A judge of the High Court of Lagos State held on September 25, 2026 that Meta Platforms, Inc. violated the constitutional privacy rights of six applicants by profiling them for advertising on Facebook and Instagram without a lawful basis. Justice A.F. Pokanu, sitting in the Ikorodu Judicial Division, rejected Meta's argument that its terms of service turn such processing into a contractual necessity, awarded general damages in the naira equivalent of US$100,000 and gave the company eight weeks to file an affidavit showing that its data processing operations in Nigeria comply with the Nigeria Data Protection Act 2023.

In Short

A court in Lagos, Nigeria, decided that Meta broke the law by using personal information about the Facebook and Instagram users who brought the case to target ads at them without properly asking first. The judge said that signing up and accepting general terms is not the same as agreeing to be profiled for advertising, and that Meta, not its users, is the one sending Nigerian data to servers abroad. Meta has to pay the naira equivalent of US$100,000, stop processing the applicants' data unlawfully and prove within eight weeks that its operations in Nigeria follow the country's data protection law. The decision comes from a first-instance court and can be appealed, so it does not yet settle the rules for every Nigerian user.

What the court granted, and what it refused

The applicants asked for twelve reliefs. They received most of them, though at a fraction of the price they named.

Justice Pokanu granted six declarations in the terms sought. The first holds that the non-consensual collection, processing, profiling and use of the applicants' personal data for behavioural advertising violates Section 37 of the Constitution of the Federal Republic of Nigeria, 1999, which guarantees the privacy of citizens. The remaining five find Meta in breach of the Nigeria Data Protection Act (NDPA) 2023: processing without a lawful basis under sections 24(1) and 25, violation of the fairness and purpose limitation principles in section 24(1)(a) and (b), breach of the duty of care in section 24(2) and (3), breach of the transparency principle in sections 24(1)(a) and 27, and an unauthorised cross-border transfer of personal data in violation of sections 41 to 43. The last declaration extends to "members of the class" as well as the named applicants.

Two operative orders followed. Meta must "cease forthwith all unlawful processing of the personal data of the Applicants including processing for behavioural advertising without a lawful basis." It must also take immediate remedial measures to bring its data processing operations in Nigeria into full compliance with the NDPA and file an affidavit of compliance within eight weeks of the judgment. The applicants had asked for four weeks. Eight weeks from September 25 falls on November 20, 2026.

The money is where the gap opens. The applicants sought general damages in the naira equivalent of $100,000,000 and a further $100,000,000 in exemplary damages. The court awarded general damages in the naira equivalent of US$100,000 - one thousandth of the general damages claimed, and 0.05 percent of the combined monetary claim. Exemplary damages were refused outright. Post-judgment interest at the prevailing Central Bank of Nigeria rate and costs of 1 million naira complete the award. The judgment does not say how the damages are to be divided among the six applicants.

Six applicants and a representative claim

The first applicant is the Incorporated Trustees of Laws and Rights Awareness Initiative, suing "for and on behalf of Nigerian Members using Facebook and Instagram Accounts." Five individuals joined it: Deborah Esther Orji, Abayomi Olakunle Adebayo, Olamijulo Ayomide Ogunkilede, Kitan Bankole and Abiola Owoaje. The suit carries the number IKD/21116MFHR/2025 and was brought under the Fundamental Rights (Enforcement Procedure) Rules 2009, Section 37 of the Constitution and sections 24 to 29, 39 and 41 to 43 of the NDPA.

The originating application was dated December 21, 2025 and filed on January 14, 2026, supported by a 25-paragraph affidavit sworn by Mayomikun Kajero, a litigation officer of the first applicant, and five exhibits. Judgment arrived 254 days after filing. Olumide Babalola Ph.D., who is listed as one of the first applicant's trustees, appeared with H. Tofi for the applicants. Mofesomo Tayo-Oyetibo SAN, with Lukwagh Mgbanyi, appeared for Meta.

Meta's defence rested on a 20-paragraph counter-affidavit dated May 13, 2026, sworn by Adeniran Haastrup, an Associate General Counsel, EMEA Disputes, with 11 exhibits. Those exhibits included the company's registration pages for Facebook and Instagram, its current terms, privacy and cookies policies for Nigeria, a copy of its data centre locations page and copies of posts made via Facebook and Instagram accounts. Meta stated that Facebook and Instagram are not legal entities, that it is a Delaware company with its principal place of business in Menlo Park, California, and that it has not advertised an office at Kings Tower, 24 Glover Road, Ikoyi, Lagos, the address the applicants gave for it. In opposing Meta's preliminary objection, the applicants exhibited documents they said showed Meta had publicly represented that address as its Lagos office, and a certified copy of a letter from the Nigeria Data Protection Commission (NDPC) delivered to Meta there.

