A Nigerian who believes that a social-media platform has unlawfully profiled her faces an awkward legal demand. She must tell a court what happened to her personal information. Yet the records most likely to establish the answer, including account-level processing logs, the operative version of an advertising policy and the basis asserted for a particular data flow, may be held by the very company she is suing.

Two recent cases against Meta Platforms bring that difficulty into view.

In Chika Chukwuemeka's claim before the Imo State High Court, Justice L. C. Alinnor dismissed a privacy and data-protection action on 21 July 2026. According to reports published on 28 September, the applicant had relied substantially on final orders previously issued by the Nigeria Data Protection Commission (NDPC). Those orders had been set aside following a settlement between Meta and the regulator. The court found that the applicant had not independently established a specific infringement of her rights. She had sought the naira equivalent of US$25 million. The Guardian's report and TheCable's account set out the ruling.

On 25 September 2026, a different court reached a different result. In Incorporated Trustees of Laws and Rights Awareness Initiative and Others v Meta Platforms, Inc., suit IKD/21116MFHR/2025, Justice A. F. Pokanu of the Lagos State High Court held that Meta had unlawfully processed the applicants' personal data for behavioural advertising and infringed their privacy rights. The court awarded the applicants the naira equivalent of US$100,000 in general damages, plus ₦1 million in costs, and made orders addressing unlawful processing and compliance. Meta filed a notice of appeal on 30 September, according to a 7 October case report. The reported judgment is available online, and a detailed account of the decision describes the parties' arguments and the court's reasoning.

The tempting account is that one court protected privacy and the other failed to do so. It is also the wrong starting point. These were different claimants, different records and different proceedings. Neither result establishes a final nationwide rule; the Lagos decision is under appeal. The more productive question is why two claims concerning similar forms of platform processing could encounter such different evidential fortunes.

My argument is that Nigeria's next major privacy-law challenge is evidential design. The Nigeria Data Protection Act 2023 has supplied substantial legal standards. What remains underdeveloped is a reliable route by which individuals can establish a prima facie case, controllers can be made to substantiate their asserted lawful bases, courts can obtain proportionate technical evidence, and regulatory settlements can coexist with independent private claims. A right that is practically impossible to prove is weaker than its statutory language suggests. Equally, a right that dispenses with proof becomes arbitrary enforcement.

A settlement cannot do the claimant's evidential work

The Imo judgment is a useful corrective to the idea that an adverse regulatory finding should settle every subsequent private claim. The NDPC had previously made findings and orders against Meta over behavioural advertising. Meta challenged the action in the Federal High Court in Abuja. The parties later settled, and the court adopted the settlement as a consent judgment in November 2025. The original regulatory orders were set aside. BusinessDay reported the settlement.

A private claimant cannot simply treat a set-aside order as if it remains an operative finding. That was a substantial difficulty in the Imo case. There is no compelling reason to say that the trial judge should have preserved the legal effect of an order that no longer stood. The court also examined the remaining material and concluded that it was insufficient to prove how the applicant's own privacy had been infringed.

The Lagos case exposed the other side of the same problem. According to the detailed account of the judgment, Justice Pokanu also declined to let the applicants found their claim directly on the displaced NDPC orders. He nevertheless considered their independent constitutional and statutory complaints. The fact that the individuals were not parties to the regulatory settlement was relevant to the court's refusal to treat that settlement as disposing of their own rights.

This distinction deserves attention beyond Meta. Regulators often have reasons to settle: securing corrective commitments quickly, avoiding expensive litigation, allocating scarce enforcement resources or obtaining cooperation that a prolonged dispute might frustrate. Settlement may be a responsible exercise of public enforcement discretion. It need not, and ordinarily should not, be equated with a judicial determination that no individual suffered a wrong.

Yet private enforcement should not depend on salvaging a regulator's earlier findings after they have been superseded. Claimants need admissible evidence of their own. Public regulators should, in turn, consider what can lawfully be disclosed about resolved investigations without compromising confidential data, legitimate commercial secrecy or the incentives to cooperate. The absence of a clear interface between public enforcement and private litigation leaves each side carrying too much weight.

What the Act actually requires a controller to prove

The Nigeria Data Protection Act 2023 is more specific than a general promise of privacy.

Section 24 requires personal data to be processed fairly, lawfully and transparently, for specified and legitimate purposes, with limits on unnecessary collection and retention. It also imposes a duty of care and an obligation to demonstrate accountability. Section 25 lists lawful bases for processing. These include consent, processing necessary for a contract, compliance with a legal obligation, protection of vital interests, public tasks and legitimate interests subject to important limitations. Consent is not mandatory for every lawful processing operation, and an allegation that consent is missing does not automatically establish unlawfulness if another lawful basis genuinely applies.

Section 26(1) goes further on one defined question: the data controller bears the burden of proving that the data subject consented. The same section makes clear that silence or inactivity is not consent, and requires attention to whether a service was improperly conditioned on consent to unnecessary processing. This is a real statutory allocation of proof. It is not, however, a general presumption that all processing is unlawful whenever a defendant cannot produce a click-record.

