Age Verification for Gaming Platforms: Lessons from Lagos Life

Introduction

The rapid rise of Lagos Life, a browser-based life-simulation game, has brought renewed attention to a familiar challenge in digital governance: how can platforms protect users from online harm while ensuring that their age-verification systems respect privacy?

In a series of reports published in October 2026, the Foundation for Investigative Journalism (FIJ) reported that Lagos Life had attracted more than seven million users and had displayed advertisements linking users to a website that FIJ described as facilitating the unlawful procurement of sexual services. Following the investigation, the advertisements were removed. FIJ later reported complaints about fraudulent practices and sexual innuendo in in-game chats, and introduced an 18-and-over access policy.

These developments raise important questions about platform accountability. A game with colourful graphics and cartoon-style characters may appeal to younger audiences, even where its operator does not intend to target children. Meanwhile, public chat, user-generated content, third-party advertising and in-game transactions can expose users to risks that extend beyond the game itself.

The central question is therefore not simply whether Lagos Life has adopted an age restriction, but whether its access controls, content moderation and data governance arrangements are adequate to give that restriction practical effect.

An Age Restriction on Paper Is Not an Effective Age Verification for Gaming Platform

An age restriction in a platform’s terms of service establishes a contractual rule. It does not, by itself, demonstrate that the operator can reliably prevent underage users from accessing the service.

One common approach is self-declaration, under which users enter a date of birth or confirm that they meet a minimum-age requirement. Although inexpensive and relatively unobtrusive, this method depends substantially on the honesty of the person providing the information. It can therefore be inadequate where the consequences of underage access are significant.

FIJ’s 11 October 2026 report stated that Lagos Life introduced a date-of-birth prompt after announcing its 18+ policy. That is a relevant first step, but a date-of-birth prompt is not necessarily proof of age. A user may enter a false date, and the effectiveness of the measure depends on the checks and consequences attached to it.

The appropriate level of age assurance should reflect the platform’s actual risk profile. A service offering passive, single-player entertainment presents a different risk from one that combines public chat, direct messaging, user-generated content, financial transactions and third-party advertisements.

Where users can communicate with strangers, share personal information or encounter unsolicited financial offers, the risks may include impersonation, phishing, fraud, grooming and exposure to inappropriate material. Cartoon avatars do not eliminate these risks; they can make it more difficult for users to assess who is communicating with them.

Accordingly, the introduction of an 18+ rule should be treated as the beginning of a broader safety programme, rather than evidence that the underlying risks have been resolved.

What does Nigerian Law Say about Age Verification for Gaming Platforms?

Several aspects of Nigerian law are relevant to age assurance, children’s data and online platform safety.

1. Data protection and children’s personal data

The Nigeria Data Protection Act 2023 (NDPA) establishes specific safeguards for the processing of children’s personal data.

Under section 31(1), where a data controller relies on consent as the lawful basis for processing a child’s personal data, it must obtain the consent of the child’s parent or legal guardian, as applicable. Section 31(2) separately requires the controller to apply appropriate mechanisms to verify age and consent, considering available technology. Section 31(3) expressly recognises government-approved identification documents as an appropriate verification mechanism. These provisions must be read together with the exceptions in section 31(4) and the other lawful bases for processing under section 25.

The distinction matters. The Act does not impose an unconditional requirement to obtain parental consent for every instance of processing a child’s personal data. Rather, parental or guardian consent is required where the controller relies on consent, subject to the statutory exceptions. Regardless of the lawful basis relied upon, the controller must comply with the applicable data protection principles and other relevant obligations.

Section 65 of the NDPA defines a child by reference to the Child’s Rights Act 2003, while section 277 of that Act defines a child as a person under the age of 18. Consequently, a platform that attracts users below 18 cannot necessarily avoid its obligations simply by declaring that its service is intended for adults.

