TRAI's New Rule Forces Truecaller to Share Spam Data With Telcos

Every time you tap "Report Spam" on Truecaller, that data used to stay inside Truecaller's own systems. Not anymore. India's telecom regulator has ordered caller-ID apps to start handing those reports straight to telecom operators, and the company that built its entire business on spam detection is not happy about it.

What TRAI actually changed

The Telecom Regulatory Authority of India (TRAI) notified the Telecom Commercial Communication Customer Preference (Third Amendment) Regulations 2026 in mid-September, and the fallout is still playing out. The rule targets any app that lets users flag a call or SMS as spam — Truecaller is the obvious example, but the language covers every call-management app with a similar feature. From now on, when enough users on one of these apps mark a number as junk, the app has to push that signal into a blockchain-based platform that telecom operators jointly run and control.

Think of that platform as a shared ledger that Jio, Airtel, Vi and the rest can all read from and write to — a Distributed Ledger Technology (DLT) setup, which is really just a tamper-resistant shared database distributed across the telcos instead of sitting on one company's server. TRAI's pitch is straightforward: operators already run spam-blocking systems of their own, and crowd-sourced reports from apps with hundreds of millions of Indian users would make those systems sharper.

The regulation also widens the net to automated calls — robocalls and prerecorded or AI-generated voice calls — bringing them under the existing Application-to-Person (A2P) framework, the bucket TRAI uses for bulk commercial messaging from banks, delivery apps and the like. Any automated call that isn't properly declared as A2P now gets treated as spam by default.

Why Truecaller is pushing back

Truecaller's objection isn't that spam-sharing is a bad idea. It's that the pipe only runs one way. The app has to send its spam signals to operators, but operators aren't required to send anything back — no access to network-level spam data, no reciprocal feed, nothing that would help Truecaller's own detection improve. The company has framed it as a regulator forcing a private product to subsidize infrastructure owned by a handful of telecom giants, for free.

A rule that only works in one direction isn't really data-sharing — it's a transfer.

There's also a legal wrinkle worth noting: TRAI's core authority under the TRAI Act is to regulate licensed telecom service providers. Truecaller isn't a telecom operator — it's an app — which is part of why the company has questioned how far this mandate can legitimately reach, even while saying it has already been complying with an earlier, related restriction since late last year.

One carve-out survives the amendment untouched: apps still can't blanket-block or spam-tag calls coming from government-designated number series. Whatever you think of that exemption, it means the system that's being built to clean up spam has a built-in blind spot for official numbers — including, critics point out, some that have been used in impersonation scams in the past.

Why this matters beyond the Truecaller-vs-TRAI fight

For the ordinary Indian phone user, the scale here is hard to ignore. Truecaller says it logged roughly 42 billion spam calls hitting Indian numbers in 2025 and managed to block around 12 billion of them. That's not a niche irritation — it's a daily reality for anyone who has ever gotten a 9 a.m. call about a "pending loan offer." Whether routing more of that signal through a telecom-controlled platform actually cuts the number of calls that reach your phone, or just shifts who owns the data about them, is the real question nobody can answer yet.

There's a privacy angle too, one that sits close to the Digital Personal Data Protection (DPDP) Act's territory even though TRAI's order is a separate telecom regulation. Spam-tagging data reveals patterns about who's calling whom and how often — and mandating that a private app route it to a consortium of telecom companies, without a public audit trail on how that shared ledger is secured, is the kind of data-flow question India's broader privacy framework is supposed to scrutinize. It's a reminder that "telecom rule" and "data protection rule" increasingly overlap in India, and enforcement hasn't caught up to that overlap yet.

A few things to watch as this plays out:

• Whether TRAI extends the same mandate to built-in spam detection on Android and iOS, which currently sits outside this order.
• Whether Truecaller challenges the rule formally rather than just objecting publicly.
• Whether the promised crackdown on undeclared AI-voice robocalls actually reduces the volume Indian users see, or whether spammers simply route around the A2P declaration requirement.

Mandated data-sharing between a private app and a group of incumbents is a pattern India has leaned on before — UPI itself was built on forcing banks to interoperate. The difference is that UPI's rulebook gave everyone equal access to the rails. This one, at least for now, gives the telcos a one-way tap into the thing that made a $2-billion-plus caller-ID business worth building in the first place. How that imbalance gets resolved will say a lot about whether India's telecom regulator sees itself as a referee or as a collector on behalf of its biggest licensees.