[JeanMarcS]

Something sure is that when they (OP app) starts sending mail or SMS to user contact to shame him/her, it will definitely be unsolicited mail/sms.

Imagine you have a friend in debt and start receiving such notices ? They’re collecting private information on you (your name, your phone number or your email) without your consent.

IANAL but I’m pretty confident it falls under GDPR.

(Sans parler du fait que les mecs qui font ça sont quand même une belle bande d’enfoirés)

[BrandoElFollito]

Except if the app user went to their contacts to ask them for authorization, as they should do under EU law.

If they do not, they are to blame because they willingly shared the contacts. The app used them per their tos.

(et oui, je suis d'accord que c'est un vrai dick move, aparamment c'est une pratique courante en Inde pour ce genre d'apps)