The deal between Nigeria and Meta, details of which have not been previously disclosed, is replete with concessions by Nigeria, including writing off the $32.8 million fine and softening the obligations it earlier imposed on Meta.
In February 2025, Nigeria announced a $32.8 million fine for data privacy violations against Meta Platform Inc., the parent company of Facebook and Instagram. But the government went quiet when it reversed course by writing off the fine after striking a deal with the tech giant in October last year.
Under the settlement agreement, Nigeria consented to freeing Meta of all liabilities regarding the alleged violations, letting the company get away without any fine.
Follow us on WhatsApp | LinkedIn for the latest headlines
In return for Nigeria writing off the fine, which resulted from about 17 months of investigation by the Nigeria Data Protection Commission (NDPC), Meta pledged to be ethical in the handling of Nigerians data in the future.
The tech company bore no financial liability except agreeing to offset the legal fees Nigeria incurred in the court case it instituted to challenge NDPC’s “Final Orders.”
When Nigeria imposed the fine last year, it joined a growing list of countries, including the United States, the United Kingdom, and the European Union (EU), that have slapped Meta and other tech companies with significant fines over data privacy breaches and other safety risks their platforms expose users to.
The companies have been forced to regularly address policy gaps to better guarantee data privacy and address safety concerns associated with exposures on social media platforms. Governments have also updated their laws and regulations and increased scrutiny to keep up with emerging threats, strengthening compliance and enforcement.
Nigeria’s move was seen as a landmark step and one of the first of its kind in Africa. But the confidence it stirred slumped when Nigeria reversed the sanctions last year.
“Regulatory action is strongest when there is a clear finding of a breach, backed by penalties and the risk of further sanctions. Setting aside the earlier orders removed that weight, leaving the commitments with little additional force,” said Iliya-Ezekiel Ndatse, a data protection lawyer.
Nigeria, through the NDPC, signed a settlement agreement with Meta on 30 October 2025, details of which have not been previously reported, to forgo the $32.8 million fine in the Final Orders the agency issued against the company on 18 February 2025.
PREMIUM TIMES has now obtained the certified true copies of the settlement agreement entered into by the NPDC and Meta and the consent judgement given on 3 November 2025 by the Federal High Court in Abuja based on the deal.
Media outlets, including PREMIUM TIMES, reported the delivery of the judgement in November last year, but not the details of the agreement.
Months after the NPDC entered into the agreement and the court gave it a judicial stamp, the agency and the government have continued to keep the details to themselves.
The development is a reminder of the fog of secrecy that, to date, envelopes the deal the Nigerian government claimed to strike with Twitter (now X) in the aftermath of the ban on the platform in Nigeria in June 2021.
How it started
Exercising its powers under the Nigeria Data Protection Act, 2023 (NDP Act), the NPDC, Nigeria’s data governing agency, launched an investigation on 20 September 2023 into Meta’s activities in Nigeria.
The probe centred on Meta’s alleged breaches of Nigeria’s data protection laws and the privacy rights of over 60 million Nigerian data subjects.
NPDC and Meta exchanged written communications, and their representatives met in person multiple times during the investigations.
After 17 months of the probe, NPDC issued its “Final Orders” on 18 February 2025, which outlined sweeping findings and remedial directives.
The commission said it found that Meta “did not seek express, specific and unambiguous consent” from users for behavioural advertising.
It also ordered a stop to the transfer of Nigerians’ personal data outside the country without approval, the collection of non-users’ data, and the company’s use of algorithms, which “could expose data subjects to health and financial risks.”
To safeguard Nigerians’ data privacy and rights, NPDC ordered Meta to obtain proper user consent, conduct a Data Processing Impact Assessment on the human rights and democratic impacts of its systems, and update its privacy policy to reflect the risks posed by profiling.
NPDC also ordered the company to stop transferring data abroad without NDPC approval, cease collecting non-users’ data, and provide educational tools on the dangers of unlawful data processing.
The commission further directed the company to ensure fair access for Nigerian users and businesses, implement adequate technical and organisational safeguards for data protection, and pay the Naira equivalent of $32.8 million as a remedial fee.
However, following the NDPC’s final orders and notice, Meta filed a legal challenge to the sanctions at the Federal High Court in Abuja and even threatened to shut down its operations in Nigeria.
On 4 March 2025, the company’s lawyer, Fred Onuofia, a Senior Advocate of Nigeria (SAN), urged Judge James Omotosho to grant an interim order staying the enforcement of NPDC’s final orders.
However, the judge turned down the request and opted to hear all parties out once and for all.
Following this, Meta filed the substantive suit on 19 March 2025, alleging that the NDPC had denied it a fair hearing and due process. It sought to quash the enforcement orders, which it said breached its right to a fair hearing under section 36 of the Nigerian constitution.
In response, the NDPC filed a preliminary objection, contending that the suit was incompetent and that the court lacked jurisdiction to hear it.
The settlement
On 3 October, when the court was to deliver its decision, both parties disclosed that they had agreed to end the dispute amicably.
