Austrian regulator finds Microsoft illegally tracked students via education software
Austria's data protection regulator found that Microsoft illegally tracked students via Microsoft 365 Education by failing to obtain consent for cookies and denying access to data collected. The finding came after a complaint by a privacy advocacy group on behalf of a parent and student.
What happened
Austria's Datenschutzbehörde ruled that Microsoft illegally tracked students using Microsoft 365 Education by failing to give them access to their data and using cookies without consent.
The decision came in response to a 2024 complaint lodged by the Austrian privacy advocacy group noyb, which accused Microsoft of violating the General Data Privacy Regulation in its handling of children's data.
Reported impact
The father of a minor whose school uses the software said he did not consent to the cookies and could not get information about how his child's data was being used.
The regulator noted the decision highlights the lack of transparency in Microsoft 365 Education, making it nearly impossible for schools to inform students, parents and teachers about what is happening with their data.
Governance controls
The regulator has ordered Microsoft to give the complainant access to their data and to begin to explain more clearly how it uses data it collects.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.