Meta Platforms has appealed a Lagos High Court judgment that ordered it to stop using Nigerians’ Facebook and Instagram data for advertising without proper consent. The company filed its notice of appeal on September 30, 2026, five days after Justice A.F. Pokanu of the Lagos High Court, Ikorodu Judicial Division, delivered the ruling.
The judgment found that Meta’s collection, profiling, and use of users’ personal data for behavioural advertising violated privacy rights protected by Section 37 of Nigeria’s Constitution and the Nigeria Data Protection Act (NDPA) 2023. The court ordered Meta to cease the unlawful processing, take remedial steps to comply with the NDPA, and submit an affidavit of compliance within eight weeks. It also awarded the applicants the naira equivalent of $100,000 in general damages and ₦1 million in costs.
The case was brought by the Incorporated Trustees of Laws and Rights Awareness Initiative and five individual applicants.
The Court Rejected Meta’s Contractual Argument
Meta’s defence centred on its terms of service. The company argued that Facebook and Instagram are free, personalised services funded by advertising, and that users accept the company’s terms and privacy policy when they sign up. Its position was that processing user data for advertising forms part of the contractual arrangement that allows it to provide the services.
Justice Pokanu rejected that position. The court held that building profiles for targeted advertising is not automatically necessary to provide a social-networking service simply because advertising funds the service. It found that behavioural advertising is ancillary to Facebook and Instagram, rather than essential to making the platforms work.
The court drew a line between processing required to operate a platform and processing undertaken to profile users and commercially target them with advertising. The second cannot become compulsory because a company embeds it in standard terms of service. The ruling stated that a platform cannot make data processing mandatory merely by placing it in its terms of service if the processing is not genuinely required to deliver the core service.
The court also held that Meta bore the burden of proving that users had provided valid consent. Consent to profiling and behavioural advertising, the court found, could not simply be folded into broad, standard terms that users must accept to access Facebook or Instagram.
Cross-Border Data Transfers Face New Scrutiny
The appeal will also test the court’s findings on the movement of Nigerian users’ data outside the country. Meta argued that it does not operate a data centre in Nigeria and that users effectively send their information abroad when they use its platforms.
The court rejected that reasoning. It held that individual users do not determine where their information is routed, stored, or processed. As a data controller, Meta therefore remained responsible for complying with Nigerian requirements governing international transfers of personal data. Justice Pokanu found that the transfers in question contravened Sections 41 to 43 of the NDPA.
This aspect of the case carries significance beyond advertising. A ruling by the Court of Appeal could clarify the obligations of international technology companies that process Nigerian users’ data on servers located outside the country. That issue sits at the centre of the growing tension between global platform operations and national data sovereignty rules. It is the same tension that Nigeria’s cloud policy seeks to address by requiring certain categories of data to remain within national borders.
The Damages Award Is Modest, but the Orders Are Not
The applicants sought general damages in the naira equivalent of $100 million and a further $100 million in exemplary damages. The court awarded $100,000 in general damages and refused exemplary damages outright. Post-judgment interest at the prevailing Central Bank of Nigeria rate and costs of ₦1 million complete the monetary award.
The relatively small damages figure matters less than the operative orders. Meta must cease the unlawful processing of the applicants’ data, bring its Nigerian data-processing operations into compliance with the NDPA, and file an affidavit of compliance within eight weeks. Eight weeks from September 25 falls on November 20, 2026.
Those orders, if upheld on appeal, would require Meta to change how it handles Nigerian users’ data. The compliance affidavit creates a mechanism for the court to verify that changes have actually occurred. The judgment also includes a declaration extending to “members of the class” beyond the named applicants, which suggests the court intended the ruling to have broader effect.
The Appeal Puts Consent at the Centre of Platform Regulation
At stake in the appeal is whether global platforms can make behavioural tracking a condition of accessing free social-media services. Meta argues that advertising funds the service, so tracking is part of the bargain. The court’s ruling says Nigerian law requires a clearer separation between access to a service and consent to the use of personal data for advertising.
The outcome will shape how much control Nigerians have over the personal data they generate on Facebook and Instagram. If the judgment is upheld, users could have stronger grounds to expect meaningful consent before their activity is used for behavioural advertising. Meta would be required to change how it processes and transfers their data. If the appeal succeeds, Meta would have more room to rely on its existing terms and advertising model.
The case arrives as Nigeria’s data protection enforcement has drawn wider scrutiny. The Nigeria Data Protection Commission previously issued a $32.8 million fine against Meta over similar consent and cross-border transfer issues, but the two parties settled the matter out of court. The Lagos ruling represents a separate legal track, pursued by private litigants rather than regulators. That distinction matters because it shows that enforcement of Nigeria’s data protection law does not depend solely on the NDPC.
The regulator’s own enforcement record has been mixed. The NDPC has taken action against companies including MultiChoice, and it has opened investigations into platforms like Temu. But settlements and waivers have raised questions about how consistently the commission pursues penalties. Nigeria’s data protection industry has grown quickly, but growth in the sector does not automatically translate into stronger enforcement against the largest platforms.
The Ruling Connects to an Enforcement Push
The Lagos judgment does not stand alone. President Bola Tinubu directed the FCCPC to investigate major technology companies, including Meta, over competition and consumer protection concerns. The FCCPC previously secured a $220 million penalty against Meta in 2025 over data privacy and competition violations, a decision that Meta also appealed. The Court of Appeal in Lagos dismissed that appeal in September 2026, leaving the $220 million fine in place.
The combination of regulatory action and private litigation creates pressure from multiple directions. The FCCPC case focuses on competition and consumer protection. The Lagos High Court case focuses on constitutional privacy and the NDPA. Together they test whether Nigerian law can constrain how global platforms operate in the country.
For Nigerian users, the practical question is what changes if the Lagos judgment survives appeal. The court’s ruling suggests that users should be able to access Facebook and Instagram without automatically consenting to behavioural profiling. If enforced, that would require Meta to offer a version of its services that does not depend on tracking users for advertising, or to make consent for tracking genuinely separate from access to the platform.
Meta’s appeal will now go before the Court of Appeal. The company’s notice of appeal does not suspend the High Court’s orders automatically, but the appellate process will determine whether those orders stand. Until the Court of Appeal rules, the legal position remains unsettled. The judgment comes from a first-instance court and does not yet settle the rules for every Nigerian user.
What the Appeal Means for Platform Regulation in Africa
The case is one of the most significant tests of data protection law in Nigeria since the NDPA took effect in 2023. A ruling by the Court of Appeal could clarify several issues that affect every international platform operating in Nigeria. It could establish whether behavioural advertising counts as a contractual necessity. It could define the limits of consent obtained through general terms of service. It could set standards for cross-border data transfers by companies that do not maintain local infrastructure.
Other African countries are watching. Nigeria’s NDPA is one of the continent’s more comprehensive data protection laws, and its enforcement record influences how other regulators approach similar cases. If the Lagos judgment survives appeal, it strengthens the argument that national data protection laws can override global platform terms. If Meta wins, it weakens that argument and gives platforms more room to rely on their standard contractual frameworks.
The appeal also highlights a practical challenge for African regulators. Global platforms design their terms of service for worldwide use. Adapting those terms to comply with country-specific consent requirements is technically possible but operationally complex. The outcome of Meta’s appeal will determine how much adaptation Nigerian law can demand.
For now, the case sits before the Court of Appeal. The judgment below stands until the higher court rules otherwise. Meta must still comply with the orders or seek a stay. Nigerian users will continue using Facebook and Instagram under the existing terms. The question of whether those terms are lawful remains open, and the answer will shape how platforms handle Nigerian data for years to come.