Any website that serves visitors in Nigeria needs opt-in consent before it sets analytics, advertising or other non-essential cookies. The rule comes from the Nigeria Data Protection Act 2023 (NDPA) and Article 19 of the General Application and Implementation Directive (GAID) 2025, which took effect on 19 September 2025. Both replaced the old Nigeria Data Protection Regulation (NDPR) of 2019, so an "NDPR cookie banner" today has to meet the NDPA and GAID: a banner visitors see without scrolling, "accept" and "reject" options, and a way to withdraw consent.
Nigeria's data protection framework: from NDPR to NDPA
Nigeria signed its first comprehensive data protection law on 12 June 2023. The Nigeria Data Protection Act (NDPA) replaced the earlier Nigeria Data Protection Regulation (NDPR) of 2019, elevating data privacy from a regulatory instrument to a full Act of the National Assembly.
Enforcement sits with the Nigeria Data Protection Commission (NDPC), an independent body headed by National Commissioner Dr Vincent Olatunji. The NDPC has the power to investigate complaints, conduct audits, issue compliance notices, and impose financial penalties. Its official website is ndpc.gov.ng.
For website owners, the practical rules around cookies and tracking technologies sit inside the NDPC's General Application and Implementation Directive (GAID) 2025, issued on 20 March 2025 and effective from 19 September 2025. From that date, the NDPR and its 2020 implementation framework stopped applying. The GAID spells out how cookie banners must behave on sites that process data from Nigerian users.
Who the NDPA applies to
The NDPA applies to any organisation - Nigerian or foreign - that processes the personal data of individuals located in Nigeria. Section 2 of the Act sets out an extraterritorial scope similar to the GDPR's.
If your website uses analytics cookies, advertising pixels, or session trackers and receives traffic from Nigeria, the NDPA applies to you. The test is not where your servers sit but where your users are.
How the NDPA defines lawful processing
The NDPA recognises six lawful bases for processing personal data: consent, contractual necessity, legal obligation, vital interests, public interest, and legitimate interests. This mirrors the GDPR's approach under Article 6.
For cookies, though, consent is the primary lawful basis. Article 19(2) of the GAID states that the use of cookies on a website or other digital platform requires consent, and Article 19(3) adds that the consent must be freely given, informed and specific.
Necessary cookies are the exception. The GAID defines them as cookies that enable core functionality such as security, network stability management and accessibility, and they need no tick box provided they do not process sensitive data, financial data or data a visitor stores privately.
Cookie banner rules under the GAID 2025
Article 19 of the GAID sets out specific requirements for cookie banners on websites and digital platforms serving Nigerian users, and Article 7 adds a rule on where the notice goes. The rules are more prescriptive than many website owners expect.
Banner placement and visibility
Article 19(7)(a) says a visitor "shall not be required to scroll to any part of a website before seeing the cookie banner". Article 7(l) goes further: the cookie notice should obstruct the middle, the left or the right side of the homepage, and a notice at the bottom of a page, where it may be ignored, "is tantamount to lack of transparency". This is stricter than most European DPA guidance on cookie banner placement.
Required information
Your banner must explain what cookies are used and why, identify the organisation deploying or managing the cookies, and describe how users can withdraw consent at any time.
Accept and reject options
The GAID requires that visitors be presented with a specific selection of "yes or no" (or "accept" / "reject") options. Pre-ticked boxes, implied consent through continued browsing, and silence or inactivity do not constitute valid consent. These provisions align with the EU's stance against dark patterns in cookie banners.
Consent withdrawal
Section 35 of the NDPA gives data subjects the right to withdraw consent at any time. The process for withdrawal must be as easy as the process for giving consent.
NDPA and GDPR: the differences that matter for cookies
Website owners already familiar with the GDPR's cookie rules will find the NDPA conceptually similar but with notable differences in detail.
| Requirement | GDPR / ePrivacy Directive | NDPA / GAID 2025 |
|---|---|---|
| Consent standard | Freely given, specific, informed, unambiguous | Freely given, informed, specific (Article 19(3) GAID) |
| Banner placement | No fixed position mandated by most DPAs | Visible without scrolling. A bottom-of-page notice counts as a lack of transparency |
| Reject option | Required (equal prominence per EDPB/CNIL) | Required - explicit "yes or no" selection |
| Strictly necessary exemption | Yes - no consent needed | Yes - but must not process sensitive or financial data |
| Maximum penalty | Up to 20 million EUR or 4% of global turnover | NGN 10 million or 2% of annual gross revenue, whichever is higher, for data controllers of major importance, NGN 2 million or 2% for others |
| Supervisory authority | National DPAs (CNIL, ICO, etc.) | NDPC (Nigeria Data Protection Commission) |
| Extraterritorial scope | Yes - applies to non-EU processors | Yes - applies to non-Nigerian processors |
The penalty ceiling is lower than the GDPR's, but the NDPC has started to use it, and its notices now reach whole sectors rather than single companies.
