Nigerian Court Approves Meta-NDPC Settlement, Reducing $32.8 Million Fine and Ending Privacy Dispute

A Nigerian court adopted a settlement agreement between Meta and the Nigeria Data Protection Commission (NDPC) as a consent judgment on 3 November 2025, ending a dispute over data privacy practices. The settlement waives the $32.8 million remedial fee that NDPC had ordered Meta to pay.

Both parties stated that the settlement does not constitute an admission of liability or wrongdoing and does not concede their legal positions.

Under the terms, Meta agreed to use its best endeavors to continuously improve its technical and organizational measures in line with the Nigeria Data Protection Act, 2023. The company also committed to process personal data lawfully, fairly, and transparently under the NDP Act, and to rely on an appropriate lawful basis when processing personal data, including for behavioral advertising.

Meta further agreed to conduct a Data Privacy Impact Assessment in Nigeria under the NDP Act and to implement safeguards for cross-border transfers of personal data.

As part of the deal, Meta pledged to terminate, abandon, withdraw, and discontinue the originating summons and all claims against NDPC. Meta also agreed to pay NDPC's legal counsel's fees directly to the lawyers. In return, NDPC agreed to set aside the final orders against Meta and to release and discharge the company from all claims, demands, actions, causes of action, contracts, obligations, suits, debts, costs, and liabilities related to the matters.

The settlement allows NDPC to engage in its statutory duties under the Nigeria Data Protection Act, 2023, with respect to Meta, except for enforcing the final orders or initiating new proceedings on the defined matters. The terms of the settlement agreement have the force of a contract notwithstanding being a court judgment.

The agreement was signed by NDPC's Head of Legal, Enforcement and Regulations, and Meta's Vice President and Associate General Counsel, International Legal.

It was also signed by a Senior Advocate of Nigeria (SAN) representing Meta, and a Senior Advocate of Nigeria (SAN) representing NDPC. Both parties disclosed in court on 3 October that they had agreed to end the dispute amicably. The settlement waives the $32.8 million fine and abandons specific privacy and safety measures directed in the final orders.

Some measures from the final orders were completely removed from the settlement agreement, and the agreement did not specifically address the collection of non-users' data. The NDPC agreed to abandon specific privacy and safety measures directed in the final orders. The dispute stemmed from NDPC's earlier orders against Meta.

NDPC ordered Meta to stop transferring Nigerians' personal data outside the country without approval and to cease collecting non-users' data. NDPC also ordered Meta to stop using algorithms that could expose data subjects to health and financial risks and to obtain proper user consent to safeguard Nigerians' data privacy and rights.

Additionally, NDPC directed Meta to conduct a Data Processing Impact Assessment on the human rights and democratic impacts of its systems.

NDPC ordered Meta to update its privacy policy to reflect the risks posed by profiling and to ensure fair access for Nigerian users and businesses. The commission further required Meta to implement adequate technical and organizational safeguards for data protection.

Meta was initially ordered to seek express, specific, and unambiguous consent of data subjects in Nigeria for processing personal information for behavioral advertising.

Meta was ordered to update its privacy policy and provide information on expert opinions about consequences of profiling and risks to users, particularly health risks.

NDPC ordered Meta to cease collecting personal data of non-users from its users, stating that user consent is not a lawful basis for such collection and upload to servers outside Nigeria. The commission directed Meta to provide an appropriate icon as a link to educative videos on dangers of manipulative, unlawful, or unfair data processing exposing data subjects to health, financial, or other risks.

This directive for educative videos considered Meta's processing involving over 60 million data subjects in Nigeria.

$32.8 million as a remedial fee. Meta filed a legal challenge to the NDPC sanctions at the Federal High Court in Abuja and threatened to shut down its operations in Nigeria. On 4 March 2025, Meta's lawyer urged the judge to grant an interim order staying the enforcement of NDPC's final orders.

The judge turned down Meta's request for an interim order on 4 March 2025 and opted to hear all parties on that date. Meta filed the substantive suit on 19 March 2025 at the Federal High Court in Abuja. In the suit, Meta alleged that NDPC denied it a fair hearing and due process.

Meta sought to quash the enforcement orders, claiming they breached its right to a fair hearing under section 36 of the Nigerian constitution. NDPC filed a preliminary objection contending that the suit was incompetent and the court lacked jurisdiction. The Nigeria Data Protection Act, 2023, governs the obligations in the settlement.