Nigeria's evolving data privacy laws face challenges from rapid AI advancements and enforcement limits

Three years after adopting a comprehensive data protection law, Nigeria is grappling with enforcement of global platform compliance amid emerging AI threats, exemplified by a landmark case against Meta and WhatsApp.

Three years after Nigeria adopted a national data-protection statute, the central question is no longer whether the country recognises digital privacy in principle. It is whether regulators can make global platforms and emerging AI systems comply in practice. That tension came into sharp focus in April 2025, when the Competition and Consumer Protection Tribunal largely upheld the Federal Competition and Consumer Protection Commission’s action against Meta and WhatsApp, leaving in place a $220 million penalty and backing the regulators on most of the core issues. By February 2026, the Nigeria Data Protection Commission had joined an international warning that AI-generated images and videos were enabling non-consensual intimate imagery and other harmful depictions of identifiable people. (fccpc.gov.ng)

The 2023 Nigeria Data Protection Act gave the state a far more complete legal structure for handling those disputes. BusinessDay and Punch both noted that President Bola Tinubu signed the law on 12 June 2023, after a period in which the earlier 2019 regulation was increasingly seen as too limited for the scale and complexity of modern data processing. Their analyses pointed to the gaps the new Act was meant to close, including thin protection for children’s data, weak rules on cross-border transfers and the old regime’s failure to recognise legitimate interest as a defined lawful basis for processing. They also underlined the practical shift created by the Act: the establishment of the Nigeria Data Protection Commission as the lead regulator, alongside breach-management duties that require notification to the commission within 72 hours after a controller is informed by a processor. (businessday.ng)

That framework did not emerge from one statute alone. Even before the Act came into force, the Nigerian Communications Commission was drawing up sector-specific privacy rules for telecoms operators. The Guardian reported in July 2023 that the draft Data Protection (Communications Services) Regulations would rest on section 70 of the Nigerian Communications Act and cover processing of communications data, safety standards, consent, caller identification, direct marketing and data transfers. The proposal showed that privacy protection in Nigeria was already moving beyond abstract rights and into detailed compliance rules for service providers. Its sanctions were designed to be felt: a licensee that breached the draft rules faced a N10 million administrative fine and a further N1 million for every day the violation continued. The draft also took a restrictive approach to biometrics, allowing processing for unique identification only under tightly defined public-interest and consent conditions. (guardian.ng)

The Meta case has become the clearest example of how that regulatory posture works when directed at a dominant technology company. According to the FCCPC, the appeal followed a 38-month joint investigation with the NDPC into Meta’s conduct, privacy practices and consumer-data policies. The three-member tribunal led by Thomas Okosun upheld the main findings, awarded the FCCPC $35,000 in investigation costs and rejected the companies’ fair-hearing challenge, although it set aside one part of the commission’s final order for want of sufficient legal basis. Technext reported that the judgment also imposed concrete compliance steps: Meta and WhatsApp were told to submit a working policy within 10 days, file a compliance letter by 1 July 2025, revert to the 2016 data-sharing position and stop linking WhatsApp data to Facebook or other third parties without Nigerian users’ consent. “The appellants were given ample opportunity to be heard,” the tribunal said, according to Technext. (fccpc.gov.ng)

Yet the most difficult cases may be the ones that spread too quickly for ordinary enforcement tools to contain. In an opinion article published in May 2026, Premium Times argued that Nigerian law still contains no explicit definition of deepfakes, no stand-alone prohibition targeted at synthetic media used for fraud, and no mandatory labelling rule for AI-generated content. The article pointed to fake investment videos using the likenesses of prominent figures including Ngozi Okonjo-Iweala and Ibukun Awosika as evidence that the harm is already real. The NDPC’s international joint statement did not create a new Nigerian offence, but it did call for “robust safeguards”, transparency about system capabilities and fast removal mechanisms for harmful personal content. That leaves Nigeria with a framework that can address some of the underlying processing of personal and biometric data, while still lacking a bespoke legal response to synthetic deception itself. (premiumtimesng.com)

Taken together, those developments suggest that Nigeria’s privacy regime is substantial, but not yet fully adequate to the pace of digital change. The country now has a principal statute, an active regulator, sector-specific proposals for communications providers and a major enforcement case showing that international platforms can be sanctioned locally. At the same time, the supporting sources point to the limits of the current settlement. Cross-border transfers remain hard to police, effective protection still depends on user awareness and institutional capacity, and technologies such as facial synthesis and AI-generated imagery are moving faster than traditional complaint and redress systems. BusinessDay and Punch both argued that the 2023 law would succeed only if regulators, businesses and citizens committed to training and continuous compliance. The NCC draft and the Meta proceedings suggest the next phase will be defined less by broad constitutional promises than by increasingly technical rules, tighter supervision and test cases against powerful intermediaries. (businessday.ng)