Microsoft secretly tracked a child's device with cookies in Austria, now it has four weeks to comply: "Tracking minors clearly isn't privacy-friendly."

At the height of the COVID-19 pandemic, schools rapidly shifted to online platforms like Microsoft 365 Education and Google Workspace for Education to ensure students weren't held back from learning.

In June 2024, None of Your Business (noyb), a European Digital Rights non-profit organization based in Vienna, Austria, filed two complaints concerning Microsoft's 365 Education in schools with the Austrian DSB.

The digital privacy group claimed that Microsoft was illegally tracking students via its 365 Education platform, further claiming that the company had attempted to shift responsibility for access to local schools.

The first complaint was decided in October 2025, marking a significant victory for the digital privacy group, as the Austrian data protection authority (DSB) ruled that Microsoft had violated the right of access under Article 15 of the GDPR.

Microsoft was ordered by the authority to provide more information about the data transmitted. It was also required to provide clear explanations of what it meant when using the terms "internal reporting," "business modeling," and "improvement of core functionality."

And now, the authority has decided on the second complaint about Microsoft's alleged use of unlawful tracking cookies in its 365 Education platform. The authority established that Microsoft had acted unlawfully by placing tracking cookies on the devices of a minor using its 365 Education platform.

While speaking to The Register, a Microsoft spokesman indicated that:

"Microsoft 365 for Education meets all required data protection standards and institutions in the education sector can continue to use it in compliance with GDPR. We are reviewing the Austrian data protection authority's latest decision and will decide on next steps in due course."

To that end, Microsoft has four weeks to comply and stop using tracking cookies on the devices of the minor. The school and the Austrian Ministry of Education claimed that they weren't aware of Microsoft using tracking cookies on minors before "noyb" raised the issue.

Should Microsoft be punished for tracking kids? Share your thoughts in the comments and cast your vote!

Follow Windows Central on Google News to keep our latest news, insights, and features at the top of your feeds!