What happened on August 13
The Nigerian Communications Commission (NCC) issued its revised Internet Code of Practice 2026 on February 13, 2026. It gave online and digital communications platforms six months to draft Community Rules and submit them to the regulator. That window closed on August 13, 2026. The rules must address harmful content, disinformation, fraud and unlawful content, and they must align with Section 146 of the Nigerian Communications Act 2003. Digital Policy Alert records the Code as entering into force on that date, after a consultation that ran from October 9 to October 31, 2025.
The Code replaces the 2019 version. Its scope reaches beyond internet access providers to user-generated content platforms. Platforms must also file biannual compliance reports and set up a direct engagement channel with the NCC's designated contact point, according to the Mondaq summary of the framework.
The strongest case for the Code
The case for the regulator is a serious one. Nigerians lose money to online fraud, and impersonation scams, fake investment pages and viral disinformation spread fast on platforms with little local accountability. A regulator that can name a point of contact and expect written moderation rules is asking for something modest. Requiring a platform to write down what it will and won't host is a transparency measure, and it is arguably less intrusive than the content-specific orders Nigerian authorities have used in the past. Section 146(1) of the Nigerian Communications Act requires licensees to use best endeavours to prevent their networks and services from being used to commit offences under Nigerian law. Tying Community Rules to that provision gives the requirement a statutory anchor.
Where the design creates risk
The trouble is what the rules are measured against. Section 146 concerns offences under any law in operation in Nigeria. A platform that drafts its rules to match Nigeria's offence catalogue, which includes broad cybercrime provisions that Nigerian courts and rights groups have criticised, imports that breadth into its private terms of service. Whether the NCC will review the submitted rules, approve them or send them back is a question the public material does not answer. Without a stated standard, a filing can be read as a request for permission.
Three features compound this:
- Fast takedowns. The Code lets the Commission issue takedown notices requiring compliance within 24 hours of receipt, according to BusinessDay's analysis. Mondaq likewise reports that unlawful material must generally be removed within 24 hours of a directive. A 24-hour clock leaves little room for a platform to check whether content is actually unlawful, so over-removal becomes the rational response.
- Undefined sanctions. BusinessDay notes that the phase beginning 180 days after publication marks the start of full compliance monitoring and enforcement, with possible sanctions. The detail on those sanctions is thin.
- AI powers without procedure. The same analysis flags broad Commission powers over the withdrawal of AI systems without clearly defined procedural safeguards. For a country trying to attract AI investment, that is a regulatory-risk premium paid up front.
Mondaq's wider discussion of Nigeria's digital-governance framework also raises the concern that terms like "morality" and "public interest", used in related codes, invite subjective and potentially politically motivated interpretation. That discussion concerns the separate NITDA Code, not the NCC's, but the two instruments sit in the same enforcement environment, and platforms will read them together.
Overlap and compliance cost
BusinessDay also identifies jurisdictional overlap with other regulators and dual reporting burdens, a 48-hour telecoms incident requirement alongside a 72-hour data protection requirement. Large platforms can absorb that. A Nigerian startup running a community forum, a marketplace or a fintech social feature cannot. The regulation applies to anyone hosting user-generated content, so the compliance cost falls hardest on the local firms the policy should want to grow.
There is also a design question. A single code now touches content moderation, quality of service, AI deployment and incident reporting, per the NCC's guidance notes. Bundling these makes it harder for firms to tell which obligations are firm and which are aspirational, and BusinessDay points to unclear thresholds for the softer obligations.
A proportionate path
None of this requires scrapping the Code. Four changes would keep its legitimate goals and cut the speech risk:
- Publish a review standard. Say whether Community Rules are filed for information or approved, and what the NCC will not require platforms to remove.
- Tie takedowns to process. Require written orders citing the specific provision of law, with a route for a platform or user to challenge them, and a longer window for content whose illegality is contestable.
- Differentiate by size. Scale reporting and response obligations to a platform's reach and risk, so small Nigerian services are not treated as global ones.
- Add procedure for AI withdrawals. Specify notice, reasons and a right to be heard before any system is pulled.
Nigeria has the largest digital market in Africa and a real fraud problem. Both argue for a regime that platforms can comply with predictably. The Community Rules requirement is a sensible transparency instrument as long as the regulator says plainly that it does not extend to deciding which lawful speech stays online. As enforcement monitoring begins, that line is the thing to watch.