TL;DR
- A Lagos High Court judge ruled on 25 September 2026 that Meta illegally profiled six Nigerian users for ad targeting.
- The court rejected Meta's argument that its terms of service counted as valid consent.
- Meta was ordered to pay damages equivalent to US$100,000 to the six applicants.
- Meta now has eight weeks from the ruling to prove its Nigerian data processing complies with the Nigeria Data Protection Act 2023.
A Lagos High Court judge ruled on 25 September 2026 that Meta violated the privacy rights of six Nigerian applicants by profiling them for Facebook and Instagram ad targeting without a lawful basis. The court rejected Meta's terms of service defense and ordered the company to pay damages equivalent to US$100,000, while giving Meta eight weeks to prove its Nigerian data processing complies with local law.
What the Lagos court actually decided
The case turned on a single question that comes up in almost every privacy dispute involving a large ad platform: does clicking "agree" on a terms of service screen count as consenting to have your activity profiled for advertising? According to PPC Land, six Nigerian applicants argued that Meta had processed their personal data to build behavioral ad-targeting profiles for Facebook and Instagram without a lawful basis for doing so. Meta's defense rested on the idea that users had already agreed to this processing when they accepted the platform's terms of service during sign-up.
The judge did not accept that framing. The ruling found that Meta's reliance on its terms of service did not amount to valid, specific consent for ad-targeting consent purposes, and the court held that the six applicants' privacy rights had been violated. As a result, the court ordered Meta to pay damages equivalent to US$100,000 to the applicants.
Why a terms of service defense is not the same as consent
It helps to separate two different things that often get blurred together in ad-platform disputes. The first is a contract: when someone creates a Facebook or Instagram account, they have to accept a set of terms before the platform will let them in. The second is a specific, informed agreement to a particular use of personal data, such as building a behavioral profile for ad targeting. Many privacy frameworks around the world, in various forms, draw a line between the two: accepting a platform's rules to get access to the product is not automatically the same as giving informed, specific permission for a secondary use like targeted advertising.
That is the theory the Lagos court appears to have applied. The ruling rejected the idea that a broad terms of service click-through could stand in for the kind of lawful basis that behavioral advertising normally requires. PPC Land's report does not detail the exact statutory language the judge relied on beyond naming the relevant law, so this article treats the legal reasoning at that level of generality rather than guessing at specific clauses.
This matters beyond the six named applicants because Meta's consent mechanism for ad targeting works in broadly similar ways across markets: a terms of service agreement at sign-up, paired with privacy settings a user can adjust afterward. A court anywhere rejecting the terms-of-service-as-consent argument is a reminder that regulators and judges are willing to look past the sign-up screen and ask what a user actually, specifically agreed to.
It is worth being clear about what the PPC Land report does not say, since it is easy to over-read a single ruling. The source does not state whether the court found Meta's entire ad-targeting system unlawful, or only the specific consent basis Meta cited for these six applicants. It does not name the judge, describe the applicants' occupations or how they came to file the claim together, or quote directly from the written judgment beyond the outcome. It also does not say whether Meta has commented publicly on the decision. Readers looking for those specifics should treat them as open questions rather than assume an answer either way.
The compliance clock: what Meta must do in eight weeks
Beyond the damages award, the court gave Meta a concrete deadline. The company has eight weeks from the date of the ruling to file proof that its data processing in Nigeria complies with the Nigeria Data Protection Act 2023. PPC Land's reporting does not state what happens if Meta misses that deadline, nor does it say whether Meta plans to appeal the decision, so both of those questions are not stated by the source.
It is also worth being precise about scope. The ruling applies to the claims brought by these six applicants in a Nigerian court, interpreting Nigerian law. Nothing in the source material says this decision changes Meta's ad-targeting consent process globally, and nothing in the source says it has any legal effect outside Nigeria.
