Austria’s data protection authority has barred Microsoft from using tracking cookies in education software, a privacy campaign group said on Tuesday.
The order was issued in response to two complaints filed
by online rights campaigners against Microsoft in 2024, saying the company’s education software violates data protection rights for children.
According to AFP, Austrian Data Protection Authority (DSB) last year determined that Microsoft “illegally” tracked students using its education software and must grant them access to their data.
In the latest ruling, issued on January 21 and provided by Noyb (European Center for Digital Rights), DSB found Microsoft lacked a “legal basis” to process “personal data” and must therefore refrain “within four weeks from using cookies that are not technically necessary”.
Noyb said the cookies, which analyse user behaviour and are used for advertising, were installed on the devices of a student without consent. “Tracking minors clearly isn’t privacy-friendly,” Felix Mikolasch, data protection lawyer at Noyb, said in a statement.
Noyb said that these cookies were not technically required to deliver the education service and were set without any valid legal basis under Article 6 of the GDPR (General Data Protection Regulation (GDPR).
According to TelecomLead, the decision not only orders Microsoft to halt such tracking practices but also exposes deeper structural problems around responsibility, transparency, and GDPR compliance in digital education across Europe.
Meanwhile, Microsoft has not issued a statement on the matter.
TelecomLead quoted Maartje de Graaf, data protection lawyer at Noyb, saying that Microsoft holds all key information about its data processing, yet points schools to handle transparency obligations and data subject rights.
Following the latest order, Microsoft has four weeks to comply with the Austrian authority’s order and stop using non-essential tracking cookies in Microsoft 365 Education without consent. The company can appeal the decision to Austria’s Federal Administrative Court.