The regulator's orders, and a settlement that removed them

The dispute has a regulatory prehistory. According to the applicants' affidavit, a non-governmental organisation called Personal Data Protection Awareness Initiative petitioned the NDPC against Meta in 2023. The commission's investigation, the applicants said, found in February 2025 that Meta's data processing affected over 60 million Nigerian users; it imposed a remedial fee of USD 32.8 million and issued eight corrective orders. Among the findings the applicants listed: processing for behavioural advertising without a lawful basis, failure to obtain explicit and informed consent, unauthorised cross-border transfers and the processing of non-user data.

Meta did not accept those findings. It acknowledged that the NDPC issued Final Orders on February 18, 2025, and told the court it challenged them in Suit No. FHC/ABJ/CS/355/2025 at the Federal High Court in Abuja, where its originating summons was dated March 19, 2025. Before a judgment on the merits, the parties agreed Terms of Settlement dated October 30, 2025, which the Federal High Court entered as a consent judgment on November 3, 2025. PPC Land reported in December 2025 that the settlement was for $32.8 million and that the commission agreed to set aside its Final Orders. Meta relied in Lagos on paragraph 9.2 of the consent judgment, which, according to its counter-affidavit, set aside the Final Orders and released the company from "any and all claims" the NDPC had or might have in respect of the investigation.

The two sides do not tell the same story about where that settlement stands. In their further affidavit dated May 26, 2026, the applicants stated that the consent judgment did not nullify the NDPC's findings, that it is being challenged in Suit No. FHC/ABJ/CS/173/2026 between the Data Privacy Lawyers Association and Meta and the NDPC, pending at the Federal High Court in Abuja, and that there are news reports of the NDPC denying that the Final Orders were set aside. The Lagos judgment does not resolve that factual dispute. It treats the consent judgment as binding.

On that basis, Justice Pokanu cut the NDPC orders out of the case. A consent judgment binds only the consenting parties, the court accepted, so it cannot bind the applicants. By the same logic, the applicants were never parties to the NDPC proceedings either. "The Applicants cannot approbate and reprobate," the judgment states. Because the commission "acted in the public interest of all data subjects in Nigeria, including the Applicants herein," the Final Orders are "no longer available as a cause of action." Any remedy on that front, the judge wrote, lies in seeking to set aside the consent judgment itself.

The distinction matters because a similar claim failed elsewhere. According to TheNigeriaLawyer, the High Court of Imo State dismissed a $25 million data protection claim against Meta on July 21, 2026, finding that the applicant's case leaned on the NDPC orders that had since been set aside and that the remaining allegations were bare assertions. In Lagos, the court found that the applicants' affidavit contained other averments - paragraphs 12 to 19 of the affidavit and 7 to 12 of the further affidavit - alleging unlawful processing, unauthorised transfers, processing of non-user data and failures of transparency and duty of care. Those, it held, deserved a hearing on the merits.

Five objections to jurisdiction

Meta's notice of preliminary objection, dated April 29, 2026, asked the court to dismiss or strike out the suit on seven grounds, argued as five issues. All five failed.

The first targeted the lawyer. Meta argued that Rule 8(3) of the Rules of Professional Conduct for Legal Practitioners 2023 barred Babalola, a trustee of the first applicant, from representing it. The court read the rule as applying to "a director of a registered company," not to a trustee of an incorporated body, and added that even a valid objection would disqualify counsel rather than invalidate the suit.

The second relied on section 97 of the Sheriffs and Civil Process Act, which requires a notice endorsed on process served outside the state. The court held that the provision names only a writ of summons and, following the Court of Appeal in IGP & Ors v. Omagbeosa (2024), does not apply to fundamental rights applications.

