*“Holds Consent Cannot Simply Be Buried In Facebook, Instagram Terms”
![](https://thenigerialawyer.com/wp-content/uploads/2026/09/2026-IDRI-Masterclass.png")
The High Court of Lagos State, Ikorodu Judicial Division, has held that Meta Platforms, Inc. violated the constitutional right to privacy of Nigerian Facebook and Instagram users who sued the company over the collection, profiling and processing of their personal data for behavioural advertising without a demonstrated lawful basis.
In a 46-page judgment delivered on September 25, 2026, Hon. Justice A.F. Pokanu declared that Meta’s non-consensual collection, processing, profiling and use of the applicants’ personal data for behavioural advertising violated Section 37 of the 1999 Constitution, as amended, as well as provisions of the Nigeria Data Protection Act 2023. The court ordered Meta to cease unlawful processing, take remedial steps to bring its Nigerian data-processing operations into compliance within eight weeks, and pay the applicants the naira equivalent of US$100,000 in general damages, together with ₦1 million costs.
The suit, marked IKD/21116MFHR/2025, was instituted by the Incorporated Trustees of Laws and Rights Awareness Initiative, acting for and on behalf of Nigerian members using Facebook and Instagram accounts, alongside Deborah Esther Orji, Abayomi Olakunle Adebayo, Olamijulo Ayomide Ogunkilede, Kitan Bankole and Abiola Owoaje, against Meta Platforms, Inc.
The originating application, filed on January 14, 2026, was brought under the Fundamental Rights (Enforcement Procedure) Rules 2009, Section 37 of the Constitution and Sections 24, 25, 26, 27, 28, 29, 39, 41, 42 and 43 of the Nigeria Data Protection Act 2023.
The applicants sought declarations that the non-consensual collection, processing, profiling and use of their personal data for behavioural advertising violated their constitutional privacy rights; that processing without a lawful basis, including the absence of valid, informed, specific and freely given consent, contravened the NDPA; and that using their personal data for behavioural advertising without lawful justification violated the statutory principles of fairness and purpose limitation.
They further alleged that Meta failed to implement appropriate technical and organisational measures to protect their personal data, breached its transparency obligations and engaged in unauthorised cross-border transfer of their data.
They asked the court to compel Meta to stop the allegedly unlawful processing, bring its Nigerian data-processing operations into compliance with the NDPA and file an affidavit showing compliance within eight weeks.
The applicants additionally demanded the naira equivalent of US$100 million in general damages, another US$100 million in exemplary damages, post-judgment interest and other consequential orders.
In their supporting case, the applicants alleged that Facebook and Instagram collect information about users’ identities, online behaviour, preferences, interactions and metadata and use the information for behavioural advertising, including the creation of detailed profiles.
They contended that they were never clearly and adequately informed about the extent of the profiling, the logic underlying Meta’s algorithms, the risks and consequences of behavioural advertising or the international movement of their personal information.
The applicants had also relied on regulatory action taken by the Nigeria Data Protection Commission against Meta, including final orders issued in February 2025 following an investigation. The court, however, ultimately held that those regulatory orders had been compromised by a consent judgment reached in separate proceedings and therefore could not themselves form the foundation of the applicants’ cause of action. The court nevertheless proceeded to determine the applicants’ independent constitutional and statutory privacy complaints.
Meta denied liability.
The company’s case was that Facebook and Instagram are personalised, data-driven services made available to users without a financial charge and that users are informed through its Terms of Service, Privacy Policy and Cookies Policy that information will be used to provide personalised services and advertisements.
Meta maintained that users voluntarily register for Facebook and Instagram after being presented with the applicable terms and privacy policies, thereby entering into contractual relationships with the company.
It argued that the performance of contract provided a lawful basis for processing user-provided and on-platform activity data for behavioural advertising, while consent was relied upon for certain information received from third parties concerning users’ activities on third-party websites and applications.
Meta also said users were provided with tools and controls through which they could understand and adjust their advertising experience and maintained that its Privacy Policy explained international data transfers and the safeguards attached to them.
It denied breaching Section 37 of the Constitution or any other fundamental right and said it had put safeguards and risk assessments in place, including Data Processing Impact Assessments which, according to Meta, were provided to the NDPC in November 2024 and December 2025.
