Meta penalty slashed, not scrapped – NDPC clarifies

By: Amarachi Okonkwo 

The Nigeria Data Protection Commission (NDPC) has clarified that the $32.8 million penalty imposed on Meta Platforms Inc. was not entirely waived, but reduced under a negotiated settlement that combines financial payments with compliance and public awareness obligations.

The clarification follows widespread reports suggesting the fine had been quietly cancelled. In a statement, the NDPC said both parties agreed to a revised framework in which Meta will make undisclosed payments to the Nigerian government, while the balance of the penalty is converted into commitments aimed at strengthening data protection practices across the country.

Background to the fine

The enforcement action stems from a 17-month investigation that began in February 2025. NDPC officials accused Meta of processing the personal data of more than 60 million Nigerians without valid consent, using the data for targeted advertising, and transferring it abroad without following local regulations.  

Read Also:

• Zenith Bank Plc enters Francophone market with Côte d’Ivoire launch
• NDPC Opens Probe into Remita, Sterling Bank

The commission initially issued eight corrective orders alongside the financial penalty, requiring significant changes to Meta’s data handling practices under the Nigeria Data Protection Act.

Meta challenged the sanctions in court, triggering months of negotiations that culminated in a confidential settlement agreement signed on October 30, 2025. The agreement was subsequently formalised as a consent judgment by the Federal High Court Abuja on November 3, 2025.

Terms of the settlement

NDPC spokesperson Itunu Dosekun said the resolution reflects a broader regulatory objective beyond monetary penalties.

According to the commission:

A portion of the fine has been paid directly to the government.

The remaining obligations have been converted into joint compliance and awareness initiatives.

Meta has agreed to cover the government’s legal costs

Between January and February 2026, both parties collaborated on nationwide digital campaigns on Facebook to promote data privacy awareness. The NDPC also confirmed ongoing discussions on three additional initiatives, including translating the Nigeria Data Protection Act into local languages to deepen public understanding.

Dosekun emphasised that enforcement is not solely punitive. “It is not just about collecting fines. We want to promote businesses while ensuring organisations respect people’s privacy,” she said.

Softened regulatory conditions

Under the original ruling, Meta faced strict directives to halt certain data processing activities. However, the settlement replaces some of these requirements with broader, forward-looking commitments on compliance and governance.

This shift has drawn scrutiny from legal and data protection experts, who argue that the revised terms may dilute the strength of the original enforcement action.

Legal and industry backlash

Criticism has been particularly strong from the Data Privacy Lawyers Association of Nigeria, which has issued a pre-action notice challenging the NDPC’s authority to reduce the fine.

The group contends that:

The commission may lack legal backing to compromise a remedial penalty of that scale

The settlement disproportionately favours Meta

The decision risks undermining the intent of Nigeria’s data protection regime

DPLAN is demanding a full explanation of the agreement and the reinstatement of the original $32.8 million penalty. A related court hearing is expected in early 2026.

Transparency concerns and broader implications

The confidentiality surrounding the agreement for several months has further intensified debate about regulatory transparency and accountability.

While negotiated settlements are common in global tech regulation, analysts warn that opaque deals could weaken deterrence and erode public trust. The case underscores a broader challenge for African regulators: balancing enforcement credibility with the practical realities of engaging multinational technology firms.

For Nigeria, the outcome may set an important precedent on how far regulators can go in negotiating penalties and how such decisions are communicated to the public.

As scrutiny continues, stakeholders are calling for clearer legal frameworks governing regulatory settlements to ensure consistency, transparency, and stronger protection of citizens’ data rights.