The third argued that the suit was really an NDPA claim dressed as a constitutional one, since, Meta said, only the first of the twelve reliefs falls within the Constitution's fundamental rights chapter. The court disagreed. Relying on the Court of Appeal's 2021 decision in Incorporated Trustees of Digital Rights Lawyers Initiative v. NIMC, which held that personal data protection falls within the Section 37 right to privacy, it described the statute as the mechanism through which the constitutional right operates. "In essence, the CFRN 1999 establishes the supreme fundamental right while the NDPA 2023 delivers the actionable statutory framework," the judgment states. Among the sources cited in that part of the ruling is a fundamental rights practice guide bearing the judge's own name as author.

The fourth issue was territorial. Meta argued nothing connected the claim to Lagos State. The court found that the deponent and applicants live in Lagos, use Facebook there, and that the processing complained of is "directly attributable to the data processing activities carried out by the Respondent in Lagos State."

The fifth invoked Meta's terms, which provide for disputes to be resolved under United States law and in California. The court dismissed the clause as irrelevant to a constitutional claim. "Parties cannot contract out of their constitutional rights, particularly fundamental rights, which are enshrined in the CFRN 1999," the judgment reads, and the right to seek redress "is a constitutional entitlement that cannot be surrendered or waived through a commercial agreement." Forum clauses in platform terms have had a difficult year in other courts as well: in August, a federal judge in California refused to move a privacy case against xAI to Texas because the plaintiff had not received adequate notice of the terms containing the forum clause.

Meta then raised four further "preliminary points" inside its written address on the merits. The judge said the rules require such objections to be filed separately, but considered them anyway, noting that a trial court addresses alternative issues in case of a "likely appeal" so the Court of Appeal has its view without sending the case back. Each point failed. The affidavit was not hearsay, because the deponent was an officer of the applicant organisation, not a clerk at its law firm, which distinguished the Court of Appeal's 2025 decision in Mairami v. Gonidinari. It was not too vague. The NDPC consent judgment removed the regulator's orders, but not the rest of the case. And the applicants had not waived their rights by staying on the platforms: Meta pointed out that the second to sixth applicants kept their accounts after filing suit, and that four of them continued to use them actively. Citing Okafor & Ors v. Ntoka & Ors (2017), the court held that the Section 37 right cannot be waived. "The fundamental nature of the right precludes its waiver by such conduct."

The substantive argument turned on legal basis, the question that has dominated European litigation against Meta since 2018.

Meta described a two-track system to the court. For on-site data - information users provide directly and data generated by their activity on Facebook or Instagram - it relied on performance of contract to deliver targeted advertising. For off-site data received from third parties such as advertisers through its business tools, covering how users interact with other websites and apps, including visits, purchases and ads seen, it relied on consent. The company told the court that it is fully transparent about its data-driven service, that prospective users must affirmatively agree to its terms before registering, and that it does not sell personal data.

Its Facebook Terms of Service, reproduced in the counter-affidavit, open with the bargain: "We don't charge you to use Facebook or the other products and services covered by these Terms, unless we state otherwise. Instead, businesses, organizations, and other persons pay us to show you ads for their products and services." The court read that passage and its Instagram equivalent as a "clear admission" that Meta uses its users' personal data, including the applicants', for advertising. What remained was whether the law permitted it.

Justice Pokanu framed the question in broad terms: "To what extent may a private technology company observe, aggregate, analyse, profile and commercially exploit the digital behaviour of a Nigerian citizen without that citizen having genuinely understood, authorised or reasonably expected that processing?"

The answer ran through sections 25 and 26 of the NDPA. Section 25 lists six lawful bases for processing, including consent, contractual necessity and legitimate interest. Section 25(2) excludes an interest as legitimate where it overrides the data subject's fundamental rights, is incompatible with another lawful basis, or involves processing the data subject would not reasonably expect. "The Respondent cannot simply say that advertising finances its free service, therefore behavioural advertising is a legitimate interest," the judgment states. Section 26 places the burden of proving consent on the data controller and directs attention to whether a service is made conditional on consent to processing not necessary for the contract.

Meta did not carry that burden, the court found. The applicants had set out what proof of electronic acceptance ordinarily looks like: electronic signatures; clickwrap records showing a timestamp, account identifier, IP address, device details, the version of terms accepted and backend logs of the consent event; and digital audit trails such as server logs, session records and verification records. Meta produced none of it. "The Respondent on its part has not demonstrated any means of acceptance of its Terms and Policies by the Applicants," the judge wrote.

