Microsoft secretly tracked a child's device with cookies in Austria, now it has four weeks to comply: "Tracking minors clearly isn't privacy-friendly."

Microsoft 365 logos. (Image credit: Microsoft)

The first complaint was decided in October 2025, marking a significant victory for the digital privacy group, as the Austrian data protection authority (DSB) ruled that Microsoft had violated the right of access under Article 15 of the GDPR.

Microsoft was ordered by the authority to provide more information about the data transmitted. It was also required to provide clear explanations of what it meant when using the terms "internal reporting," "business modeling," and "improvement of core functionality."

And now, the authority has decided on the second complaint about Microsoft's alleged use of unlawful tracking cookies in its 365 Education platform. The authority established that Microsoft had acted unlawfully by placing tracking cookies on the devices of a minor using its 365 Education platform.

While speaking to The Register, a Microsoft spokesman indicated that:

"Microsoft 365 for Education meets all required data protection standards and institutions in the education sector can continue to use it in compliance with GDPR. We are reviewing the Austrian data protection authority's latest decision and will decide on next steps in due course."

To that end, Microsoft has four weeks to comply and stop using tracking cookies on the devices of the minor. The school and the Austrian Ministry of Education claimed that they weren't aware of Microsoft using tracking cookies on minors before "noyb" raised the issue.