Austria orders Microsoft to stop tracking school children, say privacy campaigners

Austria’s data protection authority has ordered Microsoft to stop using tracking cookies in education software, a privacy campaign group said Tuesday, marking its latest victory against the US tech giant.

The European Center for Digital rights, which goes by the acronym Noyb, for “None of Your Business,” filed two complaints against Microsoft in 2024, saying its education software that is widely used in schools violates data protection rights for children.

Last year, the Austrian data protection authority DSB determined that Microsoft “illegally” tracked students using its education software and must grant them access to their data.

In the latest ruling, dated January 21 and provided by Noyb, DSB found that Microsoft lacked a “legal basis” to process “personal data” and must therefore refrain “within four weeks from using cookies that are not technically necessary”.

Cookies, which analyse user behaviour for advertising and other purposes, were installed on students’ devices without consent, Noyb said.

“Tracking minors clearly isn’t privacy-friendly,” Felix Mikolasch, a data protection lawyer at Noyb, said in a statement.

A Microsoft spokesperson told AFP the company was reviewing the decision.

“Microsoft 365 for Education meets all required data protection standards and institutions in the education sector can continue to use it” in compliance with the EU’s data protection regulation, the spokesperson said.

Noyb has launched hundreds of legal cases that often prompt action from regulatory authorities against tech giants.

The group began working in 2018 with the advent of the EU’s landmark General Data Protection Regulation (GDPR), which aims to make it easier for people to control how companies use their personal information.