The dates on Meta's own exhibits compounded the problem. The Facebook Terms of Service in evidence were effective from January 1, 2025. The Instagram Terms of Use carried no effective date. The Privacy Policy was effective from December 16, 2025 and the Cookies Policy from December 12, 2023. The applicants argued that their cause of action arose in 2023, which made documents from 2025 retrospective. The court held that Meta had failed to show these were the terms the applicants had actually accepted.

On contractual necessity, the ruling is blunt. "I find and hold that the Respondent's reliance on contractual necessity as a lawful basis for advertising-related data processing is fundamentally misconceived." The judgment goes further: "behavioural advertising, profiling, cross-platform tracking, and advertising analytics are not indispensable to the delivery of the core services of a social networking platform. They are, at best, ancillary commercial mechanisms adopted by the Respondent for revenue generation and the monetisation of user engagement." Allowing Meta's argument, the judge wrote, "would permit the Respondent to define the scope of contractual necessity by reference to its own commercial interests, rather than by reference to what is objectively indispensable for the performance of the contract for access to a social networking platform."

The court also addressed the design of consent itself. Where consent is relied on, users must be told of the right to withdraw before they agree, and "consent must be affirmative rather than based on a pre-selected confirmation." A mechanism that "effectively mandates users such as the Applicants to accept personalised tracking or lose access to the service would face a serious section 26 question where the advertising processing is not objectively necessary to provide the social-network service."

A European yardstick

Meta argued strenuously that European case law had no place in a Nigerian court. The judge rejected that. Paragraph 3(b) of the preamble to the Fundamental Rights Enforcement Rules allows a court to consult foreign instruments to expand rights, never to restrict them, and the NDPA, the judgment notes, "heavily mirrors" the principles of the GDPR. The GDPR has not been domesticated in Nigeria, so it operated as persuasive authority only.

Two rulings of the Court of Justice of the European Union carried the weight. The first was Meta Platforms v. Bundeskartellamt (Case C-252/21), decided by the Grand Chamber on July 4, 2023. The judgment quotes its paragraphs 152 to 154 on the controller's burden of proving consent and the relevance of market dominance to whether consent is freely given, and its paragraph 150, which states that users must be free to refuse processing not necessary for the contract "without being obliged to refrain entirely from using the service," with an equivalent alternative offered "if necessary for an appropriate fee."

That passage is widely read as the legal footing for the subscription model Meta built in Europe. The European Data Protection Board concluded in April 2024 that most "consent or pay" models fail the GDPR standard for valid consent, and Meta took the board to the EU General Court over it in June 2024. In the EEA, Meta has since added a less personalised ads option, which it says uses 90 percent less data, and cut its subscription price to €5.99 a month on desktop and €7.99 on mobile, according to its 2026 Digital Markets Act compliance report. In the United Kingdom, the company set its ad-free subscription at £2.99 a month on the web in September 2025. The Lagos judgment does not order any comparable product for Nigeria. It does, however, borrow the reasoning that produced them.

The second ruling was Maximilian Schrems v. Meta Platforms Ireland (Case C-446/21), decided on October 4, 2024. That case concerned Meta's use of information revealing Schrems' sexual orientation, a form of special category data, to target him with ads, and established limits on how much personal data Meta may use for targeted advertising under the principle of data minimisation. Justice Pokanu quoted the CJEU's finding that storing social network users' data "for an unlimited period for the purpose of targeted advertising" is a disproportionate interference, and its description of Meta following users' navigation "through the use of social plug-ins and pixels embedded in the relevant websites."

Europe's regulators had drawn similar conclusions earlier. The European Data Protection Board ordered Meta in 2023 to stop processing data for behavioural advertising on the legal bases of contract and legitimate interest across the European Economic Area, after Norway's data protection authority requested urgent action.

The judge's conclusion was that Nigeria's statute already contains the same architecture. "In my estimation, the most important difference is not the text of the legislation but the depth of enforcement and jurisprudence surrounding it." The ruling then put the point in a single line: "what is sauce for the Respondent's European subscribers, is sauce for the Tens of millions Nigerian Data Subjects of the Respondent."

The court's working definition of behavioural advertising drew on a February 25, 2026 article by Masha Komnenic for Termly and a 2016 paper by W. Li and Z.Y. Huang in the American Journal of Industrial and Business Management. It listed eight categories of data commonly collected: IP address, search queries, location data, websites visited, time of visit, website activity such as clicks and scroll position, browser type and settings, and device type and settings. The practice, the judgment concludes, "involves collection, tracking, aggregation, inference, profiling, prediction, targeting, measurement and further optimization."