Meta further told the court that it does not operate a data centre in Nigeria and does not store or otherwise process personal data at a Nigerian data centre. It argued that users themselves transferred their information to Meta’s infrastructure outside Nigeria when accessing its services.
It also relied on the fact that the applicants continued using Facebook and Instagram even after commencing the action, contending that this was relevant to their contractual relationship and continued acceptance of the service.
Before considering the substance of the privacy dispute, Justice Pokanu dealt with a series of preliminary objections raised by Meta.
One objection relied on Rule 8(3) of the Rules of Professional Conduct for Legal Practitioners 2023, which prohibits a director of a registered company from appearing as an advocate for the company. Meta argued that the applicants’ counsel, who was also listed as a trustee of the first applicant, was caught by the provision.
The court rejected the argument, holding that the first applicant was an incorporated trustee and not a registered company within the meaning relied upon. Justice Pokanu further held that even where a lawyer was prohibited from representing a corporate body, the consequence would ordinarily concern the lawyer’s appearance and would not automatically render the entire action incompetent.
Meta also challenged service of the originating processes outside Lagos State on the ground that they did not carry the endorsement required by Section 97 of the Sheriffs and Civil Process Act.
The court rejected that objection as well, holding that Section 97 specifically deals with a “writ of summons” and was not applicable to an originating application commenced under the Fundamental Rights Enforcement Procedure Rules.
Another objection was that the case was essentially a data-protection dispute and not an enforceable fundamental-rights action.
Justice Pokanu disagreed, holding that the principal relief concerned the right to privacy guaranteed under Section 37 of the Constitution. The judge reasoned that the Nigeria Data Protection Act does not displace the constitutional right to privacy but gives legislative and regulatory content to that protection in the digital environment.
The court also rejected Meta’s challenge to the territorial jurisdiction of the Lagos High Court. It found that the applicants had established a sufficient connection to Lagos, including their residence in the state and the alleged processing of their personal data while they used Meta’s platforms there.
Meta further relied on contractual terms providing for disputes to be determined under foreign law and before courts outside Nigeria.
The court held that parties could not use private contractual arrangements to oust the jurisdiction of a Nigerian court over an alleged breach of constitutionally guaranteed fundamental rights.
Justice Pokanu said constitutional rights could not be contracted away merely through choice-of-law or forum clauses contained in commercial terms of service.
On the evidence, the court also rejected Meta’s objections to the affidavit supporting the case. Meta had argued, among other things, that the deponent was not a direct party and lacked sufficient knowledge of the matters contained in the affidavit.
The judge held that the deponent, described as a litigation officer of the first applicant, was an officer of the incorporated trustee and could depose to facts acquired through his involvement in the organisation and its affairs. The court also declined to strike out the substantive portions of the applicants’ affidavit as vague or inadmissible.
On Meta’s contention that the dispute had effectively been resolved through the earlier Federal High Court proceedings involving the NDPC, Justice Pokanu distinguished between the regulatory litigation and the applicants’ own claims.
The court held that the individual applicants were not parties to the settlement between Meta and the regulator and that a consent judgment could not bind persons who were not parties to it. At the same time, the court held that the applicants could not base their independent action directly on the earlier NDPC final orders because those orders had become subject to the consent judgment.
The court also rejected the argument that the applicants had waived their rights by continuing to use Facebook and Instagram.
Justice Pokanu held that the right to privacy guaranteed by Section 37 is a fundamental right and could not be treated as waived merely because a user continued using the social-media platforms about which the data-processing complaint was made.
The judge said continued engagement with Meta’s platforms did not, by itself, answer the separate question of whether particular processing of personal information was lawful.
Turning to the substantive issue, Justice Pokanu framed the central question as whether Meta had breached or was likely to breach the applicants’ right to privacy under Section 37 of the Constitution and Sections 24(1), 24(2), 24(3), 25, 27 and 41–43 of the NDPA 2023.
The court described the constitutional question presented by behavioural advertising as extending beyond whether Meta had published a privacy policy.