The broader requirements of sections 24 and 28 of the NDPA are also important. Section 24 requires personal data to be processed fairly, lawfully and transparently, for specified and legitimate purposes, and in a manner that limits collection to what is necessary. Section 28 requires a data privacy impact assessment (DPIA) before processing that is likely to result in a high risk to the rights and freedoms of data subjects. Where the assessment indicates that a high risk remains despite the proposed safeguards, the controller must consult the Nigeria Data Protection Commission (NDPC) before proceeding.

For a gaming platform considering identity verification, behavioural monitoring, facial age estimation or extensive analysis of user interactions, these provisions support a documented assessment of necessity, proportionality, security and potential harm.

The NDPC’s Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025, particularly Article 29 on DPIAs, provides further implementation guidance on assessing processing risks. Its provisions on vulnerable data subjects and technology-related processing are relevant to platforms that may attract children or other users requiring additional safeguards.

2. Child protection and the best interests of the child

The Child’s Rights Act 2003 provides an additional framework for evaluating risks to children.

Section 1 makes the best interests of the child the primary consideration in actions concerning a child, whether undertaken by an individual, public or private body, institution or service. Section 2 addresses the protection and care necessary for a child’s well-being. Section 11 protects the child’s right to dignity, while sections 35 and 36 address harmful publications and associated penalties.

These provisions do not automatically establish that a gaming platform is liable whenever a child encounters inappropriate content. Liability depends on the applicable legal provisions and the facts. They nevertheless provide an important framework for evaluating the protection of children in digital environments, particularly where a service permits interaction with strangers or exposes users to potentially harmful material.

The territorial application of child-protection legislation must also be considered carefully. The Child’s Rights Act operates alongside state-level child-rights legislation, and its application should be assessed in light of the relevant jurisdiction and circumstances.

For operators, the practical lesson is that child safety should be addressed during product design and risk assessment, rather than only after an incident attracts public attention.

3. Consumer protection, advertising and cybercrime

The Lagos Life episode also demonstrates the risks associated with third-party advertising and user-generated content.

Under the Federal Competition and Consumer Protection Act 2018, including its provisions on consumer rights and unfair, misleading or unconscionable market conduct, the legality of particular advertising and commercial practices may require scrutiny. Whether a specific advertisement breaches the Act depends on its content, context and the applicable legal requirements.

The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, may also be relevant where conduct amounts to a criminal offence involving digital systems. For example, section 14 addresses computer-related forgery, while section 15 addresses computer-related fraud. These provisions should not, however, be treated as imposing general liability on a platform merely because fraudulent conduct occurs within its service.

Similarly, the appearance of an advertisement for an allegedly unlawful service does not, without more, establish the operator’s criminal liability. The relevant questions include the operator’s knowledge, involvement, applicable statutory provisions and response to the identified content.

Nevertheless, platforms that monetise advertising inventory should have appropriate controls for reviewing advertisements, screening advertising partners, responding to complaints and removing unlawful or harmful material. Their advertising policies should be reflected in actual operational processes, rather than existing only in contractual terms.

The Verification Paradox: Protecting Children Without Undermining Privacy

More rigorous age assurance can reduce the risk of underage access, but it can also introduce new privacy and security risks.

Government-issued identity documents, identity numbers and facial age-estimation systems may involve the collection or processing of personal data that is unnecessary for the platform’s underlying entertainment service. Retaining such information can increase the consequences of a data breach, create opportunities for misuse and expose users to risks disproportionate to the purpose of verification.

The challenge is therefore not to collect as much information as possible, but to establish an appropriate level of confidence about a user’s age while minimising the personal data processed.

A proportionate, layered approach should consider the following measures.

1. Match verification to risk. Operators should assess the risks associated with each feature. Public chat, direct messaging, financial transactions and access to adult-oriented content may warrant stronger assurance than low-risk gameplay. The assessment should consider the platform’s audience, foreseeable misuse and the consequences of underage access.

2. Apply data minimisation and retention limits. Where possible, a verification process should return an age threshold or an over-18 result without disclosing the user’s full identity. If an external provider verifies age, the platform should consider whether it can receive only the necessary verification outcome. Identity documents, images and other supporting information should not be retained longer than necessary for a specified, lawful purpose.

