Cybersecurity Policy Report, Microsoft’s Edtech Products Violate EU Privacy Law, Austrian DPA Finds, (Oct 10, 2025)

By Tony Foley

The Austrian data protection authority, Datenschutzbehörde (DSB), has found that Microsoft 365 Education violated several provisions of the European Union’s General Data Protection Regulation (GDPR) in its data processing practices, according to the European Center for Digital Rights (NOYB).

In June 2024, NOYB filed complaints with the DSB against Microsoft, alleging violations of the GDPR’s right to information under article 12(2) and requirements of article 6 requiring a legal basis for processing based on its alleged inappropriate placement of cookies on users’ devices (CPR, June 4, 2024). Specifically, the complainants maintained that, when faced with student requests for access to their data, Microsoft referred them to local schools, which in turn could provide only limited information because they lacked access to information in Microsoft’s possession.

In its decision, which may be accessed from NOYB’s news release but is available only in German, the DSB found that Microsoft used tracking cookies unbeknownst to the school or Ministry of Education and without consent and violated the complainants’ right to access under the GDPR. The decision requires Microsoft to delete data illegally collected using cookies and to provide full access to the data of the complainants.

DSB also found that the local schools at issue and the Ministry of Education should provide further information, particularly outlining the student information that they transferred to Microsoft, but emphasized that because Microsoft did not provide the ministry with full information regarding the data processing in Microsoft 365 Education, it was virtually impossible for local schools to comply with their obligations under articles 13 and 14 of the GDPR. Finally, the DSB rejected Microsoft’s claim that its subsidiary in Ireland was in charge of Microsoft 365 education products, finding that Microsoft US made all relevant decisions.

For its part, NOYB contended that the decision was likely to have far-reaching consequences for Microsoft 365. The software is used by millions of students and teachers across Europe, with millions of others using the standard Microsoft 365 at companies and public authorities. For such users, properly informing employees, students, and other users about how their data is used is mandatory under the law but often impossible for commercial customers. NOYB concluded that if Microsoft did not provide clear information and more power to its commercial customers, using the software would not be compliant with EU law.

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR