Microsoft ordered to stop tracking schoolchildren without consent

The Austrian data protection authority (DPA) has ruled that Microsoft unlawfully installed tracking cookies on a minor's device through its Microsoft 365 Education platform, a violation of the EU General Data Protection Regulation (GDPR). The decision follows a complaint in 2024 by the privacy advocacy group NOYB, which claimed the software was used to monitor pupils without consent. According to Microsoft’s own documentation, these cookies were designed to analyse user behaviour and collect browser data for advertising purposes.

The DPA rejected Microsoft’s assertions that the case should be addressed in Ireland, determining that the US parent company, not the Irish subsidiary, makes the relevant decisions regarding these products. Consequently, Microsoft has been ordered to cease tracking the complainant within four weeks. Both the school involved and the Austrian Ministry of Education stated they were unaware of the tracking activities prior to the legal challenge.

The ruling could have significant implications across Europe, where millions of students, teachers, and businesses use Microsoft 365. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.