Enforcement: what the NDPC has done so far
The NDPC moved from an advisory posture to active enforcement in 2024 and 2025. In July 2025, it fined Multichoice Nigeria NGN 766.2 million for intrusive and disproportionate processing of subscriber data and for transferring personal data out of the country without authorisation.
On 18 February 2025, the NDPC fined Meta Platforms USD 32.8 million over behavioural advertising on Facebook and Instagram. Meta challenged the fine in the Federal High Court in Abuja, and the two sides settled out of court in late 2025. A separate USD 220 million penalty against Meta and WhatsApp came from a different regulator: the Federal Competition and Consumer Protection Commission (FCCPC) imposed it on 19 July 2024, and the Competition and Consumer Protection Tribunal upheld it in April 2025.
On 25 August 2025, the NDPC sent compliance notices to 1,368 organisations, mostly banks and other financial institutions, insurance brokers and gaming companies. Each had 21 days to show its 2024 compliance audit return, its Data Protection Officer, its security measures and its registration with the Commission. Organisations that failed to respond faced investigation and potential sanctions. This signals that the NDPC is not limiting enforcement to large multinationals.
Checklist for websites with Nigerian visitors
Use this checklist to bring your site in line with the NDPA and GAID 2025 requirements.
Audit your cookies - run a cookie scan to identify every cookie and tracker on your site, including third-party ones like
_gaand_fbp.Categorise cookies correctly - separate strictly necessary cookies (for example
PHPSESSID) from analytics, marketing, and functional cookies. See the Kukie.io cookie categories guide for details.Place the banner where it cannot be missed - in the first visible section of the page, with clear accept and reject buttons.
Block non-essential cookies before consent - scripts like Google Analytics and Meta Pixel must not fire until the visitor opts in.
Provide a withdrawal mechanism - let visitors change their preferences at any time through a persistent settings link.
Publish a cookie notice - your cookie policy must state what cookies you use, their purpose, the deploying organisation, and how to withdraw consent.
Keep records - the NDPA places the burden of proof on data controllers to demonstrate that valid consent was obtained.
Register with the NDPC - data controllers of major importance (processing data of more than a prescribed threshold of data subjects) must register with the Commission and file annual compliance audit returns.
How Nigeria compares with other African privacy laws
Nigeria is not the only African country tightening its data protection rules. South Africa's POPIA, Kenya's Data Protection Act 2019, Ghana's Data Protection Act 2012 and the personal data protection law in Egypt all impose consent-based obligations on cookie use. If your website serves audiences across the continent, a consent platform with region rules lets you set the banner each jurisdiction expects, and the global compliance hub summarises the rules country by country.
Quick answers on Nigerian cookie rules
Does the NDPA apply to websites based outside Nigeria?
Yes. The NDPA has extraterritorial scope. Any organisation processing personal data of individuals in Nigeria must comply, regardless of where the organisation is incorporated or where its servers are located.
Are analytics cookies like Google Analytics exempt from consent in Nigeria?
No. Only necessary cookies are exempt. Analytics cookies such as _ga require opt-in consent before they are placed on a visitor's device.
Where must I place my cookie banner under the GAID 2025?
Visitors must see the banner without scrolling. The GAID says a cookie notice at the bottom of a page, where it may be ignored, amounts to a lack of transparency.
What fines can the NDPC impose for non-compliance?
Data controllers of major importance face up to NGN 10 million or 2% of annual gross revenue, whichever is higher. Other controllers face up to NGN 2 million or 2%. The NDPC fined Multichoice Nigeria NGN 766.2 million in July 2025.
Do I need to register with the NDPC as a data controller?
Data controllers of major importance - those processing personal data above a prescribed threshold - must register with the NDPC and file annual compliance audit returns. Smaller operators should still meet the consent and transparency requirements of the NDPA.
Is the NDPA the same as the NDPR?
No. The NDPR was a regulation issued in 2019 by NITDA. The NDPA, signed into law on 12 June 2023, replaced it as an Act of the National Assembly, and the GAID 2025 ended the NDPR's application from 19 September 2025.
Show Nigerian visitors a banner they cannot miss
A scan shows every cookie your site sets and which ones need consent. Kukie.io keeps that list current, blocks trackers until visitors opt in, and logs every choice for your records.
