- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
A student represented by noyb – Complaint Upheld (Austria, 2025)
Austria's data protection authority upheld a complaint against Microsoft for using tracking cookies without consent in its education platform. This is important because it shows that companies must be clear about their data practices and obtain permission before tracking users. It reinforces the need for transparency in how personal data is handled.
What happened
Microsoft 365 Education used tracking cookies without obtaining user consent.
Who was affected
The affected individuals were students using the Microsoft 365 Education platform.
What the authority found
The authority found that Microsoft violated GDPR by not providing clear information about cookie usage and third-party data sharing.
Why this matters
This decision highlights the importance of consent in data tracking practices. Companies must ensure they are transparent about their data collection methods to avoid similar complaints.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Review needed — 19 March 2026.
Processing notes: articles corrected, entity split needed.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Microsoft 365 Education used tracking cookies without consent and provided vague explanations about data processing, including interactions with third parties like LinkedIn and OpenAI.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for A student represented by noyb in AT
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
DPA case 10139147
2025 · Garante per la protezione dei dati personali
DPA case Takeaway B.V. - z2022-04011
2024 · Autoriteit Persoonsgegevens
DPA case DSB-D130.1174
2023 · Datenschutzbehörde
DPA case 9782890
2022 · Garante per la protezione dei dati personali
DPA case 9788429
2022 · Garante per la protezione dei dati personali
Details
Decision Date
8 October 2025
Authority
Datenschutzbehörde
About this data
Cite as: Cookie Fines. A student represented by noyb - Austria (2025). Retrieved from cookiefines.eu
Last updated: