Austria’s Privacy Watchdog Finds Microsoft Illegally Tracked Students With Cookies; Company Responds

Microsoft has found itself in hot water yet again in the EU. To catch you up, back in June 2024, European digital rights group NOYB (None of Your Business) filed two complaints with Austria’s Data Protection Authority (DSB). Back then, NOYB accused Microsoft of illegally tracking students through its Microsoft 365 Education platform.

Austrian regulator rules Microsoft unlawfully tracked students using cookies

According to the complaint, Microsoft also attempted to push responsibility for data access and tracking onto local schools. Well, the data protection agency ruled in favor of NOYB in October 2025. The regulator found that Microsoft had violated Article 15 of the GDPR, which guarantees users the right to access their personal data.

As part of the ruling, the Austrian DSB asked Microsoft to provide information about what data was being transmitted. The regulator also ordered the Redmond giant to explain vague internal terms like “internal reporting,” “business modeling,” and “improvement of core functionality.” That was about the first complaint.

Now, the ruling of the second complaint, arguably more serious, is also here (via Windows Central). The Austrian DSB has ruled that Microsoft acted unlawfully by placing tracking cookies on the device of a minor using Microsoft 365 Education.

The authority concluded that this practice violated GDPR rules, especially around the protection of children’s data. A data protection lawyer at NOYB, Felix Mikolasch, says, “Tracking minors clearly isn’t privacy-friendly,” adding that Microsoft appears to prioritize privacy only in marketing statements.

Microsoft’s response

Meanwhile, Microsoft’s spokesperson, in a statement to The Register, said that Microsoft 365 for Education meets GDPR requirements. They also assured that schools can continue using the platform legally, and confirmed that the company is currently reviewing the decision and will decide on the next steps soon.

Microsoft now has four weeks to comply with the ruling and must stop using tracking cookies on the affected minor’s device. Notably, both the school involved and the Austrian Ministry of Education stated that they were unaware of any tracking until NOYB raised the issue.