Meta and WhatsApp hit with $220M fine in Nigeria over major data privacy violations and discriminatory practices.
The Competition and Consumer Protection Tribunal in Nigeria has upheld a $220 million fine against Meta Platforms Inc. (Facebook) and its subsidiary WhatsApp LLC for data privacy violations and discriminatory practices impacting Nigerian users. The ruling follows a lengthy 38-month joint investigation by the Federal Competition and Consumer Protection Commission (FCCPC) and the Nigeria Data Protection Commission (NDPC). The investigation began four years ago and uncovered lapses in how the companies handled user data and consent.
The FCCPC and NDPC probe found that Meta and WhatsApp engaged in unauthorized data sharing practices, failed to secure proper user consent, and treated Nigerian users unfairly compared to users in other regions. Meta and WhatsApp appealed the FCCPC’s decision, arguing a lack of jurisdiction and claiming an unfair hearing. However, the three-member tribunal, led by Thomas Okosun, rejected their arguments.
In its final judgment, the tribunal upheld the $220 million penalty and imposed an additional $35,000 payment to cover the FCCPC’s investigative costs. Meta and WhatsApp must comply within 60 days from April 30, 2025. Beyond financial penalties, the tribunal directed Meta to update its applications to restore full user control and explicitly stop unauthorized data sharing, reverting to the company's 2016 data-sharing policy for Nigerian users.
FCCPC Executive Vice Chairman Tunji Bello welcomed the tribunal's ruling, stating the significance of the decision: "This is a watershed moment for consumer protection in Nigeria. The Tribunal’s ruling reinforces our authority and validates the hard work our team has put into defending the rights of Nigerian consumers,” he said, commending the diligence and advocacy of the legal teams involved.
The tribunal’s decision sends a strong message about the growing global emphasis on data privacy and consumer protection, especially in emerging markets like Nigeria. As more countries strengthen their data protection frameworks, multinational companies will face increasing pressure to comply with local regulations. Failure to do so could result in substantial penalties, reputational damage, and tighter scrutiny across international markets. The ruling also marks a milestone for Nigeria's enforcement agencies, solidifying their role in holding powerful tech companies accountable to national laws.
The complexity of cross-border data handling, legal challenges, and the need to gather extensive technical evidence contributed to the prolonged investigation.
Nigerian users should regain greater control over their personal data, with Meta required to update its apps and restrict unauthorized data sharing.
While appeals are possible under Nigerian law, the companies must comply with the tribunal’s orders within the 60-day deadline unless a higher court intervenes.
Meta must revert to its 2016 data-sharing practices for Nigerian users, ensuring no automatic sharing of WhatsApp data with Facebook or third parties without explicit consent.