Austria's Data Protection Authority Rules Microsoft 365 Education Unlawfully Tracked Schoolchildren

Following two 2024 complaints filed by Austrian privacy group noyb on behalf of a public-school student, the Austrian Data Protection Authority (Datenschutzbehörde, DSB) issued two decisions finding that Microsoft 365 Education — used by millions of students and teachers across the European Economic Area — processed children's personal data unlawfully.

In its first decision (October 2025, case GZ D135.027), the DSB found that Microsoft, the student's school and Austria's Federal Ministry of Education acted as joint controllers and had violated Articles 13, 15 and 26 GDPR by failing to give the student full information about, and access to, data shared with third parties including OpenAI, LinkedIn and Xandr, and by using tracking cookies without consent.

In a second decision (January 2026, case GZ D135.026), the DSB again found Microsoft had placed unlawful tracking cookies on a minor's device and ordered the company to stop tracking the complainant within four weeks. noyb lawyer Felix Mikolasch said "tracking minors clearly isn't privacy-friendly," while noyb chair Max Schrems said "companies and authorities in the EU should use compliant software." Both decisions have been challenged by Microsoft before Austria's Federal Administrative Court and are not yet final.

Read the full analysis: https://noyb.eu/en/noyb-win-microsoft-ordered-stop-tracking-school-children