The Meta $220 Million Fine: A Landmark in Nigeria’s Data Sovereignty Battle

Contributor: Chinwendu Okosa

Introduction

In July 2024, the Federal Competition and Consumer Protection Commission (FCCPC), in collaboration with the Nigeria Data Protection Commission (NDPC), concluded a 38-month investigation into Meta’s data handling practices.^[1] The probe revealed that Meta engaged in unauthorized data sharing, lacked proper user consent mechanisms, and treated Nigerian consumers differently from users in other regions.^[2] Meta appealed the fine, but on April 25, 2025, the Competition and Consumer Protection Tribunal upheld the penalty, affirming the FCCPC’s authority and the validity of its findings.^[3]

Thus, the Meta $220 million fine by the FCCPC and the NDPC marks a significant milestone in Nigeria’s pursuit of data sovereignty. The fine portrays Nigeria’s commitment to holding global tech giants accountable while asserting its regulatory authority in the digital economy.

This article seeks to explore the legal and policy implications of the fine, the broader context of data sovereignty in Nigeria, and its impact on global tech companies. It also examines how such enforcement actions shape Nigeria’s digital ecosystem and align with global data protection trends.

Brief Background of the Case

In what has become one of the most consequential confrontations between a sovereign African state and a global tech giant, Nigeria’s $220 million fine against Meta Platforms Inc. marks a critical moment in Nigeria’s assertion of digital rights and data protection.

The case started in 2021, following growing concerns that Meta, the parent company of Facebook, Instagram, and WhatsApp, was violating Nigerian users’ data privacy rights. Investigations into the company’s practices began with complaints and audits, which showed that Meta was allegedly collecting and sharing user data without sufficient consent.^[4]

In response, the FCCPC, in partnership with the NDPC, launched a comprehensive 38-month investigation. This investigation uncovered several troubling findings. For instance, it was revealed that Meta denied Nigerians the right to control their data, transferred and shared Nigerian user data without authorization, discriminated against Nigerian users compared to users in other jurisdictions, and abused its dominant market position by imposing unfair privacy policies.^[5]

On July 19, 2024, the FCCPC imposed a $220 million fine on Meta for these violations.^[6] The Commission also ordered Meta to correct its privacy practices, cease unauthorized data transfers, and enhance user control mechanisms.^[7]

Meta challenged the decision and appealed to the Competition and Consumer Protection Tribunal, arguing, among other things, that the fine was excessive and that due process had not been followed. However, on April 25, 2025, the Tribunal upheld the FCCPC’s findings and confirmed the fine.^[8] The Tribunal ruled that Meta had indeed breached Nigeria’s data protection and consumer laws, and ordered the company to pay the fine within 60 days, comply with user consent regulations, and reimburse the FCCPC approximately $35,000 in investigation costs.

Nigeria’s Legal Framework on Data Protection

• Constitution of the Federal Republic of Nigeria (CFRN) 1999: The CFRN 1999 is commonly known as the supreme law in Nigeria, and it establishes the framework or authority for other laws to be made. It made key provisions jealousy protecting and safeguarding the rights of Nigerian citizens.

The core constitutional provision on data protection is to the effect that the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is guaranteed and protected.^[9] Notably, though the provision does not expressly mention data protection, it can be widely interpreted in this digital age to include the protection of personal data.

• Nigeria Data Protection Act (NDPA) 2023: On 12 June 2023, President Bola Ahmed Tinubu, GCFR, assented to the Nigeria Data Protection Bill, 2023.^[10] The Act provides the statutory framework for overseeing the processing of personal data in Nigeria and supersedes the Nigerian Data Protection Regulations (NDPR) 2019 and the NDPR Implementation Framework 2019, both previously issued under the National Information Technology Development Agency (NITDA) Act.^[11]

The Act was enacted to protect the fundamental rights, liberties, and interests of data subjects, as guaranteed by the Constitution of the Federal Republic of Nigeria.^[12] The objective of the Act includes, inter alia, the protection of personal information; establishing the Nigeria Data Protection Commission for the regulation of the processing of personal information; promoting data processing practices that safeguard the security of personal data and privacy of data subjects, etc.^[13]

The NDPA 2023 made specific provisions regarding the protection of individuals in Nigeria. For instance, the Act provides that a data controller should ensure that personal data is processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing, loss, destruction, damage or any form of data breach.^[14]

Thus, this provision touches the core of the case because it forms part of the legal standard Meta was expected to uphold in Nigeria. Meta’s inability to ensure lawful, secure, and equitable data processing for Nigerian users violated this obligation, which led to the regulatory action and the eventual fine.

• Nigerian Data Protection Regulation (NDPR) 2019: The NDPR 2019, issued by the National Information Technology Development Agency (NITDA), was Nigeria’s first comprehensive legal framework dedicated to the protection of personal data.^[15] Although now superseded by the NDPA 2023, the NDPR laid the foundational principles that continue to shape Nigeria’s data protection landscape.

The key objectives of the Regulation include the following:

1. To safeguard the rights of natural persons to data privacy;
2. To foster safe conduct for transactions involving the exchange of Personal Data;
3. To prevent manipulation of Personal Data; and
4. To ensure that Nigerian businesses remain competitive in international trade through the safeguards afforded by a just and equitable regulatory framework on data protection, and which is in line with international best practices.^[16]
5. NDPR Implementation Framework: The NDPR Implementation Framework, issued in 2020 by NITDA, provides practical guidance for enforcing the Nigerian Data Protection Regulation (NDPR) 2019.^[17] It outlines compliance procedures for data controllers and processors, sets standards for audits and breach reporting, and introduces licensed Data Protection Compliance Organizations (DPCOs) to support enforcement.

The above are the key provisions of law regulating and protecting data privacy in Nigeria.

It has also been noted that the FCCPC, in conjunction with the NDPC conducted the investigation with respect to the activities of Meta in Nigeria. A pertinent question that arises is: What role does the FCCPC play in investigating breaches of data privacy in Nigeria?

Pointedly, the key objectives of the Federal Competition and Consumer Protection Act (FCCPA) 2019 are as follows:

1. Promote and maintain competitive markets in the Nigerian economy;
2. promote economic efficiency;
3. protect and promote the interests and welfare of consumers by providing consumers with a wider variety of quality products at competitive prices;
4. prohibit restrictive or unfair business practices which prevent, restrict or distort competition or constitute an abuse of a dominant position of market power in Nigeria; and
5. contribute to the sustainable development of the Nigerian economy.^[18]

In light of the above, the FCCPC is empowered to regulate market conduct and protect consumer rights. Since Meta holds significant market dominance in Nigeria’s social media and digital advertising space, it is in a position to use this dominance to impose unfair terms. Thus, where it does so, it may constitute abuse of market power and the FCCPC is empowered to, from the angle of consumer rights protection, prohibit and penalise such from happening (which it did as in the case of Meta).

Essential Insights for Tech Founders

Technology founders can draw vital lessons from Meta’s regulatory challenges in Nigeria. It is, therefore, imperative to point out key takeaways for tech founders.

1. Adopt a Privacy-by-Design Approach: Integrating Data Protection by Design requires technology founders to embed privacy and data protection considerations into the core architecture of their products and business processes from the very beginning.^[19] This approach ensures that privacy considerations are incorporated into the systems and processes, ensuring compliance with data protection laws.
2. Understand and Comply with Local Data Protection Laws: Understanding the data protection laws applicable in each jurisdiction where a product or service operates is of paramount importance. Tech founders must take the time to study and internalize the legal frameworks governing data privacy in their target markets, ensuring that their data handling practices are fully compliant.^[20] It is not sufficient to adopt a one-size-fits-all (uniform) approach; instead, practices must be tailored to reflect the specific legal and regulatory requirements of each region.
3. Remain Proactive in Monitoring Regulatory Changes: Data protection regulations are dynamic and subject to frequent updates. As such, it is essential for tech founders to remain actively informed about shifts in the regulatory environment and to adjust their data governance practices in response. Keeping pace with these changes not only ensures ongoing compliance but also positions a business to respond swiftly to new legal obligations.^[21]
4. Prioritize Transparency in Data Practices: Openness about how user data is collected, used, and shared is essential for building trust with both users and regulators.^[22] Tech founders should ensure that their platforms communicate data practices in a clear, accessible, and user-friendly manner.

Conclusion

The $220 million fine imposed on Meta marks a watershed moment in Nigeria’s assertion of data sovereignty and regulatory authority over global tech giants operating within its borders. This development emphasizes the growing attention on local compliance and transparency in the digital economy. For technology founders, it serves as a powerful reminder of the critical need to prioritize data protection by design and align their operations with national data protection laws.

The Nigerian authorities, through agencies like the FCCPC and NDPC, have signaled their readiness to enforce compliance and safeguard consumer rights in the digital space. As regulatory landscapes become more proactive, operational transparency will no longer be optional. Instead, they will be prerequisites for sustainable success. Finally, this case sets a precedent, not just for Nigeria, but for other emerging economies asserting control over their digital ecosystems.

Reference

1. Ijagwu, O, ‘Violations: Tribunal Upholds FCCPC’s $220 Million Fine against Meta/Whatsapp’, <https://fccpc.gov.ng/violations-tribunal-upholds-fccpcs-220-million-fine-against-meta-whatsapp/> accessed 19^th May, 2025. ↑
2. Techpoint Africa, ‘Meta must Pay $200 Million Fine in 60 Days for Discriminatory Practices in Nigeria, Tribunal Insists’, <https://techpoint.africa/news/meta-220m-fine-60-days/> accessed 19^th May, 2025. ↑
3. Ibid. ↑
4. Dosunmu, D, ‘What Meta’s Dispute in Nigeria Means for its Millions of Users’, <https://restofworld.org/2025/meta-nigeria-fine/> accessed 19^th May, 2025. ↑
5. Ibid. ↑
6. Damilola, A, ‘Tribunal Upholds FCCPC’s $220m Fine against Meta, Whatsapp’, <https://punchng.com/tribunal-upholds-fccpcs-220m-fine-against-meta-whatsapp/> accessed 19^th May, 2025. ↑
7. Clement, PS, ‘FCCPC to Meta: Threatening to Leave Nigeria Doesn’t Absolve you of Liability’, <https://dailytrust.com/fccpc-to-meta-threatening-to-leave-nigeria-doesnt-absolve-you-of-liability/> accessed 19^th May, 2025. ↑
8. Onyekachi, N, ‘Tribunal Orders Meta, Whatsapp to Pay FCCPC $200 Million Fine, $35,000 in 60 Days for Discriminatory Practices’, < https://nairametrics.com/2025/04/25/tribunal-orders-meta-whatsapp-to-pay-fccpc-220-million-fine-35000-in-60-days-for-discriminatory-practices/> accessed 19^th May, 2025. ↑
9. Section 37, CFRN 1999. ↑
10. Ajayi, A and Anyanwu, J, ‘The Nigeria Data Protection Act, 2023’, <https://kpmg.com/ng/en/home/insights/2023/09/the-nigeria-data-protection-act–2023.html> accessed 19^th May, 2025. ↑
11. Ibid. ↑
12. DLA Piper, ‘Data Protection Laws in Nigeria’, <https://www.dlapiperdataprotection.com/index.html?t=law&c=NG> accessed 19^th May, 2025. ↑
13. Ibid. ↑
14. Section 24(1)(f), NDPA 2023. ↑
15. Agunbiade, A, ‘A Review of the Nigerian Data Protection Regulation 2019’, <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4483850> accessed 19^th May, 2025. ↑
16. Section 1.1, NDPR 2019. ↑
17. G Elias & Co, ‘Nigeria Data Protection Act, 2023: A Review’, <https://www.gelias.com/images/Newsletter/The_Nigerian_Data_Protection_Act_2023_-_A_Review.pdf> accessed 19^th May, 2025. ↑
18. Section 1, FCCPA 2018. ↑
19. Pavestones, ‘Data Protection in Nigeria: Lessons from the Meta vs the FCCPC Matter’, <https://proshare.co/articles/data-protection-in-nigeria-lessons-from-the-meta-vs-fccpc-matter?menu=Technology&classification=Read&category=Data%20%26%20Financial%20Inclusion> accessed 19^th May, 2025. ↑
20. Ibid. ↑
21. Ibid. ↑
22. Ibid ↑