In a significant ruling for data protection litigation in Nigeria, the High Court of Imo State has dismissed a fundamental rights suit in which a private individual sought US$25 million in damages from Meta Platforms Inc. over alleged privacy and data protection violations. Justice L. C. Alinnor of the Mbaitoli/Ikeduru Judicial Division (sitting in Iho) delivered the judgment on 21 July 2026, holding that the applicant failed to prove any infringement of her constitutional right to privacy or unlawful processing of her personal data.
The decision underscores the high evidentiary threshold for individual claims against global technology platforms under Nigerian law, particularly where claims lean heavily on regulatory findings that later collapse.
Background to the Suit
The applicant, Chika B. Chukwuemeka (also referred to as Chika Chukwuemeka), filed a fundamental rights enforcement action against Meta. She alleged that the company collected, processed, profiled, and used her personal data for behavioural advertising on its platforms without her consent. She claimed these actions violated Section 37 of the 1999 Constitution of the Federal Republic of Nigeria which guarantees the right to privacy and provisions of the Nigeria Data Protection Act (NDPA) 2023.
Specific complaints included processing without a lawful basis, failure to meet transparency requirements, unlawful cross-border transfer of her data, and inadequate Data Protection Impact Assessment. She sought declarations that the processing was unlawful, orders restraining further processing and compelling Meta to bring its Nigerian operations into compliance with the NDPA, an affidavit of compliance from the company, and substantial monetary reliefs—the naira equivalent of US$10 million in general damages and US$15 million in exemplary damages, plus post-judgment interest.
A central pillar of her case was reliance on Final Orders issued by the Nigeria Data Protection Commission (NDPC) against Meta in February 2025. Those orders followed an investigation into Meta’s behavioural advertising practices on Facebook and Instagram. The NDPC found widespread violations affecting more than 60 million Nigerian data subjects and imposed a remedial fee of US$32.8 million along with corrective directives.
The Collapse of the Regulatory Foundation
Meta challenged the NDPC’s Final Orders in the Federal High Court in Abuja (Suit No. FHC/ABJ/CS/355/2025). The parties reached terms of settlement, which the court adopted as a consent judgment on 3 November 2025 before Justice J. K. Omotosho. Under the settlement, the Final Orders were set aside, and the NDPC waived enforcement of the $32.8 million fee. Meta agreed to provide certain remedial measures and improve technical and organisational safeguards, but the landmark sanctions effectively fell away.
In the Imo State proceedings, Meta’s counsel, Paul Mgbeoma, successfully argued that once the NDPC orders had been set aside, they became otiose and could no longer underpin the applicant’s claim. Justice Alinnor agreed. The court further held that, even independently of the regulatory findings, the applicant had not placed sufficient evidence before it demonstrating how Meta had specifically infringed her privacy rights. The remaining allegations were characterised as “bare assertions” lacking a detailed factual basis.
The judge concluded that, with the regulatory foundation gone, “the Applicant’s case was ‘built on nothing’.” The suit was dismissed in its entirety for want of merit, with no order as to costs.
Broader Context: Data Protection Litigation in Nigeria
The NDPA 2023, signed into law by President Bola Tinubu, established a comprehensive framework for data protection, creating the NDPC and empowering both regulatory enforcement and individual fundamental rights actions. Nigeria has seen a rise in privacy suits against Big Tech, reflecting growing awareness of data rights amid widespread use of social media platforms.
This Imo decision stands in contrast to other recent cases. In January 2026, a Lagos State High Court awarded Femi Falana (SAN) US$25,000 against Meta over the publication of a false health-related video on Facebook, holding that the company breached the NDPA by processing inaccurate and harmful sensitive personal data and rejecting a pure “intermediary” defence where the platform monetises content. That case involved concrete, specific harm rather than generalised reliance on regulatory findings later withdrawn.
The Imo ruling highlights a practical reality: while the NDPA and the Constitution provide robust avenues for redress, courts demand concrete, individualised evidence of infringement. Broad allegations of platform-wide practices, even when supported by (subsequently vacated) regulatory orders, are unlikely to succeed without proof of specific impact on the claimant.
Implications
For individuals and privacy advocates, the judgment is a reminder of the evidentiary burden in fundamental rights claims against sophisticated technology companies. Successful suits will likely require detailed affidavits, technical evidence of data processing specific to the claimant, and careful timing relative to any parallel regulatory proceedings.
For Meta and similar platforms, the outcome reinforces the value of challenging regulatory orders through judicial review and negotiated settlements, while also illustrating residual litigation risk from private actions. The earlier NDPC investigation and the subsequent settlement itself generated significant public and professional debate about regulatory independence, transparency of consent judgments, and the enforceability of remedial fees under the NDPA.
For Nigerian jurisprudence, the decision contributes to the emerging body of case law interpreting the intersection of constitutional privacy rights and the NDPA. It signals that courts will scrutinise the factual underpinnings of claims carefully and will not treat vacated administrative findings as binding or sufficient proof in private litigation.
The dismissal does not close the door on future privacy claims against Meta or other platforms in Nigeria. It does, however, set a clear marker: allegations of data misuse must be substantiated with evidence that withstands independent judicial scrutiny, not merely recycled from regulatory actions that may later be compromised or set aside.
