On any given day in Nigeria, millions of people click “I agree” without reading the fine print, post location-tagged photos to social media, sign into conferences with their email addresses and transfer funds across blockchain wallets — rarely pausing to consider the invisible trail they leave behind.
At a recent BusinessDay Talk Exchange conversation on X Spaces titled “Privacy vs Access: Trade-offs Nigerians Make With Their Data Every Day”, cybersecurity experts, policy lawyers and technology leaders exposed a sobering picture of the modern data economy: one where convenience is abundant, awareness is thin, and the risks are compounding.
The trade-offs, they argued, are becoming more complex in the age of artificial intelligence.
For Peter Ndukwo, a blockchain security researcher ranked among the world’s leading vulnerability hunters, the AI wave is reshaping the threat landscape faster than many systems can adapt.
Artificial intelligence, he warned, has forced a rethink of cybersecurity frameworks once considered formidable. “We are already seeing some major hacks, and this is because of the impact of AI,” he said. “What the black-hat hackers would not do before, they can now do at scale.”
The concern is not theoretical. AI tools now allow attackers to automate phishing campaigns, scrape vast amounts of personal data and craft hyper-personalised deception at unprecedented speed. Ndukwo agreed with DataPro projections that 2026 could see a surge in phishing attacks, as AI lowers the technical barrier for would-be attackers.
“The AI transformation is making everything simpler, even for hackers,” he said. With enough data points — social media activity, transaction histories, public wallet addresses — criminals can mirror credible communications and lure victims into authorising transfers or revealing credentials.
Blockchain, often celebrated for anonymity, offers no blanket immunity. Wallet addresses are pseudonymous, not private. If someone identifies your wallet, Ndukwo explained, they can monitor inflows and outflows with precision. “As much as blockchain gives transparency, it also means there are privacy risks attached to it.”
In other words, the very openness that underpins trust in decentralised systems can expose users who underestimate the visibility of their financial footprint.
If technology amplifies risk, legal frameworks attempt to contain it. Hannah Adeyemi, a data privacy lawyer and certified data protection officer who joined the conversation, pointed out that consent which ought to be the bedrock of digital data processing, is often misunderstood or misapplied.
The Nigerian Data Protection Act 2023 sets clear conditions: consent must be specific, clear and freely given. Yet many companies bury users under sprawling privacy policies that bundle necessary and unnecessary permissions into a single “I accept” or “I agree” button.
“If I want to download an app and you’re saying I must click ‘I agree’ and there’s no option for me to say I don’t agree, then that’s not consent,” Adeyemi argued. “I’m being boxed into a corner.”
The absence of meaningful opt-in and opt-out mechanisms, she said, undermines the principle of free choice. Users who cannot withdraw consent or selectively decline data-sharing clauses are not exercising control; they are complying with a condition for access.
She urged Nigerians to scrutinise three overlooked clauses before clicking “accept”: jurisdiction (where disputes will be resolved), data-sharing arrangements (who else receives the information), and purpose limitation (whether data will be used beyond delivering the core service, including for training AI models).
The legal architecture may exist, but without transparency and enforcement, it risks becoming symbolic.
Speaking during the space, Gbolabo Awelewa, a digital cybersecurity and enterprise technology leader, noted that the problem extends far beyond legal compliance. It lies in habit.
“A lot of us don’t even know we’re trading off,” he said. The trade is rarely explicit. It is embedded in routine — shopping online, researching products, posting opinions, signing into events, placing bets, opening bank accounts.
Every interaction feeds a sprawling data journey. Once submitted, information moves from web servers to databases, to backup systems, to cloud storage. Depending on consent terms, it may even get to third-party analytics platforms and partner companies. At every point of this data replication, user exposure and vulnerability is exposed.
The average user, Awelewa explained, has little visibility into this chain reaction. Convenience masks complexity. “There’s something we want, and we quickly agree,” he said. Only later does the exchange become apparent when one starts receiving emails they did not subscribe to.
The footprint is not purely digital. Physical events, religious gatherings and corporate conferences also collect personal information. The boundaries between online and offline data ecosystems are increasingly porous.
Ridwan Oloyede, Emerging Technologies and Policy Lead at TechHive Advisory Africa, believes part of the confusion stems from overreach.
While obtaining consent is important, he argued, many organisations seek permission for everything — even when not legally required. The result is “consent fatigue”, where users reflexively click through requests they no longer read or understand.
“If you actually don’t need consent, don’t go for it,” Oloyede said. Over-collection creates new liabilities and erodes trust.
The deeper issue, he suggested, is awareness. Both businesses and consumers must better understand their obligations and rights under the law. Platforms should be designed to respect user choices in practical, not performative, ways.
What emerged from the discussion was not a narrative of technological doom, but of imbalance. Nigerians are participating enthusiastically in a digital marketplace that offers access, efficiency, and opportunity. Yet the asymmetry of information — between users and platforms, between individuals and AI-powered attackers — is widening.
AI is powering both innovation and exploitation. Legal safeguards exist in Nigeria but implementation remains unclear. The trade-off between privacy and access is no longer abstract. It is showing up in daily decisions — from accepting app permissions to unknowingly publishing a wallet address.
The question is not whether Nigerians will continue to exchange data for convenience. They will. The more pressing question is how fast stakeholders can drive awareness, regulation, and cybersecurity to ensure the bargain remains fair.
