When an AI-generated video used Femi Falana’s face and a cloned version of his voice to claim he had suffered from prostatitis for sixteen years and to sell unproven health products off the back of that lie, it drew millions of views on a Facebook page before Meta took it down. But who should be held responsible? A Nigerian high court decided Meta was liable.
For years, in Nigeria, people harmed by falsehoods have historically turned to defamation law to hold people accountable. But as falsehoods moved online, the limitations of defamation law became apparent. Global technology companies have routinely argued that they merely host what other people post; they don’t write it or publish it. Although Nigeria has no law like the United States’ Section 230, which explicitly shields platforms from liability for what users post, the question of whether a platform can be held responsible for harmful content has largely been left to legal principles never designed with algorithms, deepfakes, or viral distribution in mind.
The law has not changed, but the approach to holding platforms accountable is changing. A small but growing number of Nigerian lawyers, faced with the practical limits of defamation cases, have begun reframing platform harms as privacy and data protection violations instead. At the High Court level, judges are not choosing a new direction on their own; they can only rule on the arguments before them. What we’re seeing isn’t so much a court-led revolution as a lawyer-led one, with judges responding to the specific theories now being put before them. In taking this approach, lawyers are forcing the courts, case by case, to interpret existing statutes in ways that gradually pull a slow-moving legal system toward digital-era realities.
Why Defamation Stopped Being Enough
To understand why lawyers made this shift, it helps to know what defamation actually demands. To win a defamation case in Nigeria, a claimant typically has to prove several things at once: that the statement was published, that it clearly referred to them, that the publisher acted with malice, and that it caused measurable harm. Although defamation is a civil claim, where the standard of proof is lower than in criminal cases, Nigerian courts have set a very high bar for proving it in practice.
That’s a hard bar to clear at the best of times. It becomes nearly impossible in cases involving anonymous social media accounts, AI-generated content, or posts that spread through automated recommendation systems rather than a single identifiable “publisher.” Tracking down who created a deepfake, or proving a platform acted with malice when an algorithm, not a person, decided to keep showing a video to millions of users, can take years, if it’s possible at all. Platforms have used this evidentiary maze to their advantage, arguing they are neutral intermediaries with no real hand in what gets shown to whom.
The Alternative: Data Protection Law
This is where Nigeria’s Data Protection Act (NDPA), passed in 2023, has proved useful in ways its drafters may not have fully anticipated.
Instead of asking a court to prove that a platform published something maliciously, the NDPA asks a much narrower question: did the platform unlawfully process someone’s personal data? Falana’s case shows what that looks like in practice: his cloned voice and altered image were themselves his personal data, and Meta kept that data circulating even after he complained. “Processing” is defined broadly in the Act to cover exactly that kind of activity not just collecting data, but organising it, adapting it, and making it available to others, which is also, not coincidentally, what a recommendation algorithm does every time it decides what to show you.
This matters beyond one lawsuit involving one famous lawyer. The same legal logic could apply to anyone whose image, voice, or personal information ends up circulating online without their consent, not just public figures with the means to sue.
This legal approach flips who has to prove what. Under defamation law, the person bringing the case has to prove the platform did something wrong. Under Section 52 of the NDPA, that burden shifts. Once a platform counts as a “data controller” in plain terms, a company that decides how personal data gets used must show it followed the rules, rather than the claimant having to prove it didn’t. That classification also strips away the “we’re just a neutral host” defence that has worked so well for platforms in defamation cases.
Privacy lawyer Dr Olumide Babalola argues that this reading of “processing” naturally covers what recommendation and amplification systems do: they arrange and circulate personal data at scale, which is exactly the kind of activity the law describes. Gbenga Sesan, Executive Director of Paradigm Initiative, makes a related point from a more technical angle: “whatever you call it, these systems are using people’s data to rank content and move information around, which is processing in the ordinary sense of the word”. Platform lawyers disagree, insisting that recommendation systems merely organise content that already exists, without altering the underlying personal data.
That disagreement, not the existence of the law itself, is the real fault line these cases are testing. And rather than going through slow, standard civil courts, these claims can be routed through the Fundamental Rights Enforcement Procedure, a faster, constitution-based track originally designed for urgent rights violations.
The clearest test case so far is Falana v. Meta Platforms Inc. (Lagos State High Court, January 2026), the same dispute that grounds the “processing” argument above. Meta argued it was just an intermediary that removed the content once notified. Justice O.A. Oresanya rejected that, ruling that Meta’s continued processing of false personal data breached the NDPA, and awarded Falana $25,000 in damages.
The ruling actually rested on two separate legs, not one: alongside the data-processing argument, the court found Meta could be treated as standing in for the anonymous page operator, since Falana’s lawyers couldn’t locate that person anywhere. That second theory matters because if a higher court later rejects the data-processing argument but leaves this one standing, claimants could still win similar cases in future, even if the newer data-rights theory doesn’t survive on appeal.
Beyond the two legal theories in Falana itself, the decision also sits within a broader evolution of Nigerian privacy law. In Bi-Courtney Aviation Services Ltd v. Kelani (2021), the Court of Appeal ruled that using someone’s photo commercially without consent was a serious invasion of privacy. Falana and the newer cases extend a related but different idea: that people can be harmed simply by being portrayed inaccurately online, whether or not it counts as defamation.
A clearer pattern shows up in how the courts are interpreting data and privacy violations when you compare the cases platforms have won against the ones they’ve lost. In Adunni Adewale v. Google LLC & Anor (July 2025), a court found Google liable for continuing to surface inaccurate personal information about the claimant, even after Meta, originally a co-defendant, was removed from the case entirely. But in Sowore v. Meta & DSS (April 2026), a different court declined to interfere with Meta’s decision to deactivate an account, finding the platform was simply enforcing its own moderation rules.
