Data Protection, Consent and Power: A Normative Critique of the Consent Model Under Artificial Intelligence and the Nigeria Data Protection Act 2023
DOI:
https://doi.org/10.68854/dh0d4g48Keywords:
consent, data protection, artificial intelligence, inferences, power, Nigeria Data Protection Act 2023, collective data governance, AfricaAbstract
Consent is the lawful basis that most closely expresses respect for personal autonomy in data protection law, yet artificial intelligence (AI) places it under a strain that earlier critiques of notice and choice did not anticipate. Machine-learning systems infer new facts about people from the data they disclose and from the data of others, often in ways that neither the data subject nor the controller can foresee. Nigeria's Data Protection Act 2023 (NDPA) adopts a consent model closely aligned with the European Union's General Data Protection Regulation, in a context marked by dependence on foreign platforms, state digital identity mandates and data-driven lending. This study asks whether consent can do the work the Act assigns it under these conditions. Its objectives were to identify the distinct ways in which consent fails under AI, to test the NDPA against those failures and to propose reforms for Nigeria and other African data protection regimes. The study adopted a doctrinal and normative research design with a comparative element. It analysed primary legal sources, including the NDPA, the Nigerian Constitution, the GDPR, the Malabo Convention and selected African and Asian statutes, together with a purposive sample of 28 peer-reviewed journal articles published between 2023 and 2026, each verified against its Crossref publisher record and screened for retractions. The analysis identifies three failures. Consent fails epistemically because people cannot know what will be inferred about them; structurally because they consent from positions of dependence on platforms, lenders, employers and the state; and relationally because inferences about one person are drawn from other people's data. The NDPA requires informed and free consent but addresses none of these failures adequately, as it is silent on inferences, does not regulate conditional consent or manipulative design, and provides no collective mechanisms. The study argues that consent should be retained but narrowed, and recommends guidance treating inferences as personal data, a presumption against consent conditioned on essential services, limits on sensitive inferences, published impact assessments and recognition of representative bodies and collective data governance.
References
Alakitan, M., & Makinde, E. (2025). Where are the ethical guidelines? Examining the governance of digital technologies and AI in Nigeria. Policy & Internet, 17(1), Article e416. https://doi.org/10.1002/poi3.416
Aloamaka, P. C. (2025). A critical analysis of the Nigeria Data Protection Act 2023: Elevating standards to global norms. UCC Law Journal, 4(2), 242–263. https://doi.org/10.47963/ucclj.v4i2.1724
Arowolo, G. A. (2025). Safeguarding the rights to privacy and digital protection of children in Africa: Nigeria and South Africa in focus. African Journal on Privacy & Data Protection, 2(1), 126–152. https://doi.org/10.29053/ajpdp.v2i1.0007
Brough, A. R. (2026). When the vault is never opened: AI-enabled inference and the future of consumer privacy. Consumer Psychology Review. Advance online publication. https://doi.org/10.1002/arcp.70014
Chen, M., & Chen, M. (2025). Trust, privacy fatigue, and the informed consent dilemma in mobile app privacy pop-ups: A grounded theory approach. Journal of Theoretical and Applied Electronic Commerce Research, 20(3), Article 179. https://doi.org/10.3390/jtaer20030179
Collaco, A. M. (2025). The illusion of choice: Re-imagining digital consent in India through a feminist lens. Journal of Data Protection & Privacy, 7(4), 346. https://doi.org/10.69554/kihh4415
Davis, T., & Trott, W. (2024). The regulation of artificial intelligence through data protection laws: Insights from South Africa. African Journal on Privacy and Data Protection, 1(1). https://doi.org/10.29053/ajpdp.v1i1.0010
Di Porto, F., & Egberts, A. (2023). The collective welfare dimension of dark patterns regulation. European Law Journal, 29(1–2), 114–141. https://doi.org/10.1111/eulj.12478
Fia, T., & Van Maanen, G. (2025). Through thick and thin: Data commons, community and the struggle for collective data governance. Technology and Regulation, 2025, 114– 136. https://doi.org/10.71265/tk2x3d39
Genga, S. (2025). A review of the adequacy of Kenya's and South Africa's data protection legal frameworks in protecting persons with disabilities from artificial intelligence algorithm discrimination. African Journal on Privacy & Data Protection, 2(1), 41–60. https://doi.org/10.29053/ajpdp.v2i1.0003
