Austria’s DSB finds that Microsoft violated EU privacy law in educational deployment

Austria’s data protection authority ruled that Microsoft had breached EU privacy laws by placing tracking cookies and collecting student data via its Microsoft 365 Education platform without appropriate consent, thereby failing to protect data access rights. 

‍

The regulator held the company accountable following a complaint by a student’s father. The decision emphasizes that software providers deploying educational solutions must ensure compliance with the GDPR, particularly when minors are involved. This case may set a precedent for how educational tech platform providers handle personal data in the EU.

‍