Microsoft is under renewed scrutiny in the European Union. Austrian advocacy group Noyb has filed two complaints against Microsoft over the activities of its 365 Education software in schools and children’s privacy. The group is also responsible for past complaints against OpenAI, Meta, Spotify and other tech giants.

EU alleges Microsoft secretly collects children’s data

Noyb claims that Microsoft 365 Education installed cookies that analyze user behavior, collect browser data and are used for advertising without the school’s knowledge, according to Microsoft’s own documents. The advocacy group also claims that it is unclear what Microsoft is doing with students’ data and that it may be secretly spying on children.

Felix Mikolasch, a data protection lawyer at Noyb, explains: “Our analysis of