Meta is challenging a Nigerian court ruling that could change how Facebook and Instagram collect and use people’s data for targeted advertising.
The company has appealed a September 25 judgment by the Lagos High Court, which found that Meta could not make behavioural profiling a requirement for Nigerians who want to use its platforms.
Meta filed its notice of appeal on September 30, taking the dispute to the Court of Appeal.
The case centres on how much control users have over the personal information generated when they use Facebook and Instagram, and whether accepting a platform’s terms of service is enough to give the company permission to track and profile them for advertising.
The lawsuit was filed by the Incorporated Trustees of Laws and Rights Awareness Initiative and five individuals.
Justice A.F. Pokanu of the Lagos High Court, Ikorodu Judicial Division, ruled that Meta’s collection, profiling and use of the applicants’ data for behavioural advertising without valid consent breached privacy protections under Nigeria’s Constitution and the Nigeria Data Protection Act (NDPA) 2023.
The court ordered Meta to stop the unlawful processing, bring its Nigerian data-processing practices into compliance with the NDPA and file an affidavit confirming compliance within eight weeks.
It also awarded the applicants $100,000 in general damages, ₦1 million in costs and post-judgment interest.
Why Meta is appealing
Meta’s argument is built around the way its services operate.
Facebook and Instagram are offered to users without a subscription fee, while advertising provides a major source of revenue for the platforms. Meta argued that personalising advertising through the use of user data forms part of the arrangement users accept when they sign up and agree to its terms and privacy policy.
The court took a different view.
Justice Pokanu found that the fact that advertising helps fund a social-media platform does not automatically make behavioural profiling necessary for providing the service.
In practical terms, the ruling draws a line between using Facebook or Instagram and agreeing to have personal activity analysed for targeted advertising.
The court also said that when Meta relies on consent as the legal basis for processing personal data, it must be able to show that users actually gave valid consent.
Simply accepting broad terms and conditions, the judgment found, does not necessarily amount to specific consent for behavioural profiling.
The case also involves data leaving Nigeria
Another major issue was what happens to Nigerian users’ data when it is processed outside the country.
Meta told the court that it does not have a data centre in Nigeria and argued that users effectively make their information available outside the country when they use its services.
The court rejected that reasoning.
It held that ordinary users do not determine where their information is stored, routed or processed. Meta, as the data controller, therefore remains responsible for complying with Nigeria’s rules on international transfers of personal data.
The court found that the unauthorised processing and transfer of the applicants’ data violated Sections 41 to 43 of the NDPA.
This is not Meta’s first Nigerian privacy dispute
The latest case adds to a series of regulatory and legal disputes between Meta and Nigerian authorities over how the company handles user data.
In 2024, the Federal Competition and Consumer Protection Commission imposed a $220 million penalty on Meta and WhatsApp following an investigation into alleged consumer-protection, privacy and competition violations. The Competition and Consumer Protection Tribunal later upheld the sanction.
The Lagos case also referred to an earlier enforcement action involving the Nigeria Data Protection Commission, which included a $32.8 million remedial fee. That matter was later resolved through a consent judgment.
The High Court considered the claims before it separately and reached its own findings on Meta’s data-processing practices.
What happens next?
The appeal will give the Court of Appeal an opportunity to examine whether behavioural advertising can be treated as necessary for access to Facebook and Instagram, what constitutes valid consent for profiling, and what obligations Meta has when Nigerian users’ data is processed across borders.
The ruling could have implications beyond Meta if the appellate court upholds the High Court’s interpretation of consent and behavioural advertising under Nigerian data-protection law.
For now, however, the September 25 judgment remains a High Court decision under appeal.
The next stage of the case will determine whether Meta must change the way it obtains consent and processes Nigerian users’ data, or whether the company can continue relying on its existing approach.