Austria’s data protection authority has determined that Microsoft 365 Education illegally tracked students, ruling that the company must provide students access to their personal data. The decision follows a 2024 complaint by privacy advocacy group Noyb, which alleged violations of EU data protection laws, particularly concerning children’s rights.

The authority found that Microsoft’s data collection practices in its educational platform failed to comply with strict EU regulations on transparency, consent, and purpose limitation. Tracking of students without explicit parental consent was deemed unlawful, highlighting the need for greater accountability in EdTech tools used in schools.

The ruling mandates that Microsoft must grant students and their guardians access to all data collected, along with clear explanations of how it is processed. Authorities emphasized that educational platforms must prioritize privacy and adhere to the principles of data minimization, especially when handling information related to minors.

Privacy experts note that this decision sets an important precedent for EdTech providers operating in the EU, signaling that violations of children’s digital rights will be met with stringent enforcement. It underscores the broader responsibilities of technology companies in ensuring compliance with data protection frameworks while maintaining transparency and trust.

Microsoft has yet to publicly comment on the ruling but is expected to adjust its data policies for the education sector in Austria and potentially across the EU. The case reflects growing scrutiny on how tech giants collect, store, and utilize personal information, particularly in contexts involving vulnerable populations like students.

This decision by Austria reinforces the importance of protecting children’s digital privacy and highlights the need for robust legal frameworks to govern data practices in educational technology. It also serves as a reminder to companies to prioritize ethical data management alongside innovation.