In February 2025, Nigeria’s data regulator fined Meta $32.8 million. By November, a court had closed the case on terms few people saw. A year on, that deal is being tested in court and in public.
The Nigeria Data Protection Commission (NDPC) says it settled to win change, not to wipe out the penalty. Critics say the deal gave away too much. A Lagos court has since ruled against Meta in a separate case. Meanwhile, Nigerian fintechs face a hard deadline to keep payment data inside the country by 1 January 2027. That contrast now drives a bigger debate. Are global tech giants and local founders held to the same standard?
Start with what happened. On 18 February 2025, the NDPC fined Meta $32.8 million and issued eight corrective orders. It said Facebook and Instagram used behavioural advertising without clear consent. It also said they moved Nigerian data abroad without approval. The commission said about 60 million Nigerians were affected. Meta went to the Federal High Court in Abuja to have the orders set aside. It said it had not been given a fair hearing. The court let the case go ahead but refused to freeze the NDPC’s actions.
Then the two sides talked. They signed terms on 30 October 2025. On 3 November, the court adopted them as a consent judgment. The judge had warned days earlier that some terms covered matters outside the original claims. The details stayed out of view for months. Law firm Olumide Babalola LP got a certified copy from the court and published a review in January 2026. Premium Times reported the contents in late April.
The wording is where critics focus. The NDPC’s orders told Meta to seek clear, specific consent before behavioural advertising. The settlement asks Meta to use its “best endeavours” to improve. The orders barred cross-border transfers without approval. The settlement speaks of “safeguards for cross-border transfers.” Lawyer Iliya-Ezekiel Ndatse says the new promises mostly repeat duties already in the 2023 data protection law. Babalola LP also spots a clash in the text. One clause lists new duties for Meta. Another sets aside the Final Orders and releases the company from claims. The deal also says it is not an admission of wrongdoing.
The NDPC tells a different story. On 28 April 2026, it said the fine was reduced, not cancelled. Spokesperson Itunu Dosekun said part of the money was paid to the government. The rest was turned into joint work with Meta, such as awareness drives and translations of the Nigeria Data Protection Act into local languages. She said Meta also agreed to cover the government’s legal costs. The commission has not said how much Meta paid.
The NDPC calls its approach “remediation over punishment.” It says it exists “to promote businesses, not to spoil businesses.” When it launched the follow-up programme, it added, “Nothing in this settlement limits the Commission’s independent statutory powers.”
That programme is the Meta-Supported Initiative for Data Protection, or M-SIDP. The NDPC and Meta unveiled it on 8 June 2026. It runs for two years. It has four parts: governance and research, ecosystem safety, training for data protection officers, and public awareness.
Eighteen days earlier, on 21 May, Meta joined the communications ministry and a national AI centre to launch GovGuide Nigeria. GovGuide is a chatbot on WhatsApp and the web. It speaks English, Hausa, Igbo and Yoruba. It runs on Meta’s open-source Llama models.
A September 2026 Business Day investigation put these ties in a wider frame. It was part of a project called “Big Tech’s Invisible Hand.” It found at least 17 recorded engagements since 2024 between Nigerian state bodies and Meta, Google and Microsoft. They cover training, funding, AI projects and policy talks. Nigeria has no lobbying register, the reporters note, and many agreements are not public. Meta did not provide the GovGuide agreement.
Digital rights lawyer Saidu Lawal Mohammed told the investigation: “It is apparent that there is a built-in incentive for regulators to be soft on these companies.” Tracy Keshi of the media group CJID warns of a bad signal. Waiving a fine, she says, can teach big firms that Nigerian penalties are open to bargaining.
Meta’s wider Nigerian record adds weight. Nigeria’s competition regulator fined Meta and WhatsApp $220 million in July 2024. An advertising regulator added a $37.5 million fine. Reports in October 2025 said both were still open.
The courts have now weighed in. On 15 December 2025, the Data Privacy Lawyers Association of Nigeria (DPLAN) sent the NDPC a pre-action notice. It argued that the commission has no legal power to waive a fine for proven violations. It gave the NDPC 30 days to explain. A legal news site has since reported that DPLAN filed suit.
Then came a separate case. On 25 September 2026, a Lagos court in Ikorodu ruled for a rights group and five individuals. It found that Meta had profiled them for advertising without a lawful basis. It said this broke their privacy rights and the Nigeria Data Protection Act. It also found unlawful cross-border transfers.
The court ordered Meta to pay the naira equivalent of $100,000 in damages. The claimants had asked for $100 million. Meta must also file a compliance affidavit by 20 November 2026. The judge treated the Abuja consent judgment as binding on its parties and set the NDPC orders aside as a basis for the claim. This is a first-instance ruling, so Meta can appeal.
Now the other half of the debate. On 15 June 2026, a week after M-SIDP launched, the Central Bank of Nigeria (CBN) issued a circular. It told banks, payment firms and fintechs to keep domestic payment data in Nigeria by 1 January 2027. It also asked payment firms to name their real owners. In August, the IT agency NITDA set up a task force for its sovereign cloud plan.
Technext’s analysis argues the CBN rule reaches beyond main ledgers. It says audit logs, backups and encryption keys also count. For a small fintech, that could mean a costly rebuild on a tight clock. Supporters of the rule would say payment data is sensitive and belongs under Nigerian oversight. The open question is whether global platforms face equally firm demands.
Why it matters: Nigeria is one of Africa’s biggest digital markets. How it enforces its data law shapes how others treat theirs. If big platforms can bargain down penalties while local startups face hard deadlines, trust suffers. If the NDPC’s approach brings real change, it could be a model for regulators who want results without long court fights. Either way, citizens and founders should be able to see the terms.
What to watch next: Meta’s reply to the Lagos ruling and its 20 November filing. Also watch the court fight over DPLAN’s challenge, any word from the NDPC on what Meta paid, what M-SIDP delivers, and whether the CBN keeps its January 2027 date.
Sources: Technext analysis by Blessed Frank (22 October 2026); BusinessDay on the Abuja court hearing; The Nigeria Lawyer on the NDPC’s clarification; The Nigeria Lawyer on DPLAN’s pre-action notice; Techeconomy on M-SIDP; Business Day via TimesLIVE on Big Tech’s Invisible Hand; PPC Land on the Lagos High Court ruling; Techpoint on the CBN circular; Nairametrics on NITDA’s sovereign cloud task force; Techpoint on the Meta settlement talks.
A note for startup founders: Don’t practice on investors. Practice on AI first. RaiseReady by Index Prima is an AI fundraising simulator for African founders: upload your pitch deck, get a readiness score and face a tough AI investor before the real meeting. Find this post, and every post we publish, at raiseready.indexprima.com.
