Investigation details how caller ID app Truecaller, which has 205M+ MAUs in India, uses India's weak data privacy laws to build its user information database
In October 2021, I called a journalist based in Pakistan, who did not know me. Surprisingly, they greeted me by my name when they received the call.
Context & Ripple Effects
Truecaller's database has always been crowdsourced: users upload contacts, and names get attached to numbers belonging to people who never signed up. The company crossed 200M monthly active users with 150M in India back in 2020 and now claims 205M+ there, making India both its user base and the jurisdiction where consent rules are weakest.
The Caravan investigation lands on well-documented ground: researchers flagged as early as 2019 that apps like Truecaller and Hiya ship user data to third-party analytics firms without explicit permission (the robocall-app data-sharing findings), and IFEX showed how the same name-to-number mapping endangers journalists who never installed the app. With growth now slowing under pressure from telcos, Apple, and Google building native caller ID (TechCrunch on Truecaller's mounting competitive pressure), the privacy story is no longer a side issue — it is the differentiation battleground.
First-order effects
- People whose numbers were uploaded by others — journalists most acutely, per the earlier IFEX reporting — are identifiable by name on every incoming call, without ever having consented to Truecaller.
Second-order effects
- Telco-, Apple-, and Google-built caller ID alternatives can compete on consent and on-device processing rather than a shared crowd database, attacking Truecaller exactly where its 205M-user moat sits; erosion of trust also threatens the paid tier, where iOS subscribers alone account for 40% of revenue.
Third-order effects
- If India moves from weak enforcement to a real consent regime, crowdsourced identity databases lose their cheapest source of supply, forcing platforms like Truecaller toward opt-in models or on-device matching — the same permission-boundary question now playing out across the broader dark-data economy Rest of World documented.
The trend: Crowdsourced identity databases built on weak-consent jurisdictions are being squeezed between rising privacy regulation and platform-native alternatives that keep contact data off third-party servers.