Put those cases next to Falana, and a more coherent judicial pattern emerges: courts have been more willing to hold platforms liable when the platform was making money from the harmful content, and less willing to intervene when a platform was just moderating its own service. It’s not that judges are attacking algorithms in general. It’s narrower than that; the common thread across the cases so far is commercial gain from harm, not automation itself.
Why Civil Society Remains Cautious
As lawyers are finding new applications for data protection and privacy rights, and the courts are affirming these emerging pathways in Nigeria, human rights stakeholders are wary, and for good reason.
Nigerian courts have, at times, been used as an instrument against the press rather than a protection for it. Defamation suits and, more recently, the Cybercrimes Act, have both been deployed against journalists and critics, sometimes in ways widely seen as designed to intimidate rather than to remedy genuine harm. That history is part of why a NITDA-drafted code that would let platforms be forced to take down content within 24 hours of a government notice, first proposed in 2022, has drawn concern from groups like Amnesty International and other digital rights stakeholders, and remains stalled. The worry is less about the specific rule and more about how easily new legal tools can be turned into instruments of suppression once they exist.
The court’s precedents with regard to limiting civil rights are why the shift toward data protection law deserves scrutiny alongside its promise. A framework built to help a defamed public figure win a fast, evidence-light case against a platform is, in principle, the same framework a state actor could later use to pressure a platform into removing legitimate reporting. The two outcomes aren’t separable in the statute itself; they depend on who brings the case and why.
These concerns are very valid in Nigeria’s democratic context, and it means the court’s emerging approach needs to be viewed as both an opportunity and a challenge, with the sobering reminder that the same legal pathways used for strengthening accountability can, if poorly interpreted or applied, be used to constrain fundamental human rights.
Litigation as a Regulatory Backstop
Regulators have largely stayed out of individual content disputes. The Nigeria Data Protection Commission has focused on institutional compliance audits rather than cases like Falana’s, though it jointly secured a $220 million penalty against Meta and WhatsApp in 2024 over broader data practices. In April 2026, the NDPC introduced a new “AI System Impact Assessment” tool for evaluating AI systems, without yet making it mandatory.
That leaves individual, content-related harms as a gap that litigation, rather than regulation, is currently filling.
Doxxing, publishing someone’s private information, such as their address, without consent, often isn’t defamation at all if the information happens to be true. But under the NDPA, sharing someone’s personal data without a lawful reason can be treated as unlawful processing regardless of whether it’s accurate. Falana’s case shows the same logic applied to synthetic media: a cloned voice and an altered image aren’t just “false” in the way a defamatory statement is false. They are personal data that was manipulated without consent, which is precisely the kind of harm the law’s definition of “processing” was written to capture. And because a data protection claim targets the platform’s ongoing role in distributing the material, victims may not need to first identify the anonymous person who created it, something that can otherwise take years.
An Emerging Pattern, not a Settled Precedent
None of this is settled. Every ruling used as an example is a High Court ruling, and none has yet been tested on appeal. Meta has appealed the Falana decision, arguing across eight grounds that the trial court had no jurisdiction to hear the case through the fast-track constitutional procedure, and that it was wrongly classified as a “data controller” for content someone else posted.
Critics within Nigeria’s privacy law community have raised similar concerns to Meta’s appeal. Legal and privacy expert Gbenga Odugbemi has argued the Falana ruling reaches its result through what he calls “judicial syncretism”, in other words, stitching privacy law, tort law, and agency law together into a single theory that isn’t clearly grounded in any one statute. In his view, the ruling treats simply hosting content as if it were authoring it, and treats profiting from content as if it were proof the platform set out to cause harm, while easing the NDPA’s own requirement that a claimant show real, demonstrable injury. Advocate Dirontsho Mohale raises a related but narrower objection, about a specific piece of the NDPA sometimes called the “joint controller” test: the rule for deciding when two different parties say, a platform and the person who posted on it both count as legally responsible for the same data. Mohale argues the court misapplied that test, and that Meta and an anonymous poster don’t automatically become joint controllers just because Meta hosted and distributed what the poster uploaded.
If Nigeria’s Court of Appeal accepts either argument, litigants could lose the procedural advantage that currently makes privacy and data-protection claims more attractive than defamation ones. If appellate judges also decide that recommendation systems merely organise content rather than “process” personal data in the way the NDPA means, the legal foundation for treating algorithmic amplification as a data protection issue would weaken substantially. Both Sesan and Babalola are cautious about predicting how this resolves. Sesan points out that there simply aren’t enough cases yet to draw firm conclusions. Babalola notes that other privacy interests, like the use of someone’s likeness in Bi-Courtney, took time to be formally recognised too, and argues there’s no reason to assume these newer claims will be treated differently.
What’s happening in Nigeria right now isn’t really a story about courts deciding to get tougher on tech platforms as some narratives have framed the issues. It is surfacing a reality that most sectors are facing: the limits of existing laws and frameworks with respect to new digital realities, as well as how actors in these spaces are responding to these seismic shifts, in this case, lawyers.
Meta’s appeal will determine whether this emerging legal pathway survives appellate scrutiny. Whatever the outcome, these cases have already shown that litigation is becoming an important mechanism for testing the limits of existing laws and inviting the courts to interpret them in response to digital-age harms. It remains to be seen whether that ultimately produces durable precedent, exposes the need for legislative reform, or does both.