It asked:
“To what extent may a private technology company observe, aggregate, analyse, profile and commercially exploit the digital behaviour of a Nigerian citizen without that citizen having genuinely understood, authorised or reasonably expected that processing?”
Justice Pokanu held that the NDPA 2023 reflects many of the principles contained in the European Union’s General Data Protection Regulation and considered European jurisprudence, including decisions concerning Meta, as persuasive guidance in interpreting the Nigerian statutory framework.
The court stressed that Section 24 of the NDPA requires personal data to be processed fairly, lawfully and transparently, collected for specified and legitimate purposes, limited to what is necessary and processed securely, while imposing accountability and a duty of care upon controllers and processors.
Justice Pokanu found that behavioural advertising involves significantly more than simply displaying an advertisement based upon a user’s immediate activity. It entails the collection, tracking, aggregation and analysis of information capable of building profiles about users’ habits, interests and preferences.
The court noted that under Section 26 of the NDPA, where consent is relied upon, the burden rests on the data controller to establish that consent was actually given and that it was freely and intentionally provided.
Meta relied on copies of its Terms of Service, Privacy Policy and Cookies Policy. The court, however, found that Meta had not demonstrated how the particular applicants accepted the relevant terms.
Justice Pokanu observed that evidence capable of demonstrating electronic acceptance could include electronic signatures, clickwrap records containing timestamps and user identifiers, the version of the terms accepted, backend database logs, server logs, session records or other digital audit trails.
The court found that Meta produced no such evidence connecting the applicants individually to the terms and policies relied upon.
It further observed that the various documents tendered carried different effective dates and that Meta had not established that those were the terms actually accepted by the applicants during the relevant period.
Justice Pokanu held that consent could not simply be buried in general terms of service and that a person relying on consent must be informed of the right to withdraw it before consent is given.
The judge said consent must be clear and accessible and “must be affirmative rather than based on a pre-selected confirmation.”
The court also rejected Meta’s argument that behavioural advertising was necessary for the performance of its contract with Facebook and Instagram users.
Justice Pokanu held that advertising-related profiling, cross-platform tracking and analytics were not indispensable to providing the core services of a social-networking platform.
“They are, at best, ancillary commercial mechanisms adopted by the Respondent for revenue generation and the monetisation of user engagement,” the court held.
The judge said such processing could not become a contractual necessity simply because it supported Meta’s advertising system or profitability.
The court further rejected the contention that the fact that advertising helps finance a service offered without a direct subscription charge automatically creates a legitimate interest sufficient to justify the data processing.
Justice Pokanu held that limitations on privacy rights and data processing must be confined to what is necessary and proportionate to the legitimate purpose relied upon.
“To hold otherwise,” the judge reasoned, would permit Meta to define contractual necessity by its commercial interests rather than by what was objectively indispensable to providing the social-networking service.
On transparency, the court held that compliance involved more than placing information somewhere inside a privacy policy.
The judge said a data controller must communicate information concerning its identity, lawful basis for processing, purposes, recipients, retention periods, the rights of data subjects, the right to complain to the NDPC and the existence and consequences of automated decision-making and profiling.
The information, the court said, must be clear, concise, transparent, intelligible and accessible.
Justice Pokanu found that Meta’s privacy materials presented its behavioural-advertising architecture in a manner that an ordinary user could not reasonably understand clearly enough to meet the statutory standard.
The court therefore held that general acceptance of Facebook or Instagram terms should not automatically be treated as informed consent to advertising profiling.
On international data transfers, the court considered Meta’s acknowledgment that it had no data centres in Nigeria and that Nigerian users’ information was stored and processed in international data centres.
Justice Pokanu rejected Meta’s argument that it was technically the users themselves who transferred their data outside Nigeria by accessing Facebook or Instagram.
The judge held that a user interacting with Meta’s platform did not control the routing, transmission or storage location of the data and therefore could not properly be treated as the party effecting the international transfer.
The court described Meta as a “data controller or data processor of major importance”, having regard to its own acknowledgment that tens of millions of users in Nigeria access Facebook and Instagram.
Justice Pokanu held that the global nature of Meta’s infrastructure and the absence of Nigerian data centres did not itself constitute a lawful basis for exporting Nigerian users’ personal data.
