Trending 
Austria’s data protection authority has found that Microsoft “illegally” tracked students using its education software and must provide them with access to their personal data, according to the privacy campaign group Noyb.
Noyb (None of Your Business), which complained in 2024, accused Microsoft 365 Education of violating EU data protection laws designed to protect children.
The group said the software installed cookies that collected browser data, which were subsequently used for advertising purposes, a practice potentially affecting millions of students and teachers across Europe.
In a statement on Friday, October 10, Noyb said the regulator’s decision, issued earlier this week, confirms that Microsoft 365 Education “illegally tracks students and uses student data for Microsoft’s own purposes.”
Users, including a minor represented by her father, must now be granted access to their personal data.
The Austrian authority confirmed it issued the ruling on Wednesday but provided no further details.
Noyb criticised Microsoft for previously attempting to shift responsibility to schools or other national institutions when users requested access to their data.
“The decision highlights the lack of transparency with Microsoft 365 Education,” said Noyb lawyer Felix Mikolasch. “It is almost impossible for schools to inform students, parents and teachers about what is happening with their data.”
Microsoft responded by saying it would review the decision and determine next steps.
The company insisted that “Microsoft 365 for Education meets all required data protection standards, and institutions in the education sector can continue to use it in compliance with GDPR,” referring to the EU’s General Data Protection Regulation.
Founded by privacy activist Max Schrems, Noyb has filed more than 800 complaints against technology companies across multiple jurisdictions, often prompting regulatory action to enforce GDPR protections for internet users.