Gupta, I., & Naithani, P. (2023). What is left of consent when it is deemed consent: A data protection experiment in India. Journal of Data Protection & Privacy, 6(1), 71. https://doi.org/10.69554/yvka2636
Hurshman, C. (2026). The right to privacy as a right to obscurity: On big data, inferences, and attention. Philosophy & Technology, 39(2), Article 56. https://doi.org/10.1007/s13347-026-01060-1
Jimoh, M. (2024). The quest for information privacy in Africa: A critique of the Makulilo-Yilma debate. African Journal on Privacy and Data Protection, 1(1), 1–17. https://doi.org/10.29053/ajpdp.v1i1.0002 Kramcsák, P. T. (2023). Can legitimate interest be an appropriate lawful basis for processing artificial intelligence training datasets? Computer Law & Security Review, 48, Article 105765. https://doi.org/10.1016/j.clsr.2022.105765
Krishna, D. (2025). Opinion: Towards a legal reconceptualization of algorithmic 'inferences' as 'collection' of personal data under the GDPR. Global Privacy Law Review, 6(2), 80–83. https://doi.org/10.54648/gplr2025017
Magrani, E., & Rodrigo de Miranda, P. (2025). The right to reasonable inferences in automated decision systems as an unfolding of the fundamental right to the protection of personal data in Brazil and beyond. International Review of Law, Computers & Technology, 39(1), 75–94. https://doi.org/10.1080/13600869.2024.2351676
Mahmoud, R. F., Yusuf, E., & Olohungbebe, M. (2025). Blockchain and data privacy in Nigeria: Reconciling innovation with the Nigeria Data Protection Act 2023. AGORA International Journal of Juridical Sciences, 19(2), 174–190. https://doi.org/10.15837/aijjs.v19i2.7372
McGarrigle, J., Torrance, J., Quigley, M., & Dymond, S. (2026). Consent banners, dark patterns, and GDPR infringements in online gambling: Evidence from a systematic audit and online experiment. Computers in Human Behavior Reports, 23, Article 101270. https://doi.org/10.1016/j.chbr.2026.101270
McLachlen, R. (2023). Reasonable expectations make unreasonable inferences: The reasonable expectation threshold is a legal doctrine unequal to the menace to privacy posed by mass surveillance and algorithmic analysis. Manitoba Law Journal, 45(6), 20. https://doi.org/10.29173/mlj1356
Mohammed, S. (2026). Human rights and algorithmic accountability under the Nigeria Data Protection Act 2023. Scholarly Journal of Advanced Legal Research, 6(1), 1–9. https://doi.org/10.46654/6102-1848 Mühlhoff, R. (2023). Predictive privacy: Collective data protection in the context of artificial intelligence and big data. Big Data & Society, 10(1). https://doi.org/10.1177/20539517231166886
Naithani, P., & Gupta, I. (2025). An idea of inclusive and representative consent framework: Bringing data subjects to data protection discourse. International Data Privacy Law, 15(1), 32–47. https://doi.org/10.1093/idpl/ipaf003
Novazi, Z. (2026). Targeted and invisible: Algorithmic advertising under South African law and the AU's Malabo Convention. South African Yearbook of International Law, 51. https://doi.org/10.25159/2521-2583/22280
Olorunju, N., & Adams, R. (2024). African data trusts: New tools towards collective data governance? Information & Communications Technology Law, 33(1), 85–98. https://doi.org/10.1080/13600834.2023.2260678
Salami, A. O. (2024). Artificial intelligence, digital colonialism, and the implications for Africa's future development. Data & Policy, 6, Article e67. https://doi.org/10.1017/dap.2024.75
Sarara, M. C. (2026). Is consent truly informed? A critical analysis of consent under the Tanzania Personal Data Protection Act, 2022. East African Journal of Law and Ethics, 9(1), 454–466. https://doi.org/10.37284/eajle.9.1.4870
Sprigman, C. J., & Tontrup, S. (2024). Privacy decision-making and the effects of privacy choice architecture: Experiments toward the design of behaviorally-aware privacy regulation. Journal of Empirical Legal Studies, 21(3), 577–631. https://doi.org/10.1111/jels.12391
Yilma, K. (2023). African Union's data policy framework and data protection in Africa. Journal of Data Protection & Privacy, 5(3), 209. https://doi.org/10.69554/ufcb9301 Legislation and instruments African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), adopted 27 June 2014. Constitution of the Federal Republic of Nigeria 1999 (as amended), s. 37. Data Protection Act 2019 (No. 24 of 2019) (Kenya). Digital Personal Data Protection Act 2023 (No. 22 of 2023) (India). Nigeria Data Protection Act 2023 (Nigeria). Personal Data Protection Act 2022 (Tanzania). Protection of Personal Information Act 4 of 2013 (South Africa). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 4 May 2016, 1–88.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 IIAR Journal of Law, Ethics, and Policy
This work is licensed under a Creative Commons Attribution 4.0 International License.
