Meta appeals ruling that it can’t force Nigerians accept ad tracking

Meta Platforms, parent company of Facebook, Instagram, and WhatsApp, has appealed a Lagos High Court judgment that ordered it to stop unlawfully processing the personal data of Nigerian Facebook and Instagram users for behavioural advertising and pay the naira equivalent of $100,000 in damages.

The company filed its notice of appeal on September 30, five days after Justice A.F. Pokanu of the Lagos High Court, Ikorodu Judicial Division, ruled that Meta’s non-consensual collection, profiling, and use of users’ data for targeted advertising violated privacy rights protected by Nigeria’s Constitution and the Nigeria Data Protection Act (NDPA) 2023. 

The appeal brings the consent dispute, targeted advertising, and cross-border data transfers before the Court of Appeal.

The suit was brought by the Incorporated Trustees of Laws and Rights Awareness Initiative and five individual applicants. The court ordered Meta to stop the unlawful processing, take remedial steps to bring its Nigerian data-processing operations into compliance with the NDPA, and submit an affidavit of compliance within eight weeks. It also awarded the applicants $100,000 in general damages, ₦1 million ($753.20) in costs and post-judgment interest.

The appeal will test whether Meta can treat behavioural profiling and targeted advertising as necessary conditions for providing Facebook and Instagram to Nigerian users.

At stake is whether global platforms can make behavioural tracking a condition of accessing free social-media services, or whether Nigerian law requires a clearer separation between access to those services and consent to the use of personal data for advertising.

For users, the outcome could determine how much control Nigerians have over the personal data they generate on Facebook and Instagram. If the judgment is upheld, users could have stronger grounds to expect meaningful consent before their activity is used for behavioural advertising, while Meta could be required to change how it processes and transfers their data. If the appeal succeeds, Meta would have more room to rely on its existing terms and advertising model.

Meta has argued that Facebook and Instagram are free, personalised services funded by advertising, and that users accept the company’s terms and privacy policy when they sign up. Its position is that processing user data for advertising forms part of the contractual arrangement that allows it to provide the services.

Justice Pokanu rejected that position. The court held that building profiles for targeted advertising is not automatically necessary to provide a social-networking service simply because advertising funds the service. It found that behavioural advertising is ancillary to Facebook and Instagram, rather than essential to making the platforms work.

In other words, a platform cannot make data processing compulsory merely by placing it in its terms of service if the processing is not genuinely required to deliver the core service.

The court held that Meta bore the burden of proving that users had provided valid consent where it relied on consent as the legal basis for processing. Consent to profiling and behavioural advertising, the court found, could not simply be folded into broad, standard terms that users must accept to access Facebook or Instagram.

Justice Pokanu framed the dispute as a question of how far a technology company may “observe, aggregate, analyse, profile and commercially exploit” a Nigerian citizen’s online behaviour without the person genuinely understanding, authorising or reasonably expecting that use.

The ruling connected the issue directly to the constitutional right to privacy under Section 37 of the 1999 Constitution and protections in the NDPA. The court found that Meta’s non-consensual processing, profiling and use of the applicants’ data for behavioural advertising breached those protections.

The court also considered Meta’s handling of Nigerian users’ data outside the country. Meta argued that it has no data centre in Nigeria and that users effectively transfer their own information abroad when they access its services. The court rejected that reasoning, holding that users do not control where their data is routed, stored or processed.

As a major data controller, Meta remained responsible for complying with the NDPA’s safeguards for international data transfers, the court held. It found that unauthorised cross-border transfers of the applicants’ data violated Sections 41 to 43 of the NDPA and infringed their privacy rights.

The High Court case is separate from Meta’s earlier disputes with Nigerian regulators. In 2024, the Federal Competition and Consumer Protection Commission imposed a $220 million penalty on Meta and WhatsApp following an investigation into alleged consumer-protection, privacy and competition violations. The Competition and Consumer Protection Tribunal later upheld the sanction, including directions concerning consent and data sharing.

The applicants in the Lagos case also relied in part on an earlier action by the Nigeria Data Protection Commission against Meta, which included a $32.8 million remedial fee. That dispute was later resolved through a consent judgment, so the court considered the applicants’ privacy claims independently rather than simply enforcing the regulatory decision.

The court found that the applicants had presented independent evidence of continuing privacy violations and proceeded to determine the constitutional and statutory questions on that basis.

The $100,000 award—far below the $200 million in general and exemplary damages sought by the applicants—may not be the most consequential part of the judgment. The more significant issue is whether an appellate court will uphold the finding that Meta cannot make behavioural profiling a condition of access to Facebook and Instagram.

If it stands, the ruling could establish that an advertising-funded business model does not by itself make behavioural advertising legally necessary, and that general terms of service do not necessarily amount to valid, specific consent for profiling. It could also reinforce the principle that users do not waive constitutional privacy rights simply by continuing to use a platform, and that companies—not individual users—are responsible for complying with Nigerian rules governing international data transfers.

For now, the September 25 ruling remains a first-instance decision. Meta’s appeal means its reasoning on behavioural advertising, consent, transparency, and cross-border data transfers will be tested at the appellate level. 

True scale demands moving beyond surface-level integrations to robust execution. We’ve filtered the noise out of Moonshot 2026, optimising the conference strictly for high-calibre connections between startup founders, global financial operators, enterprise leaders and individuals rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.