The judgment, delivered by Justice J.K. Omotosho in Suit No. FHC/ABJ/CS/355/2025, followed the adoption of terms of settlement jointly executed by Meta and the NDPC.
A consent judgment quietly entered at the Federal High Court in Abuja on November 3, 2025, has ignited a storm of controversy after court documents revealed that the Nigeria Data Protection Commission (NDPC) agreed to set aside its own landmark sanctions against Meta Platforms Inc.
This effectively extinguished a $32.8 million remedial fee earlier imposed on the tech giant over massive data protection violations affecting more than 60 million Nigerians.
The judgment, delivered by Justice J.K. Omotosho in Suit No. FHC/ABJ/CS/355/2025, followed the adoption of terms of settlement jointly executed by Meta and the NDPC.
Under those terms, the Commission waived its right to enforce sweeping final orders it had issued just months earlier, including the order directing Meta to pay the naira equivalent of $32.8 million to the Federal Government of Nigeria.
Meanwhile, the development has raised serious questions about regulatory independence, transparency, and whether Nigeria’s data protection watchdog sacrificed public interest and state revenue in a negotiated settlement conducted behind closed doors.
However, the controversy traces back to 2023, when the Personal Data Protection Awareness Initiative submitted a petition to the NDPC alleging widespread and unlawful processing of personal data by Meta Platforms Inc., the parent company of Facebook, Instagram, and WhatsApp.
According to the petition, Meta’s practices allegedly affected at least 61 million Nigerians, involving behavioral advertising without explicit consent, profiling that exposed users to health and financial risks, and the harvesting of personal data of non-users.
The petition also accused Meta of cross-border data transfers without lawful authorization, in violation of Nigeria’s data protection regime.
Following the petition, the NDPC issued a formal Notice of Investigation to Meta on September 20, 2023.
Over several months, the Commission and Meta exchanged written correspondence and held multiple in-person meetings as investigators examined the scope and impact of Meta’s data processing activities in Nigeria.
On February 18, 2025, the NDPC issued what many observers described as one of the most consequential regulatory actions against a multinational tech company in Nigeria’s history.
In its Final Orders, the NDPC found Meta in breach of multiple provisions of the Nigeria Data Protection Act, 2023 (NDPA).
The Commission identified eight key issues for determination and ruled against Meta on each of them.
Among other directives, the NDPC ordered Meta to immediately obtain express, specific and unambiguous consent from Nigerian users before processing their personal data for behavioral advertising.
It also directed Meta to conduct a comprehensive Data Processing Impact Assessment, examining how its algorithms amplify data processing and the implications for human rights and democratic development in Nigeria.
The orders further required Meta to update its privacy policy with expert-backed disclosures on the risks of profiling, particularly health-related risks; cease transferring personal data out of Nigeria without NDPC approval; and stop collecting personal data of non-users uploaded by its users.
In recognition of the scale of Meta’s operations in Nigeria, the Commission also ordered the company to deploy educational tools, developed with approved educational institutions and civil society groups, warning users about manipulative and unlawful data processing practices.
However, the NDPC imposed a remedial fee of $32.8 million, to be paid in naira at the Central Bank of Nigeria’s prevailing rate, citing regulatory enforcement costs and the harm caused by Meta’s violations.
Meta, however, did not accept the sanctions quietly. On March 19, 2025, the company filed an originating summons at the Federal High Court, seeking to quash the NDPC’s Final Orders, declare them invalid, and restrain the Commission from enforcing them.
Meanwhile, before the court could rule on the merits of the case, Meta and the NDPC entered into negotiations that culminated in a settlement dated October 30, 2025.
When the matter came up in court on November 3, Justice Omotosho adopted the terms as a consent judgment, bringing the case to an abrupt end.
Under the settlement, Meta agreed to provide specific remedial consideration” to support the protection of data subjects in Nigeria and to use its best endeavors” to improve its technical and organizational measures in line with the NDPA.
But the most consequential clause was the NDPC’s agreement to set aside and waive any rights to enforce or take steps to enforce the Final Orders issued against Meta.
