage statistics; default communication applications; access to device address book; device log and event information; logs, keywords and meta data of incoming and outgoing calls and messages; version of the Services You use and other information based on Your interaction with our Services such as how the Services are being accessed (via another service, web site or a search engine); the pages You visit and features you use on the Services; the services and websites You engage with from the Services; content viewed by You, content You have commented on or sent to us and information about the ads You see and/or engage with; the search terms You use; order information and other usage activity and data logged by Truecaller’s servers from time to time. Truecaller may collect some of this information automatically through use of cookies and You can learn more about our use of cookies in our Cookie Policy.

This means that even if just one person has your contact details on their device address book, without your permission, as soon as they install the Truecaller app your contact details are now part of the global Truecaller database. Truecaller doesn't immediately make your contact details, as a non-user, available (but users can search based on your name) but as soon as you call any Truecaller user, the app's caller ID function will query the database and identify you, thus indirectly "unlocking" your identity.

Upgrade for more details

Truecaller also allows anyone to search for your contact details by name, and if they don't have you on their device address book, a Truecaller user can upgrade to the premium version of the app to be able to "ask" you for the app to display your telephone number.

That's how Truecaller partly monetizes your contact details, whether you have the app installed or not. The other publicly visible monetization method they use is through serving ads on the app.

Although they don't make the uploaded data immediately available publicly, the idea that one's personal data (especially through someone else's address book, and not publicly available) is being monetized without permission is a cause for concern apart from the privacy concerns.

"Truecaller features are permission based and are disabled by default, and the users can choose whether to participate in this community or not. We know that in today’s world, privacy is a top concern. That is why we make sure we have clear principles we follow, and allow our users to decide how their information is shown or shared," said Nelson.

Nelson further added that to learn more about permissions required by Truecaller, you can visit their website here.

Privacy concerns

The privacy concerns cannot be overemphasized in a time where even parents give their children (minors), smartphones to be able to keep in touch with them. Given Truecaller's Terms of Service and Privacy Policy, this means that if a parent has the Truecaller app installed, their children's contact details will be uploaded to the Truecaller database. Added to this, depending on how Truecaller enhances the data and which sources it uses, it could even identify more details on the children like their geo-location as mentioned in their Privacy Policy.

The other concern is that at no point in their processes does Truecaller ask those whose details are uploaded to their database whether they agree to this or not. Nelson however points out that, if concerned, "we make it very easy for people to unlist their number from Truecaller through our website."

Even though there are benefits to having the Truecaller app installed, think a little longer (if you haven't already installed the app) on those whose privacy you could be putting at risk by installing the app.

Note: To unlist your telephone number from Truecaller, go here (If you are already a Truecaller user, you'll need to deactivate your account before unlisting).

After much back and forth on 10 November 2017, iAfrikan.com sent questions to Truecaller's Kim Fai Kok Director of Communications, to get clarity from the company on the privacy concerns raised in the article and to further elaborate on the statements and answers that Ted Nelson, Chief Commercial Officer at Truecaller, had sent iAfrikan.com.

iAfrikan.com: Does Truecaller upload contact details of people who are not Truecaller users and/or have never used the Truecaller service?

Truecaller: Truecaller does not upload contact details of non-users for publication from users who have downloaded the application from Apple App Store or the Google Play Store.

Does Truecaller upload telephone numbers of minors (under 18)?

We cannot distinguish phone numbers of minors and Truecaller does not knowingly engage with data in relation to minors.

Does Truecaller have a process to check if a telephone number being uploaded belongs to a minor?

See answer above

Do you have a process to ask those whose contact details are being uploaded (i.e. not the person installing the app, but the data subject) if they agree for their details to be uploaded to Truecaller? (i.e. permission)

If the subject is already a Truecaller user, they would have agreed to our T&C, however for subjects who have not agreed to our T&C, we’ve made it easy for them to opt out of the service or, if they want, control the content of their profile by becoming a user. Regardless, their phone numbers cannot be accessed by doing a search for their name in Truecaller without their consent.

Wouldn't this uploading of data in the manner that you do as Truecaller be in contravention of the EU's upcoming General Data Protection Regulation (GDPR) laws and South Africa's upcoming Protection of Personal Information (PoPI) Act?

We are committed to being compliant with all existing and future laws and regulations applicable to us.