Phone number privacy refers to the protection and proper management of personal information associated with phone numbers. Under Japan's Act on the Protection of Personal Information, phone numbers qualify as "personal information" because they can be easily cross-referenced with other data to identify individuals. Unlike names or addresses, phone numbers are difficult to change once leaked, and the resulting harm tends to be prolonged.
The risks of a leaked phone number are wide-ranging. Being targeted by nuisance calls and telemarketing is just the beginning. More serious threats include smishing (SMS fraud) redirecting to fake websites, SIM swap attacks hijacking the number, and vishing (phone-based phishing). Furthermore, a phone number can be used to identify social media accounts, exposing personal behavior patterns and social connections.
Phone numbers leak through three main channels. First, registration with web services and apps - data breaches on the service side continue to expose large volumes of phone numbers. Second, sale to list brokers - numbers collected from phone directory listings, surveys, and sweepstakes entries are traded as lists. Third, sharing numbers during transactions on social media or flea market apps.
Defensive measures include not registering your number with unnecessary services, preferring authenticator apps over SMS for two-factor authentication, minimizing the exposure of your number, and using a virtual phone number for service registrations. If nuisance calls are already increasing, call blocking and spam call filters can mitigate the damage. See Phone Number Privacy Tips for specific measures and Data Breach Response for what to do when a leak is discovered.