noyb win: Microsoft ordered to stop tracking school children

Minors Monitoring Cookies Right of Access Right of Access Procedures

Jan 27, 2026Sourcenoyb.eu

Full text

Data Subject Rights noyb has scored another win in its proceedings against Microsoft 365 Education: The Austrian data protection authority (DSB) has decided that the company illegally installed cookies on the devices of a pupil without consent. According to Microsoft’s own documentation, these cookies analyse user behaviour, collect browser data and are used for advertising. Microsoft now has four weeks to comply and cease the use of tracking cookies. Decision by the Austrian DSB (DE)PR for previous DSB decision against MicrosoftOriginal complaints from 2024Background. In June 2024, noyb had filed two complaints concerning Microsoft 365 Education in schools with the Austrian DSB. The first complaint was decided in October 2025. Back then, the DSB held that Microsoft violated the right of access under Article 15 GDPR. The second complaint, which has now been decided, concerned the use of unlawful tracking cookies in Microsoft 365 Education.Second noyb win against Microsoft. In its most

How it connects

Related across sources

€100,000 HDPA fines Teleperformance for failing to properly handle employee access request The DPA received a complaint from a former employee of the Service 800 Teleperformance Single Member S.A. (the controller), after the controller failed to comply with the data… Greece ·Art. 5, 12, 13 +3 Personal Data Right of Access Storage Limitation

SAN 3154/2026 National court annuls DPA sanction against KFC Spain over website privacy information In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website.… Jul 16, 2026 Supervisory Authorities Personal Data Recipient

C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervision IP Address Integrity and Confidentiality Principle

Guidelines 1/2020 processing personal data in the context of connected vehicles and mobility related applications Guidelines on processing of personal data through video devices Guidelines ·EDPB Feb 7, 2020 Personal Data Privacy by Design & Default Privacy by Default

Guidelines 01/2022 data subject rights - Right of access Guidelines ·EDPB Apr 17, 2023 Right of Access Personal Data Right to Rectification

2022 EDPB Annual Report 2021 Enhancing the depth and breadth of data protection 2 EDPB Annual Report 2021 2 ENHANCING THE DEPTH AND BREADTH OF DATA PROTECTION An Executive Summary of this report, which… May 12, 2022 Privacy Shield Integrity and Confidentiality Principle International Transfer