Cookies Are Not for Kids: Microsoft Must Stop Illegal Student Tracking
The Austrian Data Protection Authority has delivered a decisive verdict concerning the digital privacy of students using educational software. In a recent ruling the regulator determined that Microsoft violated the law by placing tracking cookies on the devices of minors without obtaining proper consent. This decision addresses the widespread use of Microsoft 365 Education in schools and the hidden data collection mechanisms within it. The case originated from a formal complaint filed by the privacy advocacy group NOYB on behalf of a student.
According to the findings these tracking cookies were installed to analyze user behavior and collect browser data for advertising and other business purposes. The privacy organization NOYB argued that the tech giant aims to accustom children to its ecosystem to create a future generation of loyal customers. This aggressive strategy involves dominating the educational space while potentially disregarding strict privacy standards for minors. The regulator confirmed that there was no valid legal basis for processing this personal data from students.
During the proceedings the software corporation attempted to evade liability by attributing the responsibility to local schools or its Irish subsidiary. The Austrian regulator firmly rejected this defense and clarified that Microsoft in the United States retains the ultimate power over data processing decisions. They noted that educational institutions typically lack the technical capability to influence or control these data collection practices. This establishes that the provider cannot simply shift the burden of compliance onto schools that depend on their services.
The investigation also highlighted a significant failure regarding the right to access personal information under data protection laws. When the student requested to see their data the company did not provide full access and instead pointed fingers at the school. The school was unable to comply because they did not hold the data that the software provider had collected. This cycle of denial left the student without any means to exercise their fundamental privacy rights.
As a result of the ruling the company has been ordered to stop the illegal tracking of the complainant within a period of four weeks. They must also delete the relevant personal data that was unlawfully processed during the time the software was used. Both the educational institution and the Ministry of Education expressed surprise as they were unaware of the existence of these tracking cookies. The lack of transparency has sparked a broader debate about the software tools used in classrooms.
Felix Mikolasch who serves as a data protection lawyer at NOYB emphasized that tracking minors is fundamentally incompatible with privacy-friendly education. He observed that the company seems to prioritize its marketing and public relations statements over the actual protection of student data. This case serves as a crucial reminder that digital tools in schools must adhere to strict legal standards to protect vulnerable users. The decision forces the tech industry to reconsider how they handle the information of young people.
Tell us what you think about big tech companies tracking students in the comments.
