Two Regulatory Waves, Divergent Legitimacy
Nigeria is pressing two separate but intersecting campaigns against its internet in 2025 and 2026. The first — the Nigerian Communications Commission's draft Internet Code of Practice — imposes structured obligations on social media platforms, messaging apps, and digital services operating in Africa's most populous market. The second, running simultaneously, is intensified enforcement of the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 against journalists, bloggers, and ordinary social media users.
The first push is defensible. The second is not. Understanding which is which matters enormously for Nigeria's digital economy and for every policymaker in the region watching Abuja's moves.
The Genuine Cybercrime Crisis Beneath the Rhetoric
Nigeria's case for regulating online platforms rests on a real foundation, and regulators deserve credit for naming it clearly. The country faces endemic online fraud — phishing networks, romance scammers, business email compromise rings — that extract substantial value from Nigerians and foreign victims alike. Platform compliance data underscores the scale: in 2024 alone, the three platforms that cooperated with Nigeria's National Information Technology Development Agency (NITDA) under its June 2022 Code of Practice — LinkedIn, Google, and TikTok — collectively deactivated 13.5 million accounts and removed 58.9 million pieces of content. These are not ghost accounts from registration-bots; they are active instruments of fraud, harassment, and abuse in a country with more than 100 million internet users.
Regulators also face a stark platform accountability deficit. NITDA's 2024 compliance assessment found that X (formerly Twitter) was completely non-compliant across all Code requirements — described as "the most concerning" lapse in the review. Meta incorporated locally and established a physical presence but still failed to submit content moderation reports in the prescribed format. The argument that global platforms should face the same basic transparency obligations in Lagos that they face in Brussels or Canberra is not unreasonable. It is, in fact, the argument that most credible internet governance frameworks now accept.
What the NCC's 2025 Code of Practice Actually Does
The NCC's draft Internet Code of Practice 2025 extends NITDA's 2022 framework to a broader class of platforms and sharpens procedural obligations. Online platforms must adopt community guidelines governing user conduct and submit them to the NCC within six months of the Code's issuance. They must file bi-annual compliance reports in an approved format. They must maintain a dedicated channel with the NCC's newly designated Designated Online Governance Officer to address harmful content and unlawful activity. Takedown notices must be complied with within 24 hours — though the Code preserves an appeal right for contested removals.
The structural template mirrors what the EU enforces under its Digital Services Act: differentiated obligations by platform type, mandatory transparency reports, and a dedicated regulator liaison. Nigeria's version lacks the DSA's independent audit requirements and algorithmic risk-assessment provisions for very large platforms, but the core framework is sound. A Senate bill passed its second reading in March 2025 that would require social media platforms to establish physical offices in-country — local presence creates accountability surfaces that fully remote operations do not.
The concern is execution, not principle. Mandatory 24-hour takedown windows are tight; they create pressure for over-removal rather than careful review. Local office requirements, if used to coerce platform employees or extract confidential user data outside judicial process, can damage editorial independence. These are worth fixing in the final Code — not reasons to reject it.
Where the Framework Collapses
The legitimacy of the NCC's platform-facing work collides directly with what Nigeria's police and security agencies are doing with the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024, signed February 28, 2024, and brought into full nationwide enforcement in July 2025.
Section 24 criminalises electronic messages that are "grossly offensive, pornographic or of an indecent, obscene or menacing character," as well as content intended to "cause annoyance, inconvenience or needless anxiety." In practice, those terms are applied with enormous discretion — and the documented pattern is targeting of critics, not fraudsters.
The Committee to Protect Journalists recorded three separate journalist detentions in the space of six weeks in late 2025. On September 18, Fejiro Oliver (pen name for Tega Oghenedoro) was jailed in Abuja for Facebook posts criticising Delta State's governor, initially held on a 15 million naira bail he could not post. On September 9, Sodeeq Atanda of the Foundation for Investigative Journalism was detained in Ekiti State after a university vice-chancellor complained about sexual harassment reporting. In August, Azuka Francisca Ogujiuba was arrested twice for publishing a court injunction about disputed land. At least 25 journalists faced prosecution under Section 24 before the 2024 amendment; CPJ documented five more since the reforms.
These are not edge cases or clerical errors. In May 2025, the Nigerian Guild of Editors and the Socio-Economic Rights and Accountability Project (SERAP) jointly demanded that the Tinubu government end Section 24 prosecutions. Their statement invoked a ruling that Nigeria has simply ignored: on March 25, 2022, the ECOWAS Community Court of Justice found Section 24 "arbitrary, vague and repressive" and ordered Nigeria to amend it. The 2024 amendment failed to implement that order.
The Proportionality Test
A cybercrime law that fails a regional court's constitutional review, that is used to jail reporters covering sexual harassment allegations, and that carries up to 15 years imprisonment for vaguely defined "government data leaks" is not a cybersecurity instrument. It is a press-control instrument dressed in cybersecurity language.
The distinction between cybercrime law and speech-control law is not a technicality. It is the difference between a regulatory framework that attracts investment and one that drives entrepreneurs, journalists, and developers to Accra or Nairobi.
Nigeria's NCC Internet Code of Practice — once finalised with tighter takedown safeguards — represents a workable model for platform accountability that can coexist with a free press. But that project is undermined every time a Section 24 arrest makes international headlines, because it signals that "cybercrime" enforcement is ultimately a speech-control project.
The Tinubu administration should do what the 2024 amendment failed to do: implement the ECOWAS court's 2022 order, replace Section 24's elastic terms with precise statutory definitions tied to demonstrable harm, and institutionally separate the NCC's platform accountability work from police-agency enforcement of speech offences. Nigeria's digital economy — and its press — deserve a legal environment capable of both.