Transparency beyond the privacy policy

Section 27 of the NDPA sets out what a controller must disclose before collecting data directly from a data subject. The list includes the controller's identity, the specific lawful basis, the purposes of processing, recipients, data subject rights, the retention period, the right to complain to the NDPC and the existence of automated decision-making and profiling, with its significance and envisaged consequences.

Meta's documents, the court found, "technically" contained the information but presented the advertising architecture in a way the ordinary user "cannot reasonably understand." The judge declined to treat a click through general terms as informed agreement: "acceptance of general terms governing Facebook or Instagram should not automatically be treated as akin to informed consent to advertising profiling." The test was framed as two questions. "The statutory question is not merely: Was the information somewhere in Meta's privacy policy? It is: Was the information communicated in the manner required by section 27?" The court answered the second question against Meta.

Who moves the data?

Meta's answer on international transfers was unusual. The company told the court it has no data centres in Nigeria and does not store or otherwise process personal data there. It exhibited its public data centre locations page. Its counter-affidavit argued that "once a user in Nigeria (such as Applicants) accesses Facebook or Instagram - services that are offered through servers outside Nigeria (in compliance with the NDPA) - the user transfers their data out of Nigeria to Meta servers directly." The conclusion followed: "Consequently, it is the Applicants that transferred their data to the Respondent outside Nigeria."

The court did not accept it. Data subjects, the judge found, lack "the capacity or wherewithal" to transfer their data and do not control the routing, transmission and storage of that data when they use the platforms. "It is therefore disingenuous for the Respondent to claim that its data subjects transferred their respective data from Nigeria to other countries being location of Respondent's Data Centres." A global infrastructure, in other words, is not itself a lawful basis for export.

Section 41 of the NDPA bars a controller from transferring personal data out of Nigeria unless the recipient is subject to adequate protection through law, binding corporate rules, contractual clauses, a code of conduct or certification, or one of the section 43 exceptions applies, and requires the basis for each transfer to be recorded. The judgment also quotes section 43(2), which provides that no international cross-border transfer codes, rules or certification mechanisms may be adopted as a Nigerian standard for data sovereignty without approval of the National Assembly.

Meta's own counter-affidavit supplied another finding. Having told the court that "Tens of millions of users in Nigeria" use Facebook and Instagram, the company was, in the judge's view, a "data controller or data processor of major importance" under section 65 of the NDPA - a designation that applies to entities operating in Nigeria and processing data of more subjects than the commission prescribes. Other African regulators have taken the same line on foreign platforms without local infrastructure. In July 2025, Uganda's Personal Data Protection Office ordered Google to register as a data collector and controller, rejecting the argument that a lack of physical presence placed it outside the law.

Where the court stopped short

The applicants alleged that Meta had not conducted an adequate data protection impact assessment and had never filed one with the NDPC. Meta stated that it provided the commission with assessments in November 2024 and December 2025, and that the NDPC accepted them. The court declined to adjudicate the point. Under the NDPA and the commission's General Application and Implementation Directive, it held, a data subject cannot ask a court to compel a controller to file an impact assessment, because "filing obligations are regulatory mechanisms enforceable primarily by the commission." The court nonetheless granted the separate declaration that Meta breached its duty of care under section 24(2) and (3).

Exemplary damages met a higher bar. "Mere proof of an NDPA violation would not, without more, justify exemplary damages," the judge wrote, requiring conduct "sufficiently deliberate, outrageous, high-handed or contumelious to warrant punishment." The applicants had not shown that, and an award would have amounted to double compensation.

There is also a small inconsistency in the text. One passage of the judgment refers to the applicants' supporting affidavit as dated January 14, 2025, while every other reference, including the court's own description of the case file, gives January 14, 2026.

Pricing a privacy injury

The damages reasoning follows section 51 of the NDPA, which the court read as requiring four elements: processing that contravenes the Act, responsibility for that processing as controller or processor, injury, loss or harm, and causation. Meta argued that Nigerian courts award compensation for fundamental rights breaches only in two cases - unlawful detention under section 35(6) and compulsory acquisition of property under section 44(1) of the Constitution - citing Ransome-Kuti v. A.G. Federation (1985) and Sharu v. FGN & Ors (2020). The judge held both authorities distinguishable because section 51 of the NDPA expressly makes damages payable for infringement of privacy rights.