Within one month, they hammered out a settlement agreement dated 30 October 2025, which they filed in court the next day. The document was signed by Babatunde Bamigboye, NDPC’s Head of Legal, Enforcement and Regulations, and Anna Benckert, Meta’s Vice President and Associate General Counsel, International Legal. The parties’ lawyers also signed the document, with Fred Onuobia, a Senior Advocate of Nigeria (SAN), representing Meta, and Adeola Adedipe, also a SAN, representing NDPC.
On 3 November 2025, the court adopted the settlement agreement as a consent judgement, effectively writing off the $32.8 million awarded in the Final Orders as “a remedial fee.”
The terms of settlement hinged on two broad underlying principles:
· Meta offered to give “specific remedial considerations in support of protecting the rights of data subjects in Nigeria”; and
· NPDC conceded to setting aside and waiving any rights to enforce or take steps to enforce the Final Orders against Meta.
The settlement agreement cleared both parties of liabilities.
The agreement states that the execution of the settlement agreement would not constitute either “an admission of liability or wrongdoing on the part of either party” or “conceding their legal positions expressed in connection with the Matters.”
In another part of the settlement agreement, Meta agreed to “use its best endeavours to continuously improve its technical and organisational measures, taking into account the applicable obligations and/or principles set out in the Nigeria Data Protection Act, 2023 (NDP Act).”
In doing so, the firm conceded to act in line with “the obligations under the NDP Act to process personal data lawfully, fairly and transparently; and to rely on an appropriate lawful basis when processing personal data, including for the purpose of behavioural advertising.”
It will also act to meet the “requirements under the NDP Act for conducting a Data Privacy Impact Assessment in Nigeria; and safeguards for cross border transfers of personal data.”
Therefore, Meta “wholly and completely terminates, abandons, withdraws, and discontinues the Originating Summons as well as any and all claims against the Respondent connected to or arising from the Matters or the subject matter thereof, except as the parties have otherwise agreed.”
It also agreed to pay NPDC’s legal counsel’s fees directly to the lawyers engaged by the commission for the suit.
For its part, NPDC “sets aside the Final Orders” against Meta.
It also “fully and firmly releases and discharges Meta from any and all claims, demands, actions, causes of action, contracts, obligations, suits, debts, costs, liabilities” which the agency “may ever have, may now have, or may hereafter claim to have against Meta in respect of the matters” as defined in the agreement.
But the settlement agreement included a caveat that allows the NPDC to take on the company in the event of any future infractions.
“For the avoidance of doubt, paragraph 9.2 above will not restrict the Respondent from engaging in its statutory duties under the Nigeria Data Protection Act, 2023 with respect to the Applicant so long as it does not enforce or take steps to enforce the Final Orders or initiate new proceedings or issue new orders concerning the Matters as defined in paragraph 5 above,” the agreement reads. The paragraph 5 referenced the suit instituted by Meta.
The parties agreed that the terms of the agreement shall also have the force of a contract “notwithstanding that they shall also be a judgement of the honourable court.”
Nigeria’s trade-offs
A PREMIUM TIMES review of the terms of settlement side-by-side with the Final Orders shows that the $32.8 million was not the only trade-off Nigeria conceded to in the deal.
In the near-complete about-turn, Nigeria not only wrote off the fine and freed Meta from liabilities, but also agreed to abandon the specific privacy and safety measures the Final Orders directed Meta to implement. At best, the directives were rewritten in broad, vague terms.
For instance, the final orders asked Meta to “immediately seek express, specific and unambiguous consent of data subjects in Nigeria in all circumstances where their personal information will be processed for behavioural advertising”.
It also asked Meta to carry out a “Data Processing Impact Assessment” of how its algorithm or other methodologies enable and amplify the processing of personal data — taking into account “the impact of this processing on human rights and peaceable, democratic development of Nigeria.”
Meta was also ordered to “immediately update its Privacy Policy and provide information relating to expert opinions on the consequences of profiling or and how processing of personal data may expose users to specific risks, particularly health risks.”
In the place of these specific measures contained in the Final Orders, the settlement agreement asked Meta to “use its best endeavours” to continuously improve its technical and organisational measures in the Nigeria Data Protection Act, 2023 (NDP Act) and meet other obligations and requirements in the law.
While the final orders also directed that “Meta shall cease and desist from transferring data out of Nigeria without the approval of the Commission in line with the NDP Act”, the settlement agreement simply asked Meta to ensure “safeguards for cross-border transfers of personal data.”
The Final Orders also directed Meta to “cease and desist from collecting the personal data of non-users from its users,” adding that consent of its users “is not a lawful basis for collecting and uploading the personal data of non-users to its servers outside Nigeria.” But the settlement agreement did not specifically address the collection of non-users’ data. The nearest to that is a line that asked Meta to rely on an appropriate lawful basis when processing personal data, including for behavioural advertising.
More directives were totally removed
Some measures directed in the Final Orders were completely removed from the settlement agreement.
Meta was initially ordered to provide “an appropriate icon as a link to educative videos on the dangers of manipulative, unlawful or unfair data processing which might expose data subjects to health and financial risks or other destructive or fatal risks.” This directive considered “the scale and impact” of Meta’s processing involving over 60 million data subjects in Nigeria. But it was removed from the settlement agreement.
The Final Orders also directed Metal to create educational programmes through the active participation of educational institutions and non-profit organisations approved by the commission. This, too, did not make it to the settlement agreement.
Meta was also ordered to ensure that data subjects and businesses in Nigeria were given similar opportunities to benefit from Meta Platforms as their counterparts in Europe and the United States. This was intended to help meet an objective of the NDP Act regarding the development of Nigeria’s digital economy. However, the settlement agreement was silent on this.
The Final Orders also directed the tech giant to “put in place adequate technical and organisational measures including collaboration with educational and civil society organisations for the protection of data privacy on its platforms.” “Such measures shall involve prompt deletion of unlawful personal data posted on its platforms,” the Final Orders said. This also did not make it to the settlement agreement, except as inferred from the obligations the NDP Act places on all social media platforms.
It’s remediation strategy – NDPC
Despite the huge differences between the Final Orders and the settlement agreement the NDPC had with Meta, the agency claims it was a good deal.
Speaking with PREMIUM TIMES, NDPC’s spokesperson, Itunu Dosekun, lauded the settlement agreement, which he said “reflects” the commission’s broader approach to addressing issues with tech companies.
Mr Dosekun said the commission aims “to promote businesses, not to spoil businesses… but also ensure organisations respect people’s privacy.” He said the decision to settle prioritised a balance between regulation and economic growth.
“It’s not just about paying fines but also doing the right thing… creating initiatives and awareness on data protection and privacy,” he said, adding that the commission adopted a remediation approach, focusing on correcting breaches rather than relying solely on fines.
On compliance, he said the commission “is working hand in hand with them to ensure that they are doing the right thing, which they are complying with.” He pointed to awareness campaigns carried out across Meta’s platforms. “They posted different content regarding awareness and privacy in collaboration with the commission.”
Concerns mount
But many Nigerians are not as optimistic or confident about the commission’s steps as Mr Dosekun.
Sign up for free AllAfrica Newsletters
Get the latest in African news delivered straight to your inbox
Tracy Keshi, project manager at the Tech Justice and Digital Governance Programme of the Centre for Journalism Innovation and Development (CJID), said the settlement agreement weakens the NDPC’s leverage. She said, “The withdrawal of the fine and suspension of enforcement orders reduces immediate regulatory pressure, which can set a precedent that large tech companies can negotiate around penalties.”
Mr Ndatse, the data protection lawyer, noted that obligations in the agreement, such as lawful processing, user consent, data impact assessments and safeguards for cross-border data transfers, are already required under the NDP Act.
However, he said, the settlement agreement “weakens the earlier regulatory action and does not provide the same level of protection.”
Hence, the lawyer maintained that setting aside the initial orders only “reduces the impact of enforcement.”
Mr Ndatse said the agreement now relies largely on future monitoring rather than immediate enforcement, making it weaker in practice.
Ms Keshi echoed this concern, noting that the “key difference is enforceability; regulatory teeth are dulled. Compliance is now reliant on Meta’s voluntary cooperation.”
She, however, sees a silver lining, saying the settlement shows the “NDPC can engage major platforms and secure commitments from them, which sets a positive precedent.”
Also, Israel Boboye, a monitoring and evaluation officer at CJID, said that although the NDP Act provides a legal framework, there was previously no clear agreement between regulators and companies on how the rules should be applied in practice.
He added that data protection in Nigeria goes beyond the Meta case, reflecting broader gaps in how data is handled and understood.
“Many users and organisations still do not fully understand and are not complying with basic standards,” Mr Boboye said.
‘No shift’
Many observers have also yet to see any clear-cut benefits accruing to Nigerian data subjects from the settlement agreement.
Mr Ndatse said Meta’s current data protection features on its social media platforms, including privacy notices and consent options, are part of its global system, shaped by stricter regulations in jurisdictions such as Europe.
“From a public perspective, there is no strong evidence of a noticeable shift in how Nigerian users’ data is treated,” he said, adding that there are yet to be any “Nigeria-specific privacy policies or tailored consent mechanisms reflecting local legal requirements.”
Even when Nigerian users notice some improvements in interface transparency, Ms Keshi said, the deeper structural and procedural changes needed for meaningful data protection remain largely unverified. “Cross-border data flows, the area of highest risk, remain opaque, and without third-party audits or NDPC disclosures on behavioural advertising, it is difficult to assess real change,” she said.
To know if Meta has become more accountable and transparent in processing data from Nigeria, she said, “users should see clear prompts before behavioural ads are displayed rather than buried in fine print.” She added that “Meta should publish updates or reports on its data processing in Nigeria.”
She said users must have control over what data is collected and whether it is shared abroad.
She also said Meta should actively participate in campaigns, training, or partnerships to educate Nigerians about their digital rights, while ensuring “transferred data should have contractual or technical safeguards such as encryption or binding corporate rules.”
For Mr Boboye, data protection in Nigeria goes beyond the Meta case, reflecting broader gaps in how data is handled and understood.
“Many users and organisations still do not fully understand and are not complying with basic standards,” he said.
