Meta and NDPC Settle $32.8M Data Privacy Fine Out of Court

Meta, the parent company of Facebook and Instagram, initiated settlement negotiations with the Nigerian Data Protection Commission (NDPC) on Friday following a $32.8 million fine issued in February 2025 for violations of Nigeria’s Data Protection Act. The case, which was expected to see a preliminary ruling, now heads toward potential out-of-court resolution, with both parties adjourning court proceedings to October 31, 2025, to finalize settlement terms.

The Violations and Initial Fine

The NDPC’s investigation concluded that Meta processed the personal data of Nigerian users without proper consent, engaged in behavioral advertising without authorization, and breached cross-border data transfer rules. The commission also found that Meta failed to file required compliance audits and processed data belonging to non-users of its platforms. Based on these findings, the NDPC issued eight corrective orders alongside the financial penalty.

The violations identified by the NDPC represent core breaches of Nigeria’s 2023 Data Protection Act, which requires explicit user consent for data processing, mandatory compliance reporting, and strict controls on cross-border data flows.

Meta’s Legal Challenge and Due Process Arguments

Meta rejected the NDPC’s decision and filed suit seeking to quash the corrective orders, arguing that the company was denied a fair hearing and adequate notice before sanctions were imposed. According to Meta’s legal position, the enforcement process violated the company’s constitutional right to due process, as it was not given sufficient opportunity to respond to allegations before the fine was issued.

The NDPC countered by describing Meta’s lawsuit as defective and legally incompetent. The commission’s lawyers argued that Meta’s filings were inconsistent and that the company was attempting to substitute previously ruled-upon reliefs with new claims, which violates court procedural rules. This dispute over process and legal standing set the stage for a preliminary ruling that was scheduled for Friday.

Settlement Negotiations and Court Adjournment

Instead of proceeding with the preliminary ruling, both legal teams announced that settlement negotiations were underway. Lawyers from both camps informed the court that draft settlement terms had been circulated and requested additional time to complete negotiations. The presiding judge, noting that Nigerian law encourages friendly settlement of disputes, agreed to suspend the preliminary ruling and adjourn the case to October 31, 2025.

The NDPC’s willingness to engage in settlement negotiations represents a shift from its initial enforcement stance, suggesting that the commission recognizes the potential for negotiated resolution to achieve compliance faster than protracted litigation. Similarly, Meta’s participation in settlement talks reflects the company’s desire to avoid prolonged legal uncertainty in one of Africa’s largest digital markets and to reduce operational risk in Nigeria.

Nigeria’s Data Protection Regulatory Framework and Enforcement Strategy

This case represents one of the most significant tests of Nigeria’s Data Protection Act since its passage in 2023. The law was designed to strengthen the rights of data subjects and impose strict requirements on companies operating in Nigeria, including obligations to obtain explicit consent, safeguard user information, and submit compliance reports.

The NDPC’s enforcement record demonstrates a commitment to holding both multinational and domestic companies accountable. In addition to Meta’s $32.8 million fine, the commission imposed an independent ₦766.2 million fine on Multichoice Nigeria, a major African media company, indicating that the regulator is applying enforcement consistently across foreign and local operators.

This enforcement pattern signals that Nigeria intends to establish itself as a jurisdiction with credible data protection oversight, particularly as digital platforms expand their influence across the continent.

Implications for Nigeria’s Digital Economy and African Precedent

The outcome of Meta’s case will have ripple effects across Nigeria’s digital economy and beyond. For consumers, a settlement that includes strict compliance requirements could strengthen confidence that personal data is being handled responsibly, thereby encouraging greater participation in digital services such as e-commerce, fintech, and online platforms where trust is essential for adoption.

Conversely, if settlement terms appear lenient, they may undermine public confidence in the regulator’s commitment to accountability and create the perception that large multinational companies can negotiate their way out of enforcement.

For Meta specifically, the case carries strategic importance beyond Nigeria. Nigeria is Africa’s largest internet market and is frequently used as a testing ground for new digital policies and consumer behaviors. A settlement that binds Meta to specific compliance standards in Nigeria could establish a precedent that influences the company’s data protection practices across the African continent, potentially forcing Meta to adopt similar or stronger protections in other jurisdictions.

For the NDPC, successfully resolving this case—whether through settlement or court ruling—will strengthen the commission’s reputation as a regulator capable of holding global technology companies accountable. A positive resolution will demonstrate that the NDPC possesses both the legal authority and institutional will to sanction major multinational corporations, thereby encouraging more responsible business practices among foreign technology investors in Nigeria’s tech sector.

Frequently Asked Questions

Q: What violations did the NDPC find Meta guilty of under Nigeria’s Data Protection Act?

The NDPC found Meta guilty of processing personal data without proper user consent, engaging in behavioral advertising without authorization, breaching cross-border data transfer rules, failing to file compliance audits, and processing data belonging to non-users. These violations led to the $32.8 million fine and eight corrective orders issued in February 2025.

Q: Why are Meta and the NDPC pursuing a settlement instead of allowing the court to rule?

Both parties have recognized that settlement negotiations may provide faster and more practical resolution than prolonged litigation. Meta seeks to reduce operational uncertainty in Nigeria, while the NDPC can achieve compliance objectives without the delays inherent in court appeals. The judge agreed to adjourn proceedings to October 31, 2025, to allow either a consent judgment or final settlement order.

Q: How could this case affect Meta’s operations across Africa?

Nigeria is Africa’s largest internet market and a testing ground for digital policies. A settlement that establishes strict compliance standards for Meta in Nigeria could set a precedent that influences Meta’s data protection practices across the African continent, potentially requiring the company to adopt similar protections in other jurisdictions and strengthening the NDPC’s role as a model regulator for African data protection enforcement.