A Mandate By The Numbers
On June 5, 2026, Nigeria's Federal Ministry of Communications, Innovation and Digital Economy (FMoCIDE) and the Nigeria Data Protection Commission (NDPC) convened stakeholders in Lagos for a roundtable on "Protection of Children Online," unveiling results from a public consultation survey and renewing calls for platforms to adopt a duty-of-care model backed by stronger age verification (NDPC).
The numbers are striking. Of 585 Nigerians surveyed under the ministry's "Proposed Social Media Age Regulation in Nigeria" study, 83.4% supported regulating children's social media use, with 64.8% backing strict regulation outright. A remarkable 97.6% endorsed a duty-of-care framework for platforms, and 64.5% wanted a minimum access age of 16 or 17 — above the global default of 13 (Punch). Minister Bosun Tijani called child protection online "a national priority and a shared responsibility"; NDPC Commissioner Vincent Olatunji framed the fix as strengthening legal awareness, promoting duty of care, and closing age-verification gaps.
The Case For Acting
The underlying concern is real, and the survey captures it honestly rather than manufacturing a moral panic. Respondents flagged exposure to harmful content (90.9%), digital addiction (83.6%) and online grooming (82.4%) as the dominant risks children face on Nigerian platforms — categories that map onto harms regulators from the UK to Australia have already documented. Nigeria's under-18 population is enormous and increasingly online, often with little parental oversight or platform-side friction. A government that ignored an 83% consensus after specifically soliciting public input would be shirking its job. The instinct to act is defensible; the question is what "acting" should mean in practice.
Where The Statute Runs Thin
"Promoting a duty-of-care model for digital platforms, addressing privacy and age-verification concerns." — Dr Vincent Olatunji, NDPC Commissioner/CEO
That's where the proposal collides with what the law actually says. FMoCIDE and NDPC are invoking Section 31 of the Nigeria Data Protection Act 2023, which defines a child as anyone under 18 (importing the Child's Rights Act 2003 threshold), bars processing a child's data without parental or guardian consent, and requires data controllers to implement "appropriate mechanisms" to verify a data subject's age, taking into account available technology (NDPA 2023). That is a consent-and-verification rule for data controllers generally — not a purpose-built social-media age-gating regime — and it says nothing about which verification method counts as "appropriate," what a platform's duty of care consists of, or how either would be enforced against companies with no Nigerian legal presence. Turning a general child-data-consent provision into the legal basis for platform-wide age gates is a significant interpretive stretch, and the NDPC has not yet published implementing regulations that would narrow it.
That gap matters because age verification is not a costless technical toggle. The most reliable methods tie verification to government-issued identity, and Nigeria's identity infrastructure is still catching up. The National Identity Management Commission had enrolled roughly 137 million Nigerians in the National Identification Number database as of July 2026, against a population estimated near 220-230 million (BiometricUpdate). A meaningful share of the country — disproportionately rural, poorer, and younger — either lacks a NIN or hasn't linked it to anything a platform could check. An age-verification mandate anchored to that base risks two failure modes at once: legitimate users locked out for lack of formal ID, and platforms compensating by demanding more identity data than a data-protection-first regulator should want collected — friction that lands hardest on exactly the households the survey's own respondents said they were trying to protect.
Enforcement Capacity Is The Other Unknown
Analysts who have reviewed the NDPA closely flag a related weakness: the Act does not specify implementation mechanisms for many of the rights it creates, and its penalty tiers depend on classifications the NDPC assigns at its own discretion (Future of Privacy Forum). A duty-of-care standard that is vague at the level of statute and under-resourced at the level of enforcement does not reliably protect children — it mostly rewards whichever platform can afford the largest compliance and legal team to interpret the ambiguity in its own favor. That tends to entrench incumbents like Meta, TikTok and Google, while raising the bar for the smaller Nigerian and pan-African platforms the ministry's own digital economy agenda is trying to grow.
A Narrower Path
None of this argues against acting on child safety; it argues for sequencing. NDPC should use its Section 31 rulemaking power to publish a specific, narrow verification standard — least privacy-invasive method first, phased in with a compliance floor that exempts small and early-stage platforms — rather than leaving "appropriate mechanism" undefined and daring companies to guess. Design-level interventions — default privacy settings for minors, parental-control APIs, faster reporting-tool response times — address the harms the survey actually measured: content exposure, addiction, grooming, without requiring every user to prove their age to a bureaucracy. Nigeria doesn't need to import a heavy identity-gate model to make its 83% consensus count. It needs rules precise enough that "duty of care" means something enforceable, rather than a phrase every platform can already claim to satisfy.