Online safety & content laws in Nigeria (2026)

The Nigerian Communications Commission released a draft Code requiring online platforms and Internet Access Service Providers to adopt NCC-approved community rules, file bi-annual compliance reports, designate a liaison for harmful content, and implement default parental controls for minors. It marks the NCC's formal assertion of jurisdiction over digital platforms beyond traditional telecoms licensing.

NITDA published a White Paper proposing a comprehensive Online Harm Protection (OHP) Bill to address misinformation, algorithmic bias, surveillance capitalism, and child safety risks. The Bill proposes four new institutions: an Online Harm Protection Centre, a Multi-Stakeholder Council, an Independent Oversight Forum, and a Redress Panel for users to contest harmful platform decisions.

President Tinubu signed amendments to the 2015 Cybercrime Act expanding surveillance powers — allowing security agencies to intercept communications without a court order in 'urgent' cases — extending telecom data-retention obligations, criminalising 'false or misleading' online posts, and imposing a 72-hour cyber-incident reporting duty. Civil-society groups warned the broad speech provisions risk being weaponised against journalists and activists.

President Tinubu signed the Nigeria Data Protection Act 2023, elevating data protection from a regulatory instrument to a full statute and establishing the Nigeria Data Protection Commission (NDPC) as the dedicated regulator. The Act introduced GDPR-aligned data-subject rights, mandatory registration for significant-importance data controllers, and strict restrictions on cross-border data transfers.

Drawing directly on lessons from the Twitter ban, NITDA finalised its Code of Practice for Interactive Computer Service Platforms and Internet Intermediaries. It obligates social media and internet intermediaries operating in Nigeria to implement content moderation, cooperate with lawful-interception requests, maintain user-complaints mechanisms, and register locally — bringing major platforms under Nigerian regulatory oversight for the first time.

The ECOWAS Community Court of Justice ruled that the seven-month Twitter suspension violated freedom of expression and access to information guaranteed under the African Charter on Human and Peoples' Rights and the UN Charter. The Court ordered Nigeria to pay litigation costs and take legislative steps to prevent recurrence — a landmark regional human-rights check on government internet shutdowns.

After 222 days, Nigeria restored Twitter access on conditions including the platform registering as a Nigerian corporate entity, appointing an in-country representative, paying applicable taxes, and complying with the Broadcasting Code and NCC regulations. The conditions set a template for how Nigeria would subsequently regulate all major foreign digital platforms.

President Buhari's administration indefinitely suspended Twitter after the platform deleted a presidential tweet seen as inciting violence. ISPs were ordered to block the service, and the federal government threatened criminal prosecution of users who accessed it via VPN. The ban drew condemnation from the US, EU, UK, Amnesty International, and ECOWAS, and triggered Nigeria's first serious national debate on platform governance.

NITDA issued the NDPR — Nigeria's first comprehensive data-protection framework, modelled on the EU GDPR. It established lawful-basis requirements for personal-data processing, data-subject rights, breach-notification obligations, and mandatory annual data-protection audits, applying to any entity processing data of Nigerian residents regardless of where the processor is based.

Nigeria's first standalone cybercrime statute criminalised hacking, identity theft, cyberstalking, cyber-terrorism, and online fraud, and mandated ISPs, telecoms, and financial institutions to cooperate with law enforcement and the ng-CERT. The Act established the procedural and institutional foundations of Nigeria's entire cyber-law framework and remained the primary instrument until its 2024 amendment.

Act No. 28 of 2007 placed NITDA's operations (which had begun informally in 2001) on a firm statutory footing, granting the agency authority to plan, coordinate, standardise, and regulate IT development and internet services in Nigeria. This Act became the direct legal basis for the NDPR 2019 and the Code of Practice for online platforms in 2022.

The foundational statute signed by President Obasanjo created the Nigerian Communications Commission (NCC) as an independent regulator with authority over all communications networks and services, including internet infrastructure. Its licensing, spectrum management, and enforcement powers form the base layer of Nigeria's online-governance architecture and underpin the NCC's later moves into platform regulation.