On October 30th, a settlement agreement was reached between META (the parent company of Facebook, Instagram, and WhatsApp) and the Nigerian Data Protection Commission (NDPC), bringing to an end a legal dispute that had opposed the two parties for nearly two years. The agreement was approved on November 3rd, 2025, by the Federal High Court of Nigeria in Abuja.
A dispute separate from other sanctions
It is important to emphasize that this agreement relates solely to the dispute between Meta and the NDPC and has no connection with the sanction imposed by the Nigerian Federal Competition and Consumer Protection Commission (FCCPC) in July 2024. Indeed, the FCCPC had fined Meta USD 220 million for violations of personal data protection and consumer protection laws arising from the 2021 update of WhatsApp’s privacy policy. The two cases, although both related to the regulation of Meta’s activities in Nigeria, remain legally and procedurally independent.
A dispute arising from an in-depth investigation
Everything began in September 2023, when the NDPC launched an investigation into Meta’s personal data processing practices in Nigeria.
The findings of this investigation, published in February 2025, were damning: the Commission accused Meta of failing to obtain the explicit consent of Nigerian users for behavioral advertising targeting, of transferring data outside the country without authorization, and of collecting data from non-users through its platforms. Among the measures imposed were a fine of 32.8 million USD, as well as strict obligations such as conducting a data protection impact assessment and updating its privacy policy.
A compromise with major implications
Rather than continuing with judicial proceedings, both parties chose the path of dialogue. Meta agreed to withdraw its lawsuit and to comply with several requirements, including strengthening transparency in data processing, collaborating with educational institutions, and improving its technical and organizational measures to protect privacy.
In return, the NDPC withdrew its initial orders and refrained from enforcing them, while retaining its right to monitor compliance with Nigeria’s data protection law.