Austrian regulator orders Microsoft to stop tracking a school pupil
The Austrian data protection authority found Microsoft illegally placed tracking cookies on a minor using Microsoft 365 Education and ordered the company to cease the tracking within four weeks.
- The DSB ruled Microsoft placed tracking cookies on a pupil's device without consent.
- Microsoft documentation shows the cookies analysed behaviour, collected browser data and were used for advertising.
- Microsoft has four weeks to stop the tracking identified in the complaint.
- The decision follows two noyb complaints filed in 2024 and a prior DSB finding in October 2025 about GDPR access rights.
- The regulator said Microsoft US, not Microsoft Ireland, makes the key decisions for Microsoft 365 products in Europe, raising wider compliance risks for millions of users.