In plain terms, this meant that the $32.8 million remedial fee, hailed earlier as a major enforcement victory, was effectively nullified.
"Upon this matter coming before this Court today the 3rd day of November, 2025 and parties having adopted the Terms of Settlement set out hereunder and urged the Court to adopt the said Terms of Settlement executed by the parties as the Judgment of the Court," the consent judgment said.
Summary of the Terms of Settlement
On September 20, 2023, the Respondent issued a Notice of Investigation to the Applicant. During the investigation, both parties exchanged written correspondence and held several in-person meetings.
After concluding its investigation, the Respondent issued final orders on February 18, 2025. These final orders addressed eight key issues, setting out the Respondent’s reasoning and findings on each.
The orders directed the Applicant, Meta, to obtain clear and specific consent from data subjects in Nigeria before processing personal data for behavioural advertising.
Meta was also required to conduct a Data Processing Impact Assessment examining how its algorithms and methodologies enable and amplify personal data processing, with particular regard to human rights and Nigeria’s democratic development.
In addition, Meta was ordered to update its Privacy Policy to include information, supported by expert opinions, on the risks associated with profiling and personal data processing, especially health-related risks.
The company was further directed to stop transferring data outside Nigeria without the Commission’s approval, in line with the WDP Act, and to cease collecting and uploading the personal data of non-users, as users’ consent does not provide a lawful basis for such collection.
The documents further read, "Given the scale and impact of its processing involving over 60 million data subjects in Nigeria, Meta shall provide an appropriate icon as a link to educative videos on the dangers of manipulative, unlawful or unfair data processing which may expose data subjects to health and financial risks or other destructive or fatal risks.
“The educative videos shall be created through active participation of educational institutions and non-profit organisations approved by the Commission;
In line with the objectives of the Nigeria Data Protection Act (NDP Act) to support the development of Nigeria’s digital economy, Meta is required to ensure that data subjects and businesses in Nigeria enjoy opportunities and benefits on its platforms comparable to those available to users in the EU and the United States.
Meta also agreed to implement adequate technical and organisational measures to protect data privacy on its platforms, including collaboration with educational and civil society organisations and the prompt removal of unlawfully posted personal data.
In addition, Meta is to pay a remedial fee of $32.8 million, to be converted to naira at the exchange rate determined by the Central Bank of Nigeria.
Following the issuance of the final orders, Meta exercised its statutory right to challenge them by filing an originating summons on March 19, 2025, seeking to invalidate and set aside the orders and to restrain their enforcement. The investigation, the final orders, and the originating summons are collectively referred to as the matters.
The parties subsequently reached a mutual settlement resolving the dispute. Under the agreement, Meta undertook to provide specific remedial measures to support the protection of data subjects’ rights in Nigeria, while the Respondent agreed to set aside and waive any rights to enforce the final orders. Meta also agreed to pay the Respondent’s legal counsel fees directly, at the Respondent’s request.
The parties further agreed that Meta would use its best efforts to continuously improve its technical and organisational measures in line with the Nigeria Data Protection Act 2023, including ensuring lawful, fair and transparent processing of personal data, reliance on appropriate lawful bases for processing, particularly for behavioural advertising, conducting data privacy impact assessments in Nigeria, and observing safeguards for cross-border data transfers.
As part of the settlement, Meta withdrew and discontinued the originating summons and all related claims against the Respondent.
In turn, the Respondent set aside the final orders and released Meta from all claims, liabilities, and obligations arising from the matters, except as otherwise agreed. The settlement does not prevent the Respondent from carrying out its statutory duties under the Nigeria Data Protection Act, provided it does not enforce the final orders or initiate new proceedings or orders relating to the same matters.
"That the parties agree that the execution and performance of these terms of settlement does not constitute: () an admission of liability or wrongdoing on the part of either party; or (i) either party conceding their legal positions expressed in connection with the matters,” it said.
"That the parties agree that these Terms are binding on them and the same shall be entered as final judgment of this Honourable Court in this suit.
"That these Terms shall also take effect as a contract between the Parties notwithstanding that they shall also be a judgment of the Honourable Court."