Having found that the applicants were "unlawfully profiled and monitored" through behavioural advertising and cross-border transfers, the court held that such "privacy injuries thereby cannot be mathematically quantified." It named the grounds for general damages as "persistence of profiling, absence of meaningful consent, difficulty of opting out, unlawful intrusion into Applicants' private life autonomy and informational self-determination."

Even divided six ways, the resulting figure sits well above what European courts have awarded individuals over Meta's tracking. A Leipzig court awarded one Facebook user €5,000 in July 2025 for tracking through Meta's Business Tools. The Dresden Higher Regional Court awarded €1,500 each to four plaintiffs in February 2026, and the Jena Higher Regional Court awarded €3,000 in March 2026 in a case covering the Meta Pixel and the Conversions API, with around 10,000 similar claims then pending in Germany. Austria's Supreme Court awarded Max Schrems €500 in November 2025 and barred personalised advertising to him. The largest sum in the European series came from a competition claim, not a privacy one: a Madrid commercial court ordered Meta to pay €479 million to 87 Spanish news publishers and agencies in November 2025, finding that its reliance on contractual necessity between May 2018 and August 2023 gave it an unfair advantage in advertising.

Set against Meta's regulatory exposure in Nigeria, however, the Lagos award is small. The NDPC's remedial fee of USD 32.8 million was 328 times the size of the award.

Why the marketing community is watching

The damages are unlikely to trouble Meta's accounts. The reasoning is another matter. The court held that the core advertising bargain in Meta's terms - free access in exchange for personalised ads - does not make profiling a contractual necessity under Nigerian law, and that general acceptance of terms is not automatically informed consent to advertising profiling. Those holdings concern the same terms that govern Facebook and Instagram for every Nigerian user, even though the order to cease processing covers only the applicants' data.

For advertisers, the reach of the eight-week order is the open question. It requires remedial measures across Meta's "data processing operations in Nigeria," not only for the six applicants. What would compliance look like? The judgment does not say, whether a consent flow, a subscription or reduced data use, and it makes no separate finding on the off-site data flowing from advertisers' websites and apps through Meta's business tools, for which Meta told the court it already relies on consent.

An appeal appears likely: the judge set out alternative findings expressly so that the Court of Appeal would have the trial court's view. Meta's side also exhibited a certified copy of a notice of appeal dated April 10, 2026 and the judgment in a separate fundamental rights action brought against Meta by Femi Falana SAN, though the Lagos ruling does not say which decision that notice concerns. Nigerian courts have also split: the Imo State decision in July went Meta's way on facts that overlapped with this case. Whether a Lagos first-instance ruling becomes a durable standard, or one data point among several, depends on what the appellate courts do next.

What the ruling does establish is a vocabulary. A Nigerian court has now applied the NDPA's lawful basis, transparency and transfer provisions directly to behavioural advertising, borrowed the CJEU's reasoning on contractual necessity and consent, and rejected the proposition that a user who opens an app is the party exporting their own data. For Meta's advertising business in Nigeria, that is not a small development.

Timeline

Summary

Who: The Incorporated Trustees of Laws and Rights Awareness Initiative, suing for its "Nigerian Members using Facebook and Instagram Accounts," and five individual applicants, against Meta Platforms, Inc. Justice A.F. Pokanu of the High Court of Lagos State decided the case.

What: The court declared that Meta's non-consensual profiling of the applicants for behavioural advertising violated Section 37 of the Nigerian Constitution and several provisions of the Nigeria Data Protection Act 2023, including those on lawful basis, transparency, duty of care and cross-border transfers. It ordered Meta to stop unlawfully processing the applicants' data, to take immediate remedial measures on its Nigerian data processing and file an affidavit of compliance within eight weeks, and to pay general damages in the naira equivalent of US$100,000, plus 1 million naira in costs. Exemplary damages of $100 million were refused.

When: Judgment was delivered on September 25, 2026, in a suit filed on January 14, 2026. The affidavit of compliance is due by November 20, 2026.

Where: Court 2, Ikorodu Judicial Division of the High Court of Lagos State, Nigeria.

Why: The court held that Meta could not rely on contractual necessity to justify advertising profiling, had not proven that the applicants accepted its terms or gave valid consent, did not meet the NDPA's transparency requirements, and could not attribute the export of Nigerian data to its users. The ruling applies European reasoning from the CJEU to Nigerian law in a market where Meta reports tens of millions of users, though it remains open to appeal.