Truecaller

Is Truecaller safe?

Truecaller is safe to install from an official app store, and for many people it is the best defence they have against spam and scam calls. The privacy question is unusual: the people most affected are often not its users. Its caller ID works by putting names to phone numbers, including numbers of people who never signed up, based on what other users report and suggest. Truecaller says it has about 500 million users. We score it 53/100.

How Truecaller knows who is calling

Truecaller's European privacy policy describes the mechanism plainly. Users can report a number as spam, give feedback and "suggest names for phone numbers they have interacted with so that previously unknown callers can be identified to other users via live caller ID". A suggested name is shown once it has been "verified through consistent community input". The policy for users outside Europe adds signals such as how often a number calls Truecaller users and how users react to it, which it uses to rate a number's trustworthiness.

That is why your name can appear on a stranger's screen even if you have never installed the app, and why a nickname someone saved for you can leak. The global policy also asks users who share someone else's details to confirm that person knows and consents, which few people do in practice.

Contact uploading used to be the main criticism. Today it depends on the region. The European policy says contact lists are read on the device and not uploaded. A separate addendum says that outside India, Colombia, Egypt and Kenya, sharing your whole address book through "Enhanced Search" is offered only in app versions obtained outside the App Store and Google Play. The India policy lists access to the device address book among the data collected.

What the app collects about you

Apple's App Store label for Truecaller lists device ID, product interaction and advertising data as used to track you across other companies' apps. Contact details, purchase history, coarse location, search history and user ID are linked to you for analytics and personalisation, and contacts are listed as collected but not linked to you. The free app carries ads, so tracking is part of the deal. The global privacy policy also lists metadata of your calls and messages, installed apps and SIM details among the data it can collect, depending on platform and settings.

Has Truecaller been hacked?

We found no confirmed breach of Truecaller's own systems. Two episodes show where the risk lies instead. In May 2019, and again in 2020, data sets said to contain names, numbers and email addresses of tens of millions of Indian users were offered for sale online. Truecaller denied a breach both times, saying the data matched fields that users make searchable and was likely scraped or compiled by bad actors. Either way, a database built for lookups can be harvested by people who abuse lookups.

In July 2019 an app update signed up some Indian users for Truecaller's UPI payment service without their consent. The company called it a bug and said no one's registration was completed, but India's payments body barred it from adding new UPI users.

Regulators and courts

Sweden's data protection authority, IMY, received complaints from one person in 2022 and 2023 and opened an investigation in 2025. On 5 September 2025 it told Truecaller the investigation did not show a GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary breach and closed the case without penalties. Truecaller's European policy also notes that its search database holds a Swedish publishing certificate, which exempts some processing from the GDPR where it does not infringe freedom of expression.

In India, the Bombay High Court issued notice in 2021 on a public interest petition over data sharing and the UPI sign-ups, and a separate petition in the Delhi High Court was dismissed. A suit in Kenya argued Truecaller had not registered with the national data regulator. We found no fine anywhere.

How to use Truecaller with less exposure

1. Install it only from the App Store or Google Play. Unofficial versions can turn on address book sharing.
2. On iPhone, turn off "Allow Apps to Request to Track"; on Android, delete your advertising ID or opt out of ad personalisation.
3. Think before granting contacts access; it lets the app match callers with your saved contacts and find contacts who use Truecaller messaging.
4. If you do not want to be found by name, unlist your number at truecaller.com/unlisting.
5. Treat a spam label as a hint, not proof. Legitimate callers such as clinics and delivery firms are sometimes mislabelled.

How we scored it

Privacy (35) is the weakest factor because the service depends on identifying people who never joined, and the app tracks users for ads. The regulatory record (72) and scams and harmful content (68) are its strengths: no fines, a closed Swedish GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary case, and spam blocking that does real good. For apps whose main job is private communication, compare Signal and WhatsApp.