Serves under-18s, in Nigeria

NITDA Code of Practice for Interactive Computer Service Platforms/Internet Intermediaries, 2022, Part II · Read the law's page

• Applies to all Interactive Computer Service Platforms and Internet Intermediaries operating in Nigeria, defined broadly to include social media operators, websites, blogs, media-sharing sites, discussion forums, streaming platforms and gaming platforms.
• Label, censor, redact or otherwise apply access control so that content inappropriate for a child, such as sexually explicit content or images of violence, is not viewable to a child.
• Tell users through your terms of service not to create, publish, modify, transmit, store or share content harmful to a child.
• In assessing whether content is harmful, consider the risk that its dissemination could have a physical or psychological impact on a child or an adult.
• Ensure your community rules specify how children will be protected from harmful content they may encounter.
• You need not use any particular age-verification mechanism: the Code does not prescribe one.

Nigeria Data Protection Act, 2023, sensitive personal data and a child's data (GAID 2025, arts. 18 and 43) · Read the law's page

• Obtain a data subject's consent before processing sensitive personal data, and before processing the personal data of a child.
• Do not seek, give or accept consent in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.
• Where you deploy an emerging technology such as artificial intelligence, the Internet of Things or blockchain to process personal data, set technical and organisational parameters that take account of safeguards for sensitive personal data, safeguards for child rights and other vulnerable groups, the right against solely automated decisions, the right to be forgotten, cross-border data flows, and privacy by design and by default.
• Document those parameters and file them with the Commission as part of your Compliance Audit Returns, with an impact assessment that weighs disparate outcomes of the processing and the Data Subjects' Vulnerability Indexes in Schedule 6.
• State in your Compliance Audit Returns whether you rely on consent for any of the activities article 18 lists.

Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 · Read the law's page

• This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
• Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.