The internet is not just a utility to be accessed by anyone and for Nigerians, it's no different. It is where Nigerians bank, work, learn, date, argue, grieve, and build businesses.

It is where personal data lives, where children spend unsupervised hours, and where even fraud has found some of its most fertile ground. For years, the framework governing how telecom operators managed all of that dated back to 2009—a document written before smartphones were mainstream, before social media reshaped public life, and long before artificial intelligence became a boardroom conversation.

That has now changed on February 13, 2026, when the Nigerian Communications Commission released the Internet Code of Practice 2026, a comprehensive overhaul of the 2009 edition.

The revised document redefines the rights and obligations of internet access service providers, the telcos and digital platforms operating in Nigeria, in a digital environment that looks almost nothing like the one the original code was written for.

The NCC's stated goal is to guarantee an open, safe, and accountable internet for Nigerian users. Whether it succeeds will depend on implementation, but the intentions embedded in the document are worth understanding, because several of them affect you directly.

What the New Code Actually Says

The first and most consequential change in the ICP 2026 concerns data. Specifically, who can access yours and under what conditions.

Under the new framework, telecom operators are prohibited from allowing third parties to harvest transactional data from their networks without prior written approval from the NCC.

This covers metadata, the activity logs generated by your network provider that include behavioural data, browsing trends, spending habits, and patterns of internet use. Previously, this kind of information could be accessed by companies and government agencies with relatively limited friction.

The revised code inserts the NCC as a mandatory gatekeeper, it is not a perfect shield, but it is a formal one, and its existence changes the accountability structure around data access in Nigeria in a meaningful way.

On cybersecurity, the 2026 code fills a gap that its predecessor left entirely open. Telecom operators must now implement the NCC's Cyber Resilience Framework for the Nigerian Communications Sector.

Among its most important requirements: if a cyberattack is detected, the operator must notify the NCC within four hours, provide updates every four hours after that, and submit a full confirmation report within 24 hours.

In a country where data breaches have historically been disclosed late or not at all, mandatory rapid notification represents a structural shift in how cyber incidents will be handled going forward.

The code also updates the rules around content takedowns, both the old and new frameworks required unlawful content to be removed within 24 hours of a directive. What the 2026 version adds is balance, specifically, the right of any party adversely affected by a takedown notice to appeal the decision.

Telcos are also now empowered to initiate takedown procedures themselves by issuing a formal notice to the NCC, rather than waiting passively for instructions.

Perhaps the most forward-looking addition is the regulation of artificial intelligence. Under Section 5.4, telecom operators must notify the NCC before deploying any AI tools, applications, or solutions related to network management or customer engagement.

The notification must explain why the tool is being used, how it works, and what it is intended to achieve. Operators must also inform affected subscribers before deployment, and all AI usage must comply with the NCC's ethics and integrity standards.

In a regulatory environment where AI governance globally is still being debated, Nigeria's decision to embed mandatory pre-deployment disclosure directly into its internet code is a notable step.

Child online protection receives a more robust treatment in the new code as well. Telcos must now offer parental control tools that are simple to enable, with guidance provided in multiple languages to account for Nigeria's linguistic diversity.

Crucially, the default setting before users opt in to parental controls must be protective, meaning minors and vulnerable individuals must actively agree to certain services rather than being passively enrolled.

It is a small design change with significant implications for how young Nigerians encounter the internet for the first time.

The code also introduces an entirely new chapter dedicated to how online and digital platforms operating in Nigeria manage content on their platforms. All digital service providers must draft and submit community guidelines to the NCC within six months of the code's release. Those guidelines must contain specific measures to address harmful content, disinformation, fraud, and unlawful material.

Finally, all operators must submit compliance reports to the NCC twice a year — a biannual accountability mechanism that did not exist before.

What This Means for the Average Nigerian

Reading regulatory documents is nobody's idea of a good time, so here is the plain version: the NCC is just announcing to every company handling your internet connection that the rules have changed and the consequences of ignoring them are real.

Your metadata is harder to sell without oversight, your personal data from a cyberattack must be reported faster and your child's first encounter with the internet defaults to protection rather than exposure.

Also as time progresses, the AI your telco uses to engage with you must be disclosed before it touches your experience. The platforms you use daily must have written rules about what they allow and submit those rules to a regulator.

None of this actually guarantees safety, because regulation is only as strong as enforcement, and the ICP 2026 at minimum seems to be creating the legal architecture for accountability and that is further than the country has been before.

The internet you use did not change on February 13, but the rules governing the people responsible for it did.