Meta Platforms, the parent company of Facebook, Instagram and WhatsApp, has appealed a Lagos High Court judgment that ordered it to stop unlawfully processing the personal data of Nigerian Facebook and Instagram users for behavioural advertising and to pay the naira equivalent of $100,000 in damages.

The company filed its notice of appeal on September 30, five days after Justice A.F. Pokanu of the Lagos High Court, Ikorodu Judicial Division, ruled on September 25 that Meta's non-consensual collection, profiling and use of users' data for targeted advertising violated privacy rights protected by Nigeria's Constitution and the Nigeria Data Protection Act (NDPA) 2023, Nigeria's principal data protection law. The appeal now takes the questions of consent, targeted advertising and cross-border data transfers before the Court of Appeal.

The judgment and its orders

The suit was brought by the Incorporated Trustees of Laws and Rights Awareness Initiative and five individual applicants. The court ordered Meta to stop the unlawful processing, take remedial steps to bring its Nigerian data-processing operations into compliance with the NDPA, and submit an affidavit of compliance within eight weeks. It also awarded the applicants $100,000 in general damages, ₦1 million ($753.20) in costs, and post-judgment interest.

The appeal will test whether Meta can treat behavioural profiling and targeted advertising as necessary conditions for providing Facebook and Instagram to Nigerian users. At stake is whether global platforms can make behavioural tracking a condition of accessing free social-media services, or whether Nigerian law requires a clearer separation between access to those services and consent to the use of personal data for advertising.

For users, the outcome could determine how much control Nigerians have over the personal data they generate on Facebook and Instagram. If the judgment is upheld, users could have stronger grounds to expect meaningful consent before their activity is used for behavioural advertising, while Meta could be required to change how it processes and transfers their data. If the appeal succeeds, Meta would have more room to rely on its existing terms and advertising model.

Meta's defence

Meta has argued that Facebook and Instagram are free, personalised services funded by advertising, and that users accept the company's terms and privacy policy when they sign up. Its position is that processing user data for advertising forms part of the contractual arrangement through which it provides the services.

Justice Pokanu rejected that position. The court held that building profiles for targeted advertising is not automatically necessary to provide a social-networking service simply because advertising funds the service. It found that behavioural advertising is ancillary to Facebook and Instagram rather than essential to making the platforms work. In other words, a platform cannot make data processing compulsory merely by placing it in its terms of service if the processing is not genuinely required to deliver the core service.

The court also held that Meta bore the burden of proving that users had provided valid consent wherever it relied on consent as the legal basis for processing. Consent to profiling and behavioural advertising, the court found, could not simply be folded into broad, standard terms that users must accept to access Facebook or Instagram.

Justice Pokanu framed the dispute as a question of how far a technology company may “observe, aggregate, analyse, profile and commercially exploit” a Nigerian citizen's online behaviour without the person genuinely understanding, authorising or reasonably expecting that use. The ruling connected the issue directly to the constitutional right to privacy under Section 37 of the 1999 Constitution and to the protections in the NDPA. The court found that Meta's non-consensual processing, profiling and use of the applicants' data for behavioural advertising breached those protections.

Cross-border transfers

The court additionally considered Meta's handling of Nigerian users' data outside the country. Meta argued that it has no data centre in Nigeria and that users effectively transfer their own information abroad when they access its services. The court rejected that reasoning, holding that users do not control where their data is routed, stored or processed.

As a major data controller—a party that determines how personal data is collected and used—Meta remained responsible for complying with the NDPA's safeguards for international data transfers, the court held. It found that unauthorised cross-border transfers of the applicants' data violated Sections 41 to 43 of the NDPA and infringed their privacy rights.

Separate from earlier regulatory disputes

The High Court case stands apart from Meta's earlier conflicts with Nigerian regulators. In 2024, the Federal Competition and Consumer Protection Commission imposed a $220 million penalty on Meta and WhatsApp following an investigation into alleged consumer-protection, privacy and competition violations. The Competition and Consumer Protection Tribunal later upheld the sanction, including directions concerning consent and data sharing.

The applicants in the Lagos case also relied in part on an earlier action by the Nigeria Data Protection Commission against Meta, which included a $32.8 million remedial fee. That dispute was later resolved through a consent judgment, so the court considered the applicants' privacy claims independently rather than simply enforcing the regulatory decision. The court found that the applicants had presented independent evidence of continuing privacy violations and proceeded to determine the constitutional and statutory questions on that basis. Taken together, the proceedings show Meta's Nigerian operations drawing scrutiny through competition, consumer-protection and data-protection channels alike, even though the Lagos case rests on the applicants' own constitutional and statutory claims.

What is at stake on appeal

The $100,000 award—far below the $200 million in general and exemplary damages sought by the applicants—may not be the most consequential part of the judgment. The more significant issue is whether an appellate court will uphold the finding that Meta cannot make behavioural profiling a condition of access to Facebook and Instagram.

If it stands, the ruling could establish that an advertising-funded business model does not by itself make behavioural advertising legally necessary, and that general terms of service do not necessarily amount to valid, specific consent for profiling. It could also reinforce the principle that users do not waive constitutional privacy rights simply by continuing to use a platform, and that companies—not individual users—are responsible for complying with Nigerian rules governing international data transfers.

For now, the September 25 ruling remains a first-instance decision. With the High Court's orders on record—including the eight-week affidavit of compliance—and the appeal pending, the case's next procedural steps sit with the Court of Appeal, where the ruling's reasoning on behavioural advertising, consent, transparency and cross-border data transfers will be tested.