Microsoft told to stop tracking pupils in Austria as watchdog backs privacy campaign

Austria’s data protection authority has ordered Microsoft to stop using tracking cookies in its education software, according to privacy campaigners, marking the latest regulatory setback for the US technology group. The European Center for Digital Rights, known as Noyb, said the ruling follows two complaints it filed against Microsoft in 2024, arguing that education software widely used in schools breached children’s data protection rights, as reported by AFP.

Last year, Austria’s data protection authority, the DSB, determined that Microsoft unlawfully tracked students through its education software and required the company to grant users access to their data. In its latest decision, dated January 21 and shared by Noyb, the DSB found that Microsoft lacked a legal basis to process personal data and ordered it to stop, within four weeks, the use of cookies that are not technically necessary.

Noyb said cookies that analyse user behaviour for advertising and other purposes had been installed on students’ devices without consent, and stated that tracking minors was not compatible with privacy protections.

A Microsoft spokesperson told AFP the company was reviewing the decision, adding that Microsoft 365 for Education meets required data protection standards and that educational institutions can continue using the service in compliance with EU data protection rules.

Noyb has launched hundreds of legal cases that have often prompted action by regulators against major technology firms. The organisation began its work in 2018 following the introduction of the European Union’s General Data Protection Regulation, which aims to strengthen individuals’ control over how their personal information is used.