Austria's privacy regulator finds that Microsoft violated EU law by illegally tracking students through Microsoft 365 Education, after noyb's complaint in 2024
📰 Read the full blog post, including a comment by Max #Schrems 👉 noyb.eu/en/noyb-win-... Forums: Beehaw : noyb win: Microsoft 365 Education may not track school children
Context & Ripple Effects
The Austrian finding extends a long-running scrutiny of Microsoft’s use in education: Hesse’s regulator had already barred schools from using Office 365 over student-data exposure concerns.
It also follows the EDPS conclusion that the European Commission’s use of Microsoft 365 lacked adequate privacy safeguards. Noyb’s 2024 complaint now ties that broader Microsoft 365 compliance debate directly to tracking in schools.
First-order effects
- Microsoft 365 Education’s handling of student data is now the subject of an adverse Austrian regulatory finding, raising immediate compliance pressure on Microsoft for the product.
- Schools and students using the service are directly implicated because the finding concerns tracking of children in an education setting.
Second-order effects
- Education customers and public-sector buyers may subject Microsoft 365 deployments to closer privacy review, particularly where student tracking is involved.
- The decision gives noyb another regulator-backed outcome to cite as it pursues privacy complaints, following its Austrian complaint alleging Firefox tracking without consent.
Third-order effects
- If similar findings accumulate, cloud productivity vendors will face a higher bar to demonstrate that education-focused services do not embed tracking practices that conflict with EU privacy rules.
- The pattern points to privacy enforcement becoming a more consequential factor in schools’ and public bodies’ software-procurement choices, rather than a post-deployment compliance issue.
The trend: European privacy complaints are increasingly testing whether widely deployed cloud software can meet stricter data-protection expectations in sensitive public-sector settings.