Nigeria’s Data Protection Commission, NDPC, opened a formal investigation into the Chinese e-commerce platform Temu on February 16, following allegations that the company had intruded on digital privacy standards.

The probe affects approximately 12.7 million Nigerian users and centres on allegations that Temu conducts online surveillance through extensive personal data processing, maintains opaque data handling practices, and transfers user information outside Nigeria without adequate safeguards.

The NDPC has continuously demonstrated a willingness to impose significant financial penalties on companies that violate Nigeria’s 2023 Data Protection Act. Meta paid $32.8 million in 2025 for similar violations. Multichoice Nigeria faced a ₦766 million fine in 2023. The investigation into Temu signals that no platform, regardless of size or market entry timing, operates beyond the reach of Nigerian data protection enforcement.

What Temu allegedly got wrong

The NDPC’s investigation focuses on several specific violations. First, data minimisation. Sources within the Commission indicate that Temu’s app accesses far more user data than required for basic e-commerce functionality. The platform requests permissions for location tracking, photo and video access, information about other installed apps, and detailed cellular and WiFi network data.

For context, a shopping app legitimately needs delivery addresses and payment information. It doesn’t need continuous location tracking, access to users’ photo libraries, or knowledge of what other apps they have installed. The gap between necessary data collection and actual data collection forms the basis of the Commission’s concern.

On the aspect of transparency, the NDPC claims Temu’s privacy policies are “buried under layers of complex legal jargon” that obscure how user data is actually processed, stored, and shared. This violates the Act’s requirement that data subjects receive clear, accessible information about how their personal information is used.

Also, Temu’s case presents cross-border data transfers. Moving Nigerian user data outside the country requires explicit consent and adequate protection mechanisms. The investigation will examine whether Temu met these requirements or simply transferred data as part of its standard global operations without regard for Nigerian sovereignty over its citizens’ information.

Further counts on the issue of accountability, the NDPC questions if Temu has implemented sufficient technical and organisational measures to protect Nigerian user data and respond to data subject requests.

Why Nigeria is pressing the issue now

Temu launched in Nigeria in late 2024 with aggressive social media marketing targeting young, price-conscious consumers. The platform became one of the most downloaded shopping apps within months, driven by extremely competitive pricing and influencer campaigns across Instagram and TikTok.

That rapid growth put Temu squarely in the NDPC’s sights. The Commission has been methodically working through major digital platforms since the 2023 Data Protection Act came into force, and Temu’s user base of 12.7 million Nigerians makes it a significant enforcement priority.

The timing also matters. Nigeria is asserting regulatory authority at a moment when multiple jurisdictions are scrutinising Temu’s data practices. Arizona filed a lawsuit in December 2025 alleging the company is “dangerous malware” that conducts illegal data harvesting. While that characterisation is more aggressive than the NDPC’s language, the underlying concerns about excessive data collection align across jurisdictions.

This creates a pattern. Nigeria isn’t acting alone or pursuing uniquely strict standards. It’s participating in a broader global push to hold tech platforms accountable for data practices that may have been acceptable five years ago but no longer meet evolving privacy expectations.

What this means for brands and marketers

The Temu investigation carries implications beyond one e-commerce platform. It establishes several precedents that affect how international brands should approach the Nigerian market.

First, market entry doesn’t exempt companies from compliance. Temu launched less than 18 months ago. The NDPC didn’t give the platform a grace period to build scale before enforcing standards. Brands entering Nigeria need robust data protection frameworks operational from day one, not aspirational compliance roadmaps they plan to implement later.

Second, aggressive growth through social media marketing attracts regulatory attention. Temu’s rapid user acquisition made it visible to the NDPC. Brands pursuing similar strategies should expect scrutiny to scale with their user base. The Commission appears to prioritise enforcement actions where violations affect the largest number of Nigerians.

Third, global data practices don’t automatically satisfy Nigerian requirements. Temu’s approach may work in markets with looser standards, but Nigeria is establishing itself as a jurisdiction where data sovereignty matters. Companies can’t assume that compliance in their home market or other African countries translates to compliance in Nigeria.

Fourth, the NDPC demonstrates increasing sophistication in identifying violations. The Commission’s case against Temu shows a detailed understanding of data minimisation principles, cross-border transfer requirements, and transparency standards. This isn’t amateur enforcement. It’s a regulator that understands the technical aspects of how apps collect and process data.

For digital marketers and brands operating in Nigeria, this creates a more complex environment. The days of launching digital platforms or campaigns without rigorous data protection assessments are over. Brands need to audit what data they’re collecting, ensure they have a legal basis for that collection, maintain transparent privacy policies written in plain language, implement controls on cross-border data transfers, and establish processes for responding to data subject requests.

The broader pattern of tech enforcement

The Temu investigation fits within Nigeria’s systematic approach to tech platform regulation over the past three years. The NDPC has moved deliberately, establishing enforcement credibility through high-profile cases before expanding to newer entrants.

Meta’s $32.8 million penalty in 2025 established that even dominant global platforms face real financial consequences for violations. That fine represented roughly 0.007% of Meta’s annual revenue, which might seem nominal from a corporate perspective, but sent a clear message about regulatory intent.

Multichoice’s N766 million fine in 2023 demonstrated that enforcement extends beyond social media and search to subscription services and content platforms. The cable TV operator violated data protection requirements in handling subscriber information, proving that any company processing Nigerian personal data falls within the NDPC’s mandate.

Now, Temu joins this enforcement pipeline. The Commission appears to be working through major platforms methodically rather than selectively. This suggests that other recently launched or rapidly growing digital services should expect similar scrutiny.

The pattern reveals Nigeria positioning itself as a jurisdiction where digital platforms must take data protection seriously or face consequences. This aligns with broader African trends. Kenya, South Africa, and Ghana have all strengthened data protection enforcement in recent years, creating a continental shift toward accountability in how tech companies handle user information.

What happens next

Temu issued a statement describing user privacy as a “top priority” and promising cooperation with regulators. This is standard corporate response language that commits to nothing specific while projecting concern.

The NDPC investigation will likely unfold over several months. The Commission will examine Temu’s data collection practices, review technical documentation, assess cross-border data flows, and evaluate compliance with transparency requirements. If violations are confirmed, the platform faces potential fines and operational restrictions.

The scale of those penalties will signal how seriously Nigeria takes data protection enforcement. A nominal fine would suggest the investigation was primarily about establishing oversight rather than driving behaviour change. A substantial penalty on par with Meta’s would reinforce that the NDPC intends to make non-compliance financially painful.

For Temu specifically, the investigation creates immediate brand risk in a market where the company invested heavily to build presence. Nigerian users who downloaded the app for cheap products may start questioning what data access they granted in exchange. Consumer trust, once damaged by privacy concerns, proves difficult to rebuild even if the platform ultimately addresses the technical violations.

More broadly, the investigation puts every digital platform operating in Nigeria on notice. The NDPC has moved beyond warnings to systematic enforcement. Companies processing Nigerian personal data need to treat compliance as essential infrastructure, not an optional enhancement. Those that don’t will likely find themselves next in the Commission’s enforcement queue.

The message from Nigeria’s data protection regulator is unambiguous: access to Nigerian consumers comes with obligations to protect Nigerian data. Companies that want to operate in this market need to meet those obligations or face consequences. Temu is learning that lesson. Other platforms would be wise to pay attention.

ALSO WATCH MARKETING EDGE ONTV