Microsoft is accused of secretly collecting data from minors

The Austrian privacy advocacy organization NOYB (None Of Your Business) has filed two complaints against Microsoft regarding its Microsoft 365 Education software package and children's privacy. Previously, the organization had filed complaints against OpenAI, Meta, Spotify, and other tech companies.

According to NOYB, the Microsoft 365 Education software package "sets cookies that, according to Microsoft's own documentation, are used to analyze user behavior, collect browser data, and for advertising" — without the school's knowledge. The advocates claim that Microsoft "persistently obscures" what it does with students' data and may secretly monitor children.

"Our analysis of the data flows raises great concern. Microsoft 365 Education seems to track users regardless of their age. This activity likely affects hundreds of thousands of schoolchildren and students in the EU and EEA. Authorities must finally step up and effectively ensure the protection of minors' rights," said Felix Mikolasch, a data protection lawyer at NOYB.

The advocates claim that Microsoft shifts its obligations to comply with the General Data Protection Regulation (GDPR) onto schools, without providing them with any access or clarification regarding its privacy policies or data collection.

"Microsoft holds all the key information about data processing in its software but points the finger at schools when it comes to implementing rights. Schools are left unable to meet transparency and information processing obligations," added another NOYB lawyer, Maartje de Graaf.

The GDPR sets strict standards for the protection of minors' data, focusing on additional safeguards for personal data, transparency, and accountability. Violating the regulation can result in a fine of up to €20 million or 4% of the company's global turnover from the previous year — whichever amount is greater.