Nigeria: cookie and consent rules under the NDPA and the GAID

What are Nigeria's data protection rules?

The Nigeria Data Protection Act, 2023 (NDPA), dated 12 June 2023 and published in the Official Gazette of 1 July 2023, replaced the Nigeria Data Protection Regulation 2019 as the country's main data protection law and established the Nigeria Data Protection Commission (NDPC). Under section 61 of the Act, the Commission issued the General Application and Implementation Directive (GAID) on 20 March 2025. The Commission set 19 September 2025 as the date the GAID took effect, and from its issue the NDPC stopped applying the 2019 Regulation (GAID Article 3). Where the Act and the GAID conflict, the Act prevails.

Who does the NDPA apply to?

Section 2 applies the Act when the controller or processor is domiciled, resident or operating in Nigeria, when processing occurs in Nigeria, or when a controller or processor outside Nigeria processes personal data of a data subject in Nigeria. GAID Article 8 adds that "operating in Nigeria" includes targeting data subjects in Nigeria. A foreign website with Nigerian visitors is therefore covered. Personal data includes information that identifies a person by an online identifier (section 65), so cookie and advertising IDs fall under the Act.

Controllers and processors "of major importance" carry extra duties: registration with the NDPC, a data protection officer and compliance audits. The GAID sorts them into levels by the number of data subjects they process, with registration fees that rise with the level.

Do cookies need consent in Nigeria?

Yes, apart from necessary cookies. Article 19 of the GAID, titled "Consent to Cookies and other Tracking Tools", is one of the most specific cookie rules outside Europe:

• the use of cookies on a website or other digital platform requires consent, which must be freely given, informed and specific;
• necessary cookies, defined as those that enable core functions such as security, network stability management and accessibility, do not need a tick box, provided they do not process sensitive data, financial data or data the person stores privately;
• all other cookies require a specific selection of yes or no, or accept or reject, presented to the visitor;
• the banner must be conspicuous: visitors must not have to scroll to see it, and every tracking tool must be disclosed in the part of the page that appears first;
• the banner must explain the cookies clearly, state their presence and purpose, identify the organization responsible, and say how to withdraw consent;
• any tracking tool that works like a cookie is subject to the same rules.

GAID Article 7 adds a placement rule in the list of general compliance measures: privacy and cookie notices must be provided on the homepage, the cookie notice must let the visitor accept or decline, and it must be displayed so that it significantly obstructs the middle, left or right side of the homepage. A notice at the bottom of the page, where it may be ignored, is "tantamount to lack of transparency". A thin footer bar is therefore not enough in Nigeria; a box or modal in the main view is.

The Act sets the general consent standard. Section 25 lists six lawful bases: consent, contract, legal obligation, vital interests, public interest and legitimate interests, which are not legitimate if the person would not reasonably expect the processing. Section 26 puts the burden of proving consent on the controller, says silence or inactivity is not consent, requires consent to be affirmative and not based on a pre-selected confirmation, and requires the person to be told of the right to withdraw before consenting. Section 27 lists the information to give before collecting data, including the lawful basis, recipients, retention period and the right to complain to the NDPC. The GAID's model complaint form even lists "preselected cookies apart from necessary cookies" as a type of violation people can report.

Can personal data leave Nigeria?

Section 41 allows a transfer when the recipient is bound by a law, binding corporate rules, contractual clauses, a code of conduct or a certification that gives adequate protection, and the controller must record the basis for each transfer. Without adequacy, section 43 allows transfers with the person's consent after being told the risks, for a contract with the person, for their sole benefit, for important public interest reasons, for legal claims or to protect vital interests. Most analytics and advertising providers process data abroad, so the privacy policy should name them and the transfer basis.

What are the penalties?

After an investigation, the NDPC can order a controller to remedy the violation, compensate data subjects, account for profits or pay a penalty (section 48). The penalty can reach the "higher maximum amount", the greater of NGN 10 million or 2% of annual gross revenue in the previous financial year, for controllers and processors of major importance, and the "standard maximum amount", the greater of NGN 2 million or 2%, for others. Failing to comply with an order is an offense punishable by a fine of the same size, up to one year in prison, or both (section 49). Data subjects can also sue for damages (section 51).

The NDPC has used these powers. In August 2024 it fined Fidelity Bank NGN 555.8 million, about 0.1% of the bank's 2023 gross revenue, after finding that it processed personal data without informed consent; press reports of the findings listed cookies and the bank's app among the tools deployed in breach of the Act, and the bank disputed the decision. In July 2025 it fined MultiChoice Nigeria NGN 766.2 million for intrusive processing and cross-border transfers of subscribers' data without adequate safeguards.

How Cookiequiet fits

Nigeria is not in Cookiequiet's preset list of regulated countries, so add it to a custom country list or show the banner everywhere; geo-targeting is included on every plan, including Free. For Nigeria, choose the floating box or centred modal layout rather than the bottom bar, since the GAID wants the notice in the main view. Accept all and Reject all have the same weight on the first screen, nothing optional is pre-ticked, necessary cookies stay on, the preferences center explains each category and how to withdraw, and the consent log keeps each choice as proof. Run the cookie scanner to list the tracking tools Article 19 wants disclosed, and see the Reject all guide and pricing. Not legal advice.