Nigeria NDPA 2023 · MIT licensed · Open source
Cookie Consent Banner for Nigerian Websites — NDPA 2023 Compliant
A drop-in React cookie consent banner built for the Nigeria Data Protection Act 2023. Granular categories, audit log, easy withdrawal, version-bump re-prompt, and pluggable storage adapters for any backend. Free and open source.
Why a Nigeria-specific cookie consent banner?
Generic GDPR cookie banners do not satisfy Section 26 of the Nigeria Data Protection Act 2023, which requires consent to be specific, informed, freely given, and affirmative — with the right to withdraw at any time made as easy as the act of giving consent. The NDPR Toolkit cookie banner is built against the gazetted Act and the 2025 General Application and Implementation Directive (GAID), with audit-friendly defaults Nigerian DPOs can sign off on.
What you get
- Granular consent categories — necessary (always on), analytics, marketing, advertising, functional, with human-readable purpose descriptions for every category.
- Section 26 withdrawal — one-click access to a consent management dialog from any page; revoke specific categories without losing necessary cookies.
- Version-bump re-prompt — bump the consent version when your purposes change and every prior visitor gets re-asked. No stale consent.
- Audit log — every accept / reject / update is recorded with timestamp and version, satisfying NDPC record-keeping requirements.
- Storage adapters — localStorage, sessionStorage, cookie, API, or a custom backend via
StorageAdapter. Bring your own Prisma / Drizzle / Firestore / Supabase. - RSC-safe — ships
"use client"banners correctly so you can drop it into Next.js App Router without manual wrappers. - Multilingual — English (Nigeria), Yorùbá, Igbo, Hausa, and Pidgin locales out of the box; custom locales via a typed
mergeLocalehelper. - Accessible — WCAG 2.1 AA, full keyboard navigation, focus trap that restores focus on close,
prefers-reduced-motionrespected.
30-second install
pnpm add @tantainnovative/ndpr-toolkitThen drop the preset into your Next.js layout:
// app/layout.tsx
import { NDPRConsent } from '@tantainnovative/ndpr-toolkit/presets';
import '@tantainnovative/ndpr-toolkit/styles';
export default function RootLayout({ children }) {
return (
<html lang="en-NG">
<body>
{children}
<NDPRConsent />
</body>
</html>
);
}That's it — the banner appears on first visit, the preferences icon stays accessible site-wide, and every event is persisted to localStorage by default. For server-side persistence (recommended for fintech and health-tech), pass an apiAdapter and wire it to your existing user model.
Built for Nigerian apps
NDPR Toolkit is used by Nigerian fintech, insurtech, healthcare, and SaaS teams to satisfy the NDPC's compliance notices issued to licensed banks, insurance brokers, gaming operators, and pension funds. It is not legal advice — we recommend you have your DPO review the deployed consent surface — but it ships every piece of the consent stack the NDPC asks about during an audit, with the section references baked into the API.
Not sure if your consent flow already passes?
Take the free 5-minute NDPA audit. It scores your consent banner, DSR portal, breach process, and 5 other modules against the gazetted Act and gives you prioritised fixes.
Run the free NDPA audit →Frequently asked questions
Does the Nigeria Data Protection Act require a cookie consent banner?+
In practice, yes. NDPA 2023 Section 26 requires consent to be specific, informed, freely given and affirmative, and the NDPC’s 2025 General Application and Implementation Directive (GAID) requires opt-in before any non-essential cookies or trackers (analytics, marketing, advertising) are set. Only strictly necessary cookies are exempt, so most Nigerian websites that run analytics or ad pixels need a compliant banner.
Is a generic GDPR cookie banner enough for NDPA compliance?+
Not reliably. Most GDPR banners are not built against NDPA Section 26, frequently omit the “withdrawal as easy as consent” requirement, do not keep the audit log the NDPC asks for during reviews, and have no Nigerian-language support. The NDPR Toolkit banner is built against the gazetted Act and GAID 2025, with the section references baked into the API.
What cookie categories should a Nigerian consent banner support?+
Necessary cookies (always on, no consent required), plus separately toggleable analytics, marketing, advertising and functional categories. Each category should carry a plain-language purpose description so consent is genuinely informed, which is what Section 26 and the GAID require.
How do users withdraw cookie consent under the NDPA?+
Section 26 requires that withdrawing consent be as easy as giving it. The toolkit exposes a site-wide preferences dialog so a visitor can revoke any category at any time without losing necessary cookies, and every change is recorded with a timestamp and consent version for your records.
Is the NDPR Toolkit cookie consent banner free?+
Yes. It is MIT-licensed and fully open source — there are no per-seat, per-domain or per-pageview fees, unlike most commercial consent management platforms.
Does it work with Next.js App Router and server-side rendering?+
Yes. The banner ships the correct “use client” boundaries so it drops into the Next.js App Router without manual wrappers, and it supports reading consent server-side so the banner hydrates already-resolved with no flash of an un-consented UI.