The table below summarizes the core facts of the ruling as reported by PPC Land.
| Detail | What the ruling states |
|---|---|
| Court | Lagos High Court |
| Ruling date | 25 September 2026 |
| Applicants | Six Nigerian citizens |
| Meta's rejected defense | Its terms of service constituted valid consent for ad targeting |
| Damages awarded | Equivalent to US$100,000 |
| Compliance deadline | Eight weeks from the ruling to file proof of compliance with the Nigeria Data Protection Act 2023 |
What this means for Thai marketers
Thailand has its own data protection law, the Personal Data Protection Act (PDPA), which sets out its own requirements for when a business needs consent to collect, use, or disclose personal data, including for ad targeting. The Lagos ruling does not say anything about Thailand, PDPA, or Thai enforcement, and it would be inaccurate to suggest otherwise. What the ruling does illustrate, in a general sense, is a question that any business running Facebook, Instagram, or Google ad campaigns in Thailand should be able to answer for its own account: what is the actual legal basis for the audience data you are using to target ads, and is a generic terms-of-service acceptance doing more work in that answer than it should be?
For a Thai business running Meta Ads, Google Ads, or any platform that profiles users for targeting, the practical takeaway is not to panic about a Nigerian court case, but to treat it as a prompt. Check how your own consent banners, cookie notices, and data collection forms are worded. Confirm with qualified legal counsel whether your current setup matches what PDPA actually requires for your specific use of customer or visitor data, rather than assuming that a standard terms-of-service checkbox covers everything. This is advisable regardless of what happens in Nigeria, since PDPA enforcement in Thailand has its own separate timeline and priorities.
In practice, a quick internal check usually covers the same ground a consent dispute like this one raises. Look at whether your website's cookie or consent banner actually names ad targeting as a purpose, separate from basic analytics or site functionality, and whether a visitor can decline ad-related tracking without losing access to the site. Look at whether your Meta pixel or Conversions API setup, and any customer list you upload for lookalike or custom audiences, has a documented basis for that specific use under PDPA, not just a general privacy policy link in the footer. None of this is a response to the Nigerian case specifically, since PDPA already requires it independently, but a news story about a court rejecting a terms-of-service defense is as good a prompt as any to confirm the paperwork actually matches what the account is doing.
Relevant Audience manages Facebook Ads and Google Ads accounts for Thai and regional clients, and consent and data-handling questions come up as part of account setup and audits. None of that changes the fact that this specific news item is about a Nigerian court ruling, not about Thai law or Thai enforcement. A court decision thousands of kilometers away does not rewrite PDPA, but it is a reasonable occasion to ask whether your own account's paperwork would hold up if someone asked the same question a Nigerian court just answered.
FAQ
Did Meta admit it did anything wrong?
Not stated by the source. PPC Land reports that the court rejected Meta's defense and ruled against the company, but the article does not say whether Meta issued any admission or statement accepting fault.
Is this ruling live in Thailand, or does it affect Meta's operations there?
Not stated by the source. The ruling concerns six Nigerian applicants and Nigerian law, and the source material does not mention Thailand, PDPA, or any effect on Meta's operations outside Nigeria.
What exactly was Meta's defense that the court rejected?
Meta argued that its terms of service, which users accept when creating a Facebook or Instagram account, constituted valid consent for the company to profile them for ad targeting. The Lagos High Court rejected that argument.
What happens if Meta does not meet the eight-week compliance deadline?
Not stated by the source. PPC Land's report describes the eight-week deadline to file proof of compliance with the Nigeria Data Protection Act 2023, but does not describe any specific consequence for missing it.
Does this ruling change how Meta asks for consent everywhere?
Not stated by the source. The report covers a single Nigerian court decision tied to six applicants, and does not describe any global change to Meta's consent mechanisms or ad-targeting settings for other markets, including Thailand.
If you run paid social or search campaigns and want a second set of eyes on how your audience targeting and consent setup fits together, Relevant Audience's Facebook Ads and Google Ads services include an account review as part of onboarding.
