20260128 Österreichs Datenschutzbehörde gegen Microsoft

28.01.2026 Österreichs Datenschutzbehörde gegen Microsoft

Microsoft tracks schoolgirl

"Nothing special" is what they say, and that's probably true. What is interesting about the case of an Austrian schoolgirl is, on the one hand, that it has been proven in court and that the schoolgirl had previously "done everything right" in her privacy settings. Unfortunately, many students – including those in Germany – still work with the Microsoft 365 Education software package. Some data protection officers had already determined that this software cannot be operated in compliance with data protection regulations.

Microsoft had installed five tracking cookies on the student's device without her knowledge or consent, even though she had previously rejected data transmission in all queries in the privacy settings. Now, the Austrian data protection authority has ruled that Microsoft must stop tracking the student within four weeks.

Max Schrems from noyb, who has successfully brought several data protection cases before the European Court of Justice, notes that Microsoft has once again failed to comply with the GDPR applicable in the EU. Of course, this abuse is particularly punishable in the case of schoolgirls, but adults are also often victims of this tracking.