The Nigeria Data Protection Commission (NDPC) has launched an immediate investigation into the data processing activities of the global eCommerce giant, Temu. This probe, initiated by the National Commissioner and CEO, Dr. Vincent Olatunji, stems from allegations that the platform may be in violation of the Nigeria Data Protection Act (NDP Act), 2023. The investigation, which began following a press release on February 16, 2025, was prompted by increasing concerns regarding Temu’s handling of users' personal information.

Key aspects under the NDPC's scrutiny include allegations of online surveillance, a perceived lack of transparency in data practices, and the platform's alleged failure to adhere to fundamental data minimisation principles. Furthermore, the regulator is meticulously examining Temu’s accountability frameworks, its duty of care towards data subjects, and the protocols it employs for cross-border data transfers. Preliminary findings from the NDPC reveal that Temu currently processes the personal data of approximately 12.7 million individuals within Nigeria. Globally, the platform boasts a significant user base, with an estimated 70 million daily active users. The substantial volume of Nigerian data involved underscores the critical importance and urgency of the Commission’s regulatory oversight in this matter.

Dr. Olatunji also issued a stern warning, emphasizing that third-party data processors operating on behalf of data controllers must proactively verify their compliance with the NDP Act. Under Nigeria’s existing legal framework, such processors face the risk of being held directly liable if their activities are found to be non-compliant with Nigerian statutory requirements.

In a statement to Techpoint Africa on February 17, 2026, Temu confirmed its receipt of the NDPC’s inquiry and emphasized its willingness to collaborate with the regulatory body. The company affirmed, “At Temu, protecting user privacy and data security is a top priority. We are committed to complying with applicable laws and regulations in our data practices. We will continue to engage in open and constructive dialogue with the NDPC to address any questions or concerns.”

The NDPC’s investigation into Temu’s data practices is indicative of a broader global trend towards increased scrutiny of the data-harvesting strategies employed by high-growth eCommerce platforms. This action represents a significant assertion of digital sovereignty by Nigeria, which holds the distinction of being Africa’s largest internet market. The NDPC has demonstrated a growing proactive stance since its establishment. In March 2025, it launched similar investigations into TikTok and Truecaller. Additionally, in July 2025, the Commission imposed a landmark ₦766.24 million fine on MultiChoice Nigeria following a year-long probe into intrusive data processing and illicit cross-border transfers impacting both subscribers and non-subscribers.

Nigeria has also taken a decisive stand against prominent Western tech giants. In April 2025, the Competition and Consumer Protection Tribunal upheld a substantial $220 million fine against Meta, the parent company of WhatsApp and Facebook, citing discriminatory and exploitative practices. While a separate $32.8 million fine from the NDPC related to behavioral advertising was later resolved through a consent judgment in October 2025, that particular case compelled Meta to commit to specific corrective privacy measures tailored for Nigerian users.

Temu is encountering similar regulatory challenges across the African continent. In late 2025, South Africa’s National Consumer Commission (NCC) initiated a formal investigation into both Temu and Shein, examining their adherence to the Consumer Protection Act and expressing increasing concern over their reliance on algorithms and data-mining practices to drive consumer engagement.

The NDPC’s robust actions against global corporations signal a definitive conclusion to the era of unrestricted data harvesting in Nigeria. As the Commission expands its regulatory reach, this investigation serves as a high-stakes reminder that business growth achieved at the expense of user privacy is no longer a sustainable strategy in Africa’s largest economy. For global platforms operating within this environment, the outcome of this probe will establish a crucial precedent: the adoption of localised data ethics is no longer merely an option but a necessity. To successfully operate within Nigeria’s increasingly mature digital landscape, tech giants must make a critical choice: either align their data-driven algorithms with the stringent requirements of the NDP Act or face a regulatory environment where substantial fines and market exclusion are the standard consequences for non-compliance.