The Lagos ruling, as reported, turned partly on Meta's failure to connect the relevant applicants to particular versions of its terms and consent arrangements. The court reportedly identified account-linked evidence that could have assisted: dated acceptance records, relevant policy versions, logs and other electronic audit trails. Producing a current privacy policy is not the same as proving which policy a particular user saw, when it took effect or whether a disputed form of processing was covered by valid consent.

Contractual necessity presents a different inquiry. A platform may reasonably say that it needs certain account data to authenticate a user, maintain a session or deliver a requested feature. It does not follow that behavioural tracking across services is necessary merely because personalised advertising finances a free-to-use business model. The Lagos court rejected that equation on the facts before it. The question is objective necessity for the service, not commercial usefulness to its operator.

But the limits run in both directions. The fact that behavioural advertising is controversial does not relieve claimants of identifying the processing complained of. Nor may a court collapse distinct lawful bases into one undifferentiated test of user agreement. If a controller relies on legitimate interests, the relevant task is to assess that claim against section 25, including the data subject's reasonable expectations and the relationship between the processing and the person's rights. If it relies on consent, section 26's express burden applies.

A mature privacy jurisprudence will need to preserve these distinctions even when the defendant is a powerful platform.

Proof is unevenly distributed

The asymmetry is not simply that one party is richer. It follows from the architecture of digital advertising.

A user can show that an account exists, that personalised advertisements appeared and that certain disclosures were received. The service operator may control the account history, the ad-delivery record, event tracking, third-party signals, the version of each privacy notice, the asserted legal basis for a processing operation and the record of any consent withdrawal. A claimant may not know which of those records are material until a disclosure process reveals them.

The Act contains a partial answer. Section 34 gives a data subject a right to obtain information about the processing of their data, including its purposes, categories, recipients, retention information, source information where applicable and certain information concerning profiling. It also provides for a copy of their personal data, subject to statutory conditions. Section 36 gives a particularly direct right to object to processing for direct marketing, including profiling related to that marketing. Where a data subject objects to processing for direct marketing, the Act requires that processing for that purpose to stop.

These are substantive rights, not general-purpose litigation discovery powers. An access response will not necessarily reveal proprietary ranking weights, source code or every inference in an advertising system. It may nonetheless help a claimant identify what information the controller says it holds and the reasons it gives for using it. Refusals, evasive explanations, conflicting policy versions and missing historical records can themselves sharpen the evidential dispute.

The institutional answer cannot be to require an ordinary claimant to reverse-engineer a global advertising platform. Nor should a court treat a plausible description of the industry as conclusive evidence about a particular person's account.

A more disciplined approach would proceed in stages. The claimant should identify an individualised interference supported by the information reasonably available to them. The controller should then substantiate any consent on which it relies, as section 26 already requires, and particularise its alternative lawful bases where invoked. Relevant documents and logs should be preserved and sought using the disclosure and evidential procedures applicable to the case. Technical experts can help courts distinguish what is inferable from ordinary user experience from what requires internal records. A court should draw adverse inferences only where the applicable law and the evidence warrant them, not as an automatic sanction for technological complexity.

That proposal is procedural, not a claim that the NDPA itself has created a universal reversal of the burden of proof. It would make existing rights and accountability obligations more workable without converting civil litigation into a presumption of platform guilt.

The constitutional route is powerful, and dangerous if overextended

The Lagos applicants invoked section 37 of Nigeria's 1999 Constitution, which protects privacy, alongside the NDPA and the Fundamental Rights (Enforcement Procedure) Rules 2009. The court accepted that the claim was, in substance, about constitutional privacy, not merely an attempt to relabel a routine statutory compliance issue as a fundamental-rights action. The court also rejected reliance on foreign forum-selection clauses to defeat the local constitutional claim, according to the judgment reports.

There is a defensible constitutional argument here. Persistent, opaque profiling can interfere with the private life of an identifiable person even where the resulting advertisement looks harmless. Privacy can be impaired by observation, classification and loss of control over personal information, not only by public disclosure of secrets.

The difficulty is defining the threshold. Not every defect in a retention schedule or notice automatically produces a constitutional injury. If the constitutional claim swallows every technical breach of the NDPA, courts could turn a wide regulatory code into an unpredictable damages jurisdiction without explaining the connection between the conduct and section 37. A right designed to protect human dignity and autonomy risks becoming a procedural shortcut.

The Lagos damages award illustrates both the opportunity and the unresolved question. The court reportedly rejected the much larger claims for general and exemplary damages, awarded US$100,000 equivalent in general damages to the applicants, and declined exemplary damages for want of the additional showing it considered necessary. The amount is not a statutory tariff, not an award to every Nigerian Meta user, and not a final appellate measure of injury.

European law provides a useful comparative warning, although it does not determine the Nigerian constitutional question. In Österreichische Post, C-300/21, the Court of Justice of the European Union held that a GDPR infringement alone does not entitle a claimant to compensation under Article 82: damage and causation must also be established, although non-material harm need not cross a minimum seriousness threshold. Nigeria's constitutional-remedy framework is different. The comparative lesson is methodological: courts should explain the harm and the legal basis for a remedy rather than allowing the size of the defendant or the gravity of the regulatory issue to do that work.

A right against profiling is not a demand for local data centres

One feature of the Lagos litigation may have consequences beyond advertising. Meta reportedly argued that users transmitted data to infrastructure outside Nigeria by accessing its services and that it operated no Nigerian data centre. The court rejected the premise that users controlled the location or routing of Meta's processing infrastructure, and found breaches of the relevant cross-border-transfer safeguards in the applicants' case.

The NDPA does not impose a general requirement that every Nigerian's personal data be stored in Nigeria. Sections 41–43 establish conditions for lawful cross-border transfers, including adequate protection through recognised legal or contractual mechanisms and specified alternative conditions. Section 41 also requires the basis for a transfer to be recorded. Whether a particular transfer meets those requirements is an evidential and legal question.

Treating the Lagos decision as a judicial command for universal data localisation would be a mistake. Local hosting can have legitimate security, resilience or jurisdictional advantages in particular sectors. It can also increase costs, concentrate infrastructure risk and leave questions of access, onward transfer and effective remedies unanswered. A server in Lagos is not, merely by its location, proof of fair processing. A transfer abroad is not unlawful merely because it crosses a border.

This is where African regulatory autonomy needs to be more exacting than slogans about data sovereignty. The serious aim is enforceable jurisdiction over processing and effective protection after transfer. That requires credible records of transfer mechanisms, regulator-to-regulator cooperation, accessible complaints, enforceable court orders and an ability to investigate firms whose material systems operate outside Nigeria. Localisation may sometimes be a tool. It is not a substitute for these institutions.

What the European comparison does, and does not, show

The Lagos court reportedly drew on European data-protection reasoning. That is unsurprising: the Nigerian Act shares several organising principles with the GDPR. The Court of Justice's decision in Meta Platforms v Bundeskartellamt, C-252/21, for example, treated broad cross-service data combination and the proposed lawful bases with considerable scepticism, while preserving the need to assess specific processing operations and legal grounds.

The cases cannot simply be transplanted. The European dispute arose in its own institutional setting, including a competition authority assessing processing under the GDPR and a system of specialised data-protection supervision. Nigeria has its own statute, constitutional privacy protection, procedural law and institutional distribution of enforcement powers. The analogy is strongest when it directs a Nigerian court to ask a more precise question. It is weakest when it is offered as the answer itself.

There is also an accountability risk in excessive reliance on foreign litigation. If the persuasive core of a Nigerian privacy judgment is always what a European court previously said about a global platform, Nigeria's own body of evidence, regulatory expertise and judicial reasoning develops slowly. Transnational learning is valuable; regulatory dependency is not.

The NDPC should be a source of Nigerian institutional knowledge, not merely a producer of fines that become unusable after settlement. It can develop guidance on historical proof of consent, records of advertising purposes and retention, adequacy of cross-border-transfer documentation and preservation of evidence relevant to contested processing. If particular classes of claims repeatedly founder because essential records are inaccessible, that should inform procedural reform and regulatory investigative priorities.

The next case will test the system, not only the statute

The strongest objection to an evidence-sensitive approach is that it may burden lawful businesses with expensive preservation, disclosure and technical testimony whenever someone alleges that a complex service profiles them. That objection is serious. Unrestricted discovery can expose other users' personal data, compromise security, disclose trade secrets and make smaller firms disproportionately vulnerable to litigation costs. Courts are not forensic laboratories, and an attractive rights-based theory does not justify ignoring those constraints.

Proportionality offers a better answer than either blanket secrecy or unlimited inspection. Requests should be tied to identified processing, relevant time periods and specific contested facts. Where confidentiality is justified, courts can consider protective handling, redaction, expert review and limited disclosure under applicable procedure. A firm's size or technical complexity may explain why a particular safeguard is needed. It should not, without more, excuse the absence of auditable records supporting a legal claim the firm has chosen to make.

For organisations, the practical implication is straightforward. Maintain versioned privacy notices, account-linked consent and withdrawal records where consent is the lawful basis, documented assessments for other bases, intelligible records of processing purposes, and defensible transfer documentation. For claimants and advisers, focus on a specific person's data and relevant time period; use statutory access and objection rights; distinguish what can be established independently from what must be requested through procedure. For regulators, treat publication of reasoned enforcement outcomes and the evidential consequences of settlement as part of effective supervision, while respecting lawful confidentiality.

For courts, neither the Imo nor the Lagos case should be reduced to a referendum on whether Nigerians have privacy rights. The Act already says they do. A more demanding question follows: how should the justice system respond when the person who must prove interference can see only the service's outward behaviour, while the company asserting lawful processing controls the historical record?

A court that ignores that imbalance may protect rights in theory while making them inaccessible in practice. A court that resolves every evidential doubt against the platform may undermine the legal discipline on which credible enforcement depends. Nigerian privacy law will mature through the harder work between those extremes.