Meta settles Nigerian privacy case for $32.8 million

Meta Platforms settled a data protection dispute with the Nigerian Data Protection Commission for $32.8 million on October 30, 2025, according to court documents filed at the Federal High Court of Nigeria in Abuja. The settlement resolves an investigation that began on September 20, 2023, when the commission issued a notice of investigation examining Meta's processing of personal data for behavioral advertising across Facebook, Instagram, and WhatsApp.

The terms of settlement document dated October 30, 2025 reveals that Meta agreed to provide specific remedial consideration to protect data subject rights in Nigeria while the commission agreed to set aside final orders issued on February 18, 2025. Those final orders had outlined eight issues for determination regarding Meta's data processing practices, consent mechanisms, and cross-border data transfers.

According to the settlement terms, the Nigerian commission issued its investigation notice on September 20, 2023. During subsequent months, Meta and the commission exchanged written communications and met multiple times to discuss the matter. The investigation culminated in final orders dated February 18, 2025 that mandated immediate changes to Meta's operations in Nigeria.

The final orders required Meta to "immediately seek express, specific and unambiguous consent of data subjects in Nigeria in all circumstances where their personal [sic] will be processed for behavioral advertising." The commission determined that Meta must conduct a Data Processing Impact Assessment accounting for algorithmic consequences on human rights and peaceful democratic development in Nigeria.

Meta challenged those final orders through an originating summons filed March 19, 2025 before the Federal High Court. The company sought judicial review through certiorari proceedings and requested the court declare the final orders invalid and quash them. Justice J.K. Omotosho presided over the case designated as Suit No. FHC/ABJ/CS/355/2025.

The investigation encompassed Meta's processing activities involving over 60 million data subjects in Nigeria. According to the final orders, Meta was required to "provide an appropriate icon as a link to educative videos on the dangers of manipulative, unlawful or unfair data processing which may expose data subjects to health and financial risks or other destructive or fatal risks." The commission mandated that educational videos be created through active participation of educational institutions and non-profit organizations approved by the commission.

The settlement agreement terminates Meta's legal challenge. According to the terms, Meta "wholly and completely terminates, abandons, withdraws, and discontinues the Originating Summons as well as any and all claims against the Respondent connected to or arising from the Matters or the subject matter thereof, except as the parties have otherwise agreed."

The commission reciprocated by setting aside the final orders against Meta and releasing the company from claims, demands, actions, causes of action, contracts, obligations, suits, debts, costs, and liabilities connected to the matters. The settlement specifies that its execution "does not constitute: (i) an admission of liability or wrongdoing on the part of either party; or (ii) either party conceding their legal positions expressed in connection with the Matters."

Meta agreed to pay the commission's legal counsel fees directly at the commission's request. The company also committed to "use its best endeavors to continuously improve its technical and organizational measures" while taking into account obligations under the Nigeria Data Protection Act of 2023.

Those obligations include processing personal data lawfully, fairly, and transparently, relying on appropriate lawful bases when processing personal data including for behavioral advertising, conducting Data Privacy Impact Assessments in Nigeria, and implementing safeguards for cross-border transfers of personal data.

The settlement preserves the commission's ability to engage in statutory duties under the Nigeria Data Protection Act with respect to Meta "so long as it does not enforce or take steps to enforce the Final Orders or initiate new proceedings or issue new orders concerning the Matters as defined in paragraph 5 above."

Hon. Justice J.K. Omotosho signed the consent judgment on November 3, 2025. The court adopted the terms of settlement as the final judgment. Anna Benckert, VP and Associate General Counsel for International Legal at Meta Platforms, signed on behalf of the company. Adeola Adedipe and other counsel signed for the Nigeria Data Protection Commission.

Meta's data processing practices for behavioral advertising have faced regulatory scrutiny across multiple jurisdictions. The European Data Protection Board ordered Meta to cease behavioral advertising throughout the European Economic Area in December 2023, finding the company used contract and legitimate interest legal bases inappropriately. German courts awarded individual users €5,000 compensation for data protection violations involving Meta's Business Tools tracking infrastructure.

The Nigerian settlement represents a significant enforcement action from an African data protection authority. Uganda's Personal Data Protection Office ordered Google to register as a data controller within 30 days in July 2025, demonstrating expanding regulatory reach across African jurisdictions implementing comprehensive privacy frameworks.

The settlement amount of $32.8 million in U.S. dollar equivalent reflects a remedial fee calculated at the naira rate determined by the Central Bank of Nigeria. This financial penalty aligns with a broader pattern of privacy enforcement actions against Meta. Spanish courts ordered Meta to pay €479 million to digital publishers in November 2025 for unfair competitive advantages gained through GDPR violations between 2018 and 2023.

Meta's behavioral advertising model depends on processing extensive user data across platforms to deliver targeted advertisements. The company's advertising revenue reached €50.1 billion in the third quarter of 2025, representing 26% year-over-year growth driven by AI-powered optimization systems. These revenue figures underscore the commercial significance of data processing practices now under regulatory examination across global markets.

The Nigeria Data Protection Act of 2023 establishes comprehensive requirements for lawful data processing. The settlement agreement specifically references four key obligations: processing personal data lawfully, fairly, and transparently; relying on appropriate lawful basis when processing personal data including for behavioral advertising; conducting Data Privacy Impact Assessments in Nigeria; and implementing safeguards for cross-border transfers of personal data.

Meta's final orders from the Nigerian commission had prohibited the company from "transferring data out of Nigeria without the approval of the Commission in line with the NDP Act." The commission also ordered Meta to "cease and desist from collecting the personal data of non-users from its users" on grounds that "Consent of its users is not a lawful basis for collecting and uploading the personal data of non-users to its servers outside Nigeria."

