Austria Orders Microsoft to Stop Tracking Students in School Software

2026-01-27 data

Vienna, Tuesday, 27 January 2026.
Austria’s data protection authority ruled that Microsoft illegally installed tracking cookies on student devices through its Microsoft 365 Education platform without consent. The cookies analyze behavior, collect browsing data, and enable targeted advertising - affecting potentially millions of European students using the software daily for schoolwork.

Regulatory Decision Targets Student Privacy Violations

On January 21, 2026, Austria’s Data Protection Authority (DSB) issued a decisive ruling against Microsoft Corporation, finding the technology giant violated the General Data Protection Regulation (GDPR) by placing non-essential tracking cookies on student devices [4]. The ruling specifically addressed Microsoft 365 Education, which encompasses products including Word, Teams, and SharePoint used extensively in Austrian schools [6][7]. The cookies in question—identified as MC1, FPC, MSFPC, MicrosoftApplicationsTelemetryDeviceId, and ai-session—analyze user behavior and collect browser-related data for advertising and analytics purposes [4]. Critically, Microsoft had not claimed during the proceedings that it obtained consent for installing these tracking mechanisms [6][7].

Four-Week Compliance Deadline and Legal Framework

The Austrian authority ordered Microsoft to cease tracking activities within four weeks of the January 21 decision, establishing a compliance deadline of February 18, 2026 [2][4][7]. The DSB emphasized that European Union law requires explicit consent for non-essential cookies, particularly when involving minors [4]. The ruling clarified that while Microsoft 365 Education’s core educational functions remain permissible, tracking cookies for advertising, analytics, and behavioral analysis purposes are technically unnecessary and therefore require prior consent [6][7]. Privacy advocacy organization noyb, which filed the original complaint on behalf of a minor student in June 2024, hailed this as their second victory against Microsoft following an October 2025 ruling on data access rights violations [2][3].

Corporate Responsibility and Jurisdictional Clarity

The Austrian decision resolved a significant jurisdictional dispute by ruling that Microsoft Corporation in the United States, rather than its Irish subsidiary, bears responsibility for product design and data processing decisions in Microsoft 365 Education [2][4][7]. This determination carries substantial implications, as technology companies frequently argue they fall under Irish jurisdiction due to the Irish Data Protection Commission’s reportedly lenient enforcement approach [2][3]. Felix Mikolasch, data protection lawyer at noyb, characterized the ruling as evidence that “Microsoft doesn’t care much about privacy, unless it is for their marketing and PR statements” [2]. Both the affected school and Austria’s Ministry of Education stated they were unaware of the tracking cookie installations prior to the noyb complaints [2][3][6].

European-Wide Implications for Educational Technology

The ruling’s impact extends far beyond Austria’s borders, given Microsoft 365 Education’s widespread adoption across European schools serving millions of students and teachers [2][3][8]. German data protection authorities have previously determined that Microsoft 365 falls short of GDPR requirements, suggesting a broader pattern of compliance issues [2]. Max Schrems, noyb’s founder, emphasized that “companies and authorities in the EU should use compliant software,” warning that Microsoft has “once again failed to comply with the law” [2][8]. The decision arrives amid heightened scrutiny of educational technology platforms, as privacy advocates argue that Microsoft’s dominance in schools creates “a new generation of future ‘loyal’ customers” through early exposure to company products [3]. The Austrian Ministry of Education maintains framework agreements with Microsoft’s European operations to provide cloud services for IT-supported instruction in federal schools [6][7].

Bronnen

privacy regulation educational technology