Microsoft Ireland Operations Limited – Court Ruling (Ireland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Irish High Court addressed a case involving Microsoft and the processing of personal data in real-time bidding. This matters because it clarifies responsibilities around data protection in advertising.
What happened
The court examined whether Microsoft was responsible for complying with GDPR in its real-time bidding platform.
Who was affected
Consumers whose personal data may have been processed during online advertising auctions.
What the authority found
The court determined several preliminary questions about the burden of proof and compliance obligations under GDPR.
Why this matters
This ruling could influence how tech companies handle personal data in advertising, emphasizing the need for clear compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 3 October 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Irish Council for Civil Liberties (ICCL), a qualified entity, brought a representative action against Microsoft Ireland Operations Limited concerning the processing of personal data through the Xandr real-time bidding platform. ICCL alleged that personal data broadcast during real-time bidding auctions could include highly personal information and that the processing infringed several GDPR requirements, including transparency, data minimisation, security and consent obligations. It sought injunctive relief requiring Microsoft to cease, amend or restrict the processing. A dispute subsequently arose concerning the burden of proof and the parties' pleading obligations. ICCL argued that Articles 5(2) and 24(1) GDPR required the controller to demonstrate its compliance with the GDPR. Microsoft disputed that it was the relevant controller and argued that the ordinary rules of civil procedure placed the burden of establishing the alleged infringements on ICCL. The parties also disagreed about the information that had to be provided in the representative action. Microsoft sought further information concerning, among other things, the alleged infringements, the consumers affected and the funding of the proceedings. The court therefore determined several preliminary questions relating to the burden of proof, pleading requirements and access to information before the underlying GDPR allegations were decided. The court held that Articles 5(2) and 24(1) GDPR do not create a general reversal of the legal or evidential burden of proof. The claimant must first establish the matters for which it bears the burden, including that the defendant is a controller and that processing takes place which engages the relevant GDPR obligations. However, once those matters are established and compliance with a relevant GDPR obligation is at issue, the controller bears the legal and evidential burden of demonstrating compliance. In particular, where compliance with the principles in Article
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (1)
Other cases involving Microsoft Ireland Operations Limited in IE
Details
About this data
Cite as: Cookie Fines. Microsoft Ireland Operations Limited - Ireland (2026). Retrieved from cookiefines.eu
Last updated: