Microsoft secretly tracked a child’s device with cookies in Austria, now it has four weeks to comply: “Tracking minors clearly isn’t privacy-friendly.”

by

When the COVID-19 pandemic was at its worst, schools quickly moved to online learning tools like Microsoft 365 Education and Google Workspace for Education so students could continue their education.

In June 2024, the European digital rights group None of Your Business (noyb), based in Vienna, Austria, submitted two complaints to the Austrian Data Protection Authority (DSB) regarding Microsoft’s 365 Education software used in schools.

A digital privacy group accused Microsoft of secretly monitoring students through its 365 Education platform. They also stated that Microsoft tried to make local schools responsible for controlling access to the data.

In October 2025, a ruling in the first complaint proved to be a win for digital privacy advocates. Austria’s data protection authority determined that Microsoft had broken GDPR rules by denying someone access to their data, as guaranteed by Article 15.

The authorities have asked Microsoft for more details about the data it sends and receives. They also want clear definitions of terms Microsoft uses, specifically “internal reporting,” “business modeling,” and “improvement of core functionality.”

The regulatory body has ruled on a second complaint regarding Microsoft’s use of tracking cookies within its 365 Education platform. They determined that Microsoft illegally placed these cookies on a child’s device while they were using the platform.

Monitoring children’s online activity raises serious privacy concerns. Microsoft appears to prioritize privacy only when it benefits their public image and marketing efforts.

Felix Mikolasch, data protection lawyer at noyb

While speaking to The Register, a Microsoft spokesman indicated that:

As a big Microsoft 365 for Education user, I was relieved to hear that it fully complies with data protection rules like GDPR, so schools and universities can keep using it safely. Microsoft is looking into the recent decision from Austria’s data protection authority and will figure out what to do next, but everything seems good for now!

Microsoft has four weeks to fix the problem and stop tracking the online activity of the student. The school and Austria’s education ministry say they didn’t know Microsoft was using these tracking methods on children until the privacy group, noyb, brought it to their attention.

Read More

2026-01-28 16:09