The commission's final orders addressed digital economy development, requiring Meta to "ensure that data subjects and businesses in Nigeria are given similar opportunities to benefit from Meta Platforms in a manner that is similar to their counterparts in the EU and the US." This provision reflects broader concerns about equitable access to platform benefits across different geographic markets.

The European Commission fined Meta €200 million in April 2025 for Digital Markets Act violations related to consumer choice mechanisms. That enforcement action determined Meta's advertising model failed to offer users specific choice to opt for service using less personal data while remaining equivalent to personalized ads service.

Meta faces ongoing regulatory challenges across multiple jurisdictions examining data processing for advertising purposes. A Delaware court filing revealed Meta reached a $190 million settlement with shareholders who accused the company's directors of failing to prevent massive privacy violations, resolving seven years of litigation dating to the Cambridge Analytica scandal.

The Nigerian settlement demonstrates how data protection authorities in emerging markets are asserting jurisdiction over global platforms serving local users. The commission's investigation covered all Meta platforms operating in Nigeria, including Facebook, Instagram, and WhatsApp, examining behavioral advertising practices across the entire service ecosystem.

Digital marketing professionals operating in Nigeria must navigate regulatory requirements for lawful data processing under the Nigeria Data Protection Act. The settlement establishes that international platforms cannot rely solely on consent-based mechanisms when collecting data from non-users or transferring data across borders without commission approval.

The court proceedings included representation from multiple legal teams. Meta's counsel included Professor Gbolahan Elias, Fred Onuobia, Peace Adeleye, Larry Nkwor, Justice Uka-Ofor, Ayomide Abiodun, Kanyinsola Olukokun, Moyinoluwa Adegboye, Oluwatosin Jinadu, Victoria Akingbemila, and Ifenna Okeke from G Elias located at 30 Mediterranean Street, Maitama, Abuja. The commission's counsel included Adeola Adedipe, Jedidiah Akpata, McDonald Kurere, Victor Oni, and Dide Oluwa Nylander, with offices at 16 Aso Gardens Estate, Off River Trent Street, Ministers' Hills, Maitama, Abuja.

The settlement terms include provisions for legal certainty. The parties agreed the settlement terms "shall also take effect as a contract between the Parties notwithstanding that they shall also be a judgment of the Honourable Court." This dual nature as both court judgment and contractual agreement provides enforcement mechanisms through both judicial authority and contract law.

Meta's commitment to continuously improve technical and organizational measures addresses the commission's concerns about data privacy protection on platforms. The final orders had required Meta to "put in place adequate technical and organisational measures – including collaboration with educational and civil society organisations – for the protection of data privacy on its platforms." Such measures must "involve prompt deletion of unlawful personal data posted on its platforms."

The Nigerian enforcement action follows patterns established in European privacy enforcement. The Irish Data Protection Commission previously fined Meta €390 million for advertising consent violations, while French authorities imposed €60 million for cookie-related infractions.

The settlement resolves immediate legal conflict while establishing framework for ongoing regulatory relationship between Meta and Nigerian data protection authorities. The commission retains ability to engage in statutory duties regarding Meta's operations, provided it does not enforce the set-aside final orders or initiate new proceedings concerning the resolved matters.

For marketing professionals, the Nigerian settlement underscores platform accountability risks surrounding data collection and advertising targeting practices in African markets. Data protection enforcement has intensified globally, creating compliance requirements across jurisdictions where platforms serve local users through behavioral advertising systems.

The case demonstrates how African data protection authorities are implementing privacy frameworks comparable to European standards. Nigeria's approach mirrors GDPR principles requiring lawful basis for processing, data minimization, purpose limitation, and safeguards for international transfers. Marketing campaigns targeting Nigerian users operate under regulatory framework requiring explicit consent for behavioral advertising.

Timeline

• September 20, 2023: Nigerian Data Protection Commission issues notice of investigation to Meta Platforms
• September-February 2025: Meta and commission exchange written communications and meet multiple times
• February 18, 2025: Commission issues final orders with eight issues for determination
• March 19, 2025: Meta files originating summons challenging final orders at Federal High Court
• October 30, 2025: Parties sign terms of settlement agreement
• October 31, 2025: Irish Data Protection Commission notifies Meta about related European enforcement
• November 3, 2025: Justice J.K. Omotosho signs consent judgment adopting settlement terms
• December 2023: European Data Protection Board orders Meta to cease behavioral advertising across EEA
• April 2025: European Commission fines Meta €200 million for Digital Markets Act violations
• July 2025: German court awards Facebook user €5,000 for data protection violations
• July 2025: Uganda orders Google to register as data processor in landmark ruling
• November 2025: Madrid court orders Meta to pay €479 million for GDPR advertising violations

Summary

Who: Meta Platforms Inc. and the Nigeria Data Protection Commission, represented by respective legal counsel before Hon. Justice J.K. Omotosho at the Federal High Court of Nigeria.

What: Settlement agreement resolving data protection investigation into Meta's behavioral advertising practices, with Meta paying $32.8 million remedial fee and commission setting aside final orders that mandated immediate operational changes across Facebook, Instagram, and WhatsApp.

When: Investigation began September 20, 2023; final orders issued February 18, 2025; legal challenge filed March 19, 2025; settlement signed October 30, 2025; consent judgment entered November 3, 2025.

Where: Federal High Court of Nigeria in Abuja (Suit No. FHC/ABJ/CS/355/2025), addressing data processing affecting over 60 million Nigerian users and cross-border data transfers to servers outside Nigeria.

Why: Commission found Meta processed personal data for behavioral advertising without express, specific, and unambiguous consent; collected non-user data from users; transferred data internationally without commission approval; and failed to conduct required Data Processing Impact Assessments accounting for algorithmic impact on human rights and democratic development in Nigeria.