The judge considered Sections 41 to 43 of the NDPA, which regulate transfers of personal data from Nigeria to other countries and require an adequate level of protection or satisfaction of recognised statutory conditions.
The court consequently found that the unauthorised cross-border transfer of the applicants’ personal data violated the safeguards under Sections 41–43 of the NDPA and infringed their constitutional right to privacy.
The applicants had also raised issues concerning Data Protection Impact Assessments. The court noted Meta’s assertion that it had filed DPIAs with the NDPC, but Justice Pokanu held that compelling a controller to file a DPIA with the regulator was primarily a regulatory enforcement matter for the NDPC rather than a direct remedy available to the applicants in that form.
On damages, Justice Pokanu distinguished between statutory compensation and damages arising directly from violation of the constitutional right to privacy.
The court found that the applicants had been unlawfully profiled and monitored through behavioural advertising and cross-border data transfers and held that the privacy injury arising from such conduct could not necessarily be mathematically quantified.
Justice Pokanu identified the persistence of profiling, absence of meaningful consent, difficulty of opting out, unlawful intrusion into private-life autonomy and interference with informational self-determination as relevant considerations.
The applicants had sought US$100 million as general damages, but the court considered that sum excessive and instead awarded the naira equivalent of US$100,000.
The court separately refused the applicants’ claim for another US$100 million in exemplary damages, holding that proof of an NDPA violation, without more, was insufficient to justify punitive damages.
Justice Pokanu said exemplary damages required evidence that elevated the conduct from an actionable privacy or statutory wrong to conduct sufficiently deliberate, outrageous, high-handed or contumelious to warrant punishment. The court held that the applicants had not satisfied that test and added that awarding exemplary damages in the circumstances would also amount to double compensation.
In its final orders, the court declared that Meta’s non-consensual collection, processing, profiling and use of the applicants’ personal data for behavioural advertising constituted a violation of their fundamental right to privacy under Section 37 of the Constitution.
It further declared that processing their personal data without a lawful basis, including without valid, informed, specific and freely given consent, violated Sections 24 and 25 of the NDPA.
The court declared that the use of their personal information for behavioural advertising without lawful justification violated the principles of fairness and purpose limitation and that Meta breached its duty of care by failing to implement appropriate technical and organisational measures for the protection of the applicants’ personal information.
Justice Pokanu additionally declared that Meta breached the statutory principle of transparency by failing adequately and intelligibly to inform the applicants of the nature, scope, purpose and legal basis of its data-processing activities.
The court declared the unauthorised cross-border transfer of their personal data contrary to Sections 41–43 of the NDPA and an infringement of their constitutional privacy rights.
Meta was consequently ordered to cease forthwith all unlawful processing of the applicants’ personal data, including processing for behavioural advertising without a lawful basis.
The company was further directed to take immediate remedial measures to bring its data-processing operations in Nigeria into full compliance with the Nigeria Data Protection Act 2023 and to file an affidavit of compliance within eight weeks of delivery of the judgment.
The court awarded the applicants the naira equivalent of US$100,000 in general damages, granted post-judgment interest at the prevailing Central Bank of Nigeria rate until final liquidation of the judgment debt and awarded ₦1 million as costs of the action.
The applicants were represented by Olumide Babalola, Ph.D., with H. Tofi, while Mofesomo Tayo-Oyetibo, SAN, with Lukwagh Mgbanyi, appeared for Meta Platforms, Inc.
[A MUST HAVE] Evidence Act Demystified With Recent And Contemporary Cases And Materials
Available now for NGN 40,000 at ASC Publications, 10, Boyle Street, Onikan, Lagos. Beside High Court, TBS. Email publications@ayindesanni.com or WhatsApp +2347056667384. Purchase Link: https://paystack.com/buy/evidence-act-complete-annotation
______________________________________________________________________ “Enhance Legal Practice With Authoritative Reports” — Alexander Payne Offers Comprehensive Law Reports, Spanning Over A Century Of Nigerian Jurisprudence
Interested buyers are encouraged to place their orders and enquiries via:
0704 444 4777, 0704 444 4999, 0818 199 9888
Website: www.alexandernigeria.com
