A student represented by noyb – Complaint Upheld (Austria, 2025)
Austria's Data Protection Authority upheld a complaint against Microsoft 365 Education for using tracking cookies without consent. The authority found that Microsoft provided unclear information about its data practices. This ruling stresses the importance of obtaining user consent before placing cookies and being transparent about data usage.
What happened
Microsoft 365 Education used tracking cookies without obtaining proper consent from users.
Who was affected
Students and users of Microsoft 365 Education who were tracked without their knowledge.
What the authority found
The authority ruled that Microsoft violated GDPR by placing cookies before obtaining user consent and failing to provide clear information.
Why this matters
This decision reinforces the requirement for companies to obtain consent for cookies and be transparent about data processing. It serves as a warning for businesses to review their cookie policies.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Review needed — 19 March 2026.
Processing notes: articles corrected, entity split needed.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Microsoft 365 Education used tracking cookies without consent and provided vague explanations about data processing, including interactions with third parties like LinkedIn and OpenAI.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Violations (3)
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.
Art. 12, 13 GDPR
Related Enforcement Actions (0)
No other enforcement actions found for A student represented by noyb in AT
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
Decision Date
8 October 2025
Authority
Datenschutzbehörde
About this data
Cite as: Cookie Fines. A student represented by noyb - Austria (2025). Retrieved from cookiefines.eu
Last updated: