Nigerian Court Approves Meta-NDPC Settlement, Reducing $32.8 Million Fine and Ending Privacy Dispute

The agreement was signed by NDPC's Head of Legal, Enforcement and Regulations, and Meta's Vice President and Associate General Counsel, International Legal.

It was also signed by a Senior Advocate of Nigeria (SAN) representing Meta, and a Senior Advocate of Nigeria (SAN) representing NDPC. Both parties disclosed in court on 3 October that they had agreed to end the dispute amicably. The settlement waives the $32.8 million fine and abandons specific privacy and safety measures directed in the final orders.

Some measures from the final orders were completely removed from the settlement agreement, and the agreement did not specifically address the collection of non-users' data. The NDPC agreed to abandon specific privacy and safety measures directed in the final orders. The dispute stemmed from NDPC's earlier orders against Meta.

NDPC ordered Meta to stop transferring Nigerians' personal data outside the country without approval and to cease collecting non-users' data. NDPC also ordered Meta to stop using algorithms that could expose data subjects to health and financial risks and to obtain proper user consent to safeguard Nigerians' data privacy and rights.

Additionally, NDPC directed Meta to conduct a Data Processing Impact Assessment on the human rights and democratic impacts of its systems.

NDPC ordered Meta to update its privacy policy to reflect the risks posed by profiling and to ensure fair access for Nigerian users and businesses. The commission further required Meta to implement adequate technical and organizational safeguards for data protection.

Meta was initially ordered to seek express, specific, and unambiguous consent of data subjects in Nigeria for processing personal information for behavioral advertising.

Meta was ordered to update its privacy policy and provide information on expert opinions about consequences of profiling and risks to users, particularly health risks.

NDPC ordered Meta to cease collecting personal data of non-users from its users, stating that user consent is not a lawful basis for such collection and upload to servers outside Nigeria. The commission directed Meta to provide an appropriate icon as a link to educative videos on dangers of manipulative, unlawful, or unfair data processing exposing data subjects to health, financial, or other risks.

This directive for educative videos considered Meta's processing involving over 60 million data subjects in Nigeria.

$32.8 million as a remedial fee. Meta filed a legal challenge to the NDPC sanctions at the Federal High Court in Abuja and threatened to shut down its operations in Nigeria. On 4 March 2025, Meta's lawyer urged the judge to grant an interim order staying the enforcement of NDPC's final orders.

The judge turned down Meta's request for an interim order on 4 March 2025 and opted to hear all parties on that date. Meta filed the substantive suit on 19 March 2025 at the Federal High Court in Abuja. In the suit, Meta alleged that NDPC denied it a fair hearing and due process.

Meta sought to quash the enforcement orders, claiming they breached its right to a fair hearing under section 36 of the Nigerian constitution. NDPC filed a preliminary objection contending that the suit was incompetent and the court lacked jurisdiction. The Nigeria Data Protection Act, 2023, governs the obligations in the settlement.