3. Evaluate third-party age-assurance providers. External providers may help reduce the amount of identity data handled directly by a gaming operator. However, outsourcing does not eliminate the operator’s data protection responsibilities. Contracts, security arrangements, retention practices, international transfers and the provider’s own processing activities should be assessed before deployment.

4. Control the advertising ecosystem. Advertising partners should be subject to appropriate due diligence, clear content restrictions and effective monitoring. Operators should maintain a process for reviewing complaints, suspending questionable advertisements and removing unlawful or harmful material promptly. Where third parties supply advertising content, the operator should establish clear contractual responsibilities and practical enforcement mechanisms.

5. Moderate communications and respond to abuse. Reporting tools, user blocking, impersonation controls and proportionate automated detection can help identify suspicious messages and inappropriate content. Moderation systems should be supported by trained personnel, clear escalation procedures and meaningful enforcement. Users should also be warned against disclosing passwords, identity documents, financial information or other sensitive details to strangers.

6. Conduct and document a DPIA where required. A DPIA should assess the purpose of age verification, the reliability of the proposed method, the personal data involved, the risks to users, less intrusive alternatives and the safeguards available. The assessment should be undertaken before high-risk processing begins and revisited when the platform introduces materially different features or technologies.

7. Make safety information accessible. Terms of service and privacy notices should explain age requirements, verification processes, reporting channels and the handling of personal data in language users can understand. Where children may access a service, communications should be designed with their age and understanding in mind.

These measures are not interchangeable, nor does any single measure guarantee safety. Their effectiveness depends on how they work together and whether they are appropriate to the risks presented by the service.

Lessons for Gaming Operators and Digital Platforms

The Lagos Life episode offers several broader lessons for operators of gaming platforms and other interactive digital services.

First, design for foreseeable risks before scaling. Rapid user growth can magnify weaknesses in onboarding, moderation and advertising controls. Age assurance and platform safety should be considered during product development, not introduced solely in response to public criticism.

Second, assess the actual audience, not merely the intended audience. A platform’s stated minimum age does not establish that its users are all adults. Operators should consider available evidence about their audience and the foreseeable likelihood of underage access when deciding which safeguards are appropriate.

Third, treat third-party content as part of the platform’s risk environment. Advertising networks, content partners and user communications can introduce risks that the operator did not create directly. Appropriate contractual protections must be accompanied by monitoring, escalation and enforcement processes.

Fourth, integrate privacy and safety by design. Age assurance should not become a justification for indiscriminate collection of identity documents or biometric information. The objective is to achieve a reasonable level of assurance through a method that is necessary, proportionate and secure.

Fifth, distinguish policy adoption from effective implementation. A revised terms-of-service clause may be a useful first step, but operators should also be able to demonstrate how age restrictions are enforced, how complaints are investigated and how recurring risks are addressed.

Finally, prepare for regulatory scrutiny. Documented risk assessments, appropriate contracts, moderation records, retention schedules and incident-response procedures can help demonstrate accountability. These records should reflect actual operational practices rather than merely describe intended controls.

Conclusion

The Lagos Life episode illustrates a central principle of digital governance: a platform’s safety obligations cannot be discharged simply by announcing a new rule.

An 18+ restriction may establish a clear boundary, but its effectiveness depends on the controls supporting it. Age assurance, advertising oversight, communication safeguards and responsible data handling must work together to address foreseeable risks.

For Nigerian gaming operators, the NDPA 2023, the Child’s Rights Act 2003 and applicable consumer-protection and cybercrime legislation provide important parts of the legal framework. Compliance requires more than collecting additional personal information or inserting protective language into terms of service. It requires an evidence-based assessment of risks, proportionate safeguards and demonstrable accountability.

Ultimately, the question for Lagos Life—and for other digital platforms experiencing rapid growth—is not whether a policy exists, but whether the platform can show that its controls work in practice without creating unnecessary risks to the privacy and rights of its users.

This article is for general information only and does not constitute legal advice. The factual account of Lagos Life is based on FIJ’s published reports from 6, 7 and 11 October 2026 and has not been independently audited.