Meta Platforms has appealed a Lagos High Court judgment that found its processing of Nigerian users’ personal data for behavioural advertising unlawful.
The company filed its notice of appeal on September 30, five days after Justice A.F. Pokanu of the High Court of Lagos State, Ikorodu Judicial Division, ordered Meta to stop unlawful processing and profiling of users’ data for targeted advertising.
The appeal now moves the dispute over consent, behavioural advertising and cross-border data transfers to the Court of Appeal.
What the Lagos High Court ruled
The case was brought by the Incorporated Trustees of Laws and Rights Awareness Initiative and five individual applicants over Meta’s collection, profiling and use of personal data from Facebook and Instagram users.
In its September 25 judgment, the court held that Meta’s non-consensual processing of the applicants’ data for behavioural advertising violated the right to privacy under Section 37 of the 1999 Constitution and provisions of the Nigeria Data Protection Act (NDPA) 2023.
The court ordered Meta to:
- Cease unlawful processing of the applicants’ personal data, including for behavioural advertising without a lawful basis.
- Take remedial measures to bring its Nigerian data-processing operations into compliance with the NDPA.
- File an affidavit of compliance within eight weeks of the judgment.
- Pay the applicants the naira equivalent of US$100,000 in general damages.
- Pay ₦1 million in costs, in addition to applicable post-judgment interest.
Court rejects contractual necessity argument
A central issue in the case was whether Meta could rely on its terms of service to process users’ data for behavioural advertising.
Meta's position was that Facebook and Instagram are free, personalised services funded by advertising, and that users agree to the company's terms and privacy policies when they sign up.
Justice Pokanu rejected the argument that behavioural advertising was automatically necessary to provide the social-media services. The court treated profiling and targeted advertising as commercial activities associated with the platforms rather than indispensable elements of providing access to Facebook and Instagram.
The judgment also found that consent could not simply be incorporated into broad terms that users have to accept in order to access the services. Where Meta relied on consent as its legal basis, the court held that the company had the burden of demonstrating that valid consent had actually been obtained.
The judgment also addressed where Nigerian users’ data is processed.
Meta argued, among other things, that it does not operate a data centre in Nigeria and that users effectively transfer their information abroad when they use its services.
The court rejected that reasoning. It held that individual users do not control where their data is routed, stored or processed and that Meta, as the data controller, remains responsible for complying with Nigerian requirements governing international data transfers.
The court consequently found breaches relating to cross-border transfers under Sections 41 to 43 of the NDPA.
Why the appeal matters
The case goes beyond the damages awarded to the applicants.
At its centre is a broader question: can a social-media platform make behavioural tracking and targeted advertising a condition of accessing its services in Nigeria?
If the High Court's reasoning is upheld on appeal, it could have implications for how major digital platforms obtain consent, profile users and transfer personal data outside Nigeria. It could also affect the relationship between free, advertising-funded digital services and users' data-protection rights.
For Nigerian Facebook and Instagram users, the case could determine how much control they have over the use of information generated through their online activities.
Meta's advertising model under scrutiny
Meta's advertising business relies heavily on the ability to use data to personalise and measure advertising. The Lagos case therefore places aspects of that model under scrutiny in the Nigerian legal environment.
The court's decision does not automatically establish a new rule applicable to every Nigerian social-media user. It is a first-instance judgment and is now subject to appeal.
The Court of Appeal will have an opportunity to consider the legal questions surrounding lawful bases for processing, consent, behavioural advertising, transparency and international data transfers.
The case follows earlier regulatory action
The dispute comes amid previous privacy and competition-related proceedings involving Meta in Nigeria.
In 2024, the Federal Competition and Consumer Protection Commission (FCCPC) imposed a $220 million penalty on Meta and WhatsApp following an investigation into alleged consumer-protection, privacy and competition violations. The Competition and Consumer Protection Tribunal subsequently upheld the sanction, including directions concerning consent and data sharing.
The applicants in the Lagos case also referred to earlier proceedings involving the Nigeria Data Protection Commission (NDPC) and Meta. However, the Lagos High Court considered the applicants' claims independently rather than simply treating the regulatory proceedings as determinative.
A separate privacy case against Meta was also dismissed by the High Court of Imo State in July 2026 after the applicant failed to establish sufficient evidence of unlawful processing. The different outcomes highlight that Nigerian courts have not reached a uniform result across all privacy claims involving Meta.
What happens next?
For now, the September 25 Lagos judgment remains subject to the appellate process.
Meta's September 30 notice of appeal means the Court of Appeal will now be asked to review the High Court's findings.
The case could ultimately provide further judicial guidance on how Nigeria's Data Protection Act 2023 applies to behavioural advertising, user consent and the international processing of Nigerians' personal data.
Source: Techcabal