Online rights campaigners Noyb filed two complaints against Microsoft in 2024, saying the company’s education software that is widely used in schools violates data protection rights for children.

Last year, the Austrian data protection authority DSB determined that Microsoft “illegally” tracked students using its education software and must grant them access to their data.

In the latest ruling, dated Jan 21 and provided by Noyb, DSB found Microsoft lacked a “legal basis” to process “personal data” and must therefore refrain “within four weeks from using cookies that are not technically necessary”.

Cookies – which analyse user behaviour and are used for advertising – were installed on the devices of a pupil without consent, Noyb said.

“Tracking minors clearly isn’t privacy-friendly,” Felix Mikolasch, data protection lawyer at noyb, said in a statement.

Microsoft did not immediately react to a request for comment.

Noyb has launched hundreds of legal cases, often prompting action from regulatory authorities against tech giants.

The group began working in 2018 with the advent of the EU’s landmark General Data Protection Regulation (GDPR), which aims to make it easier for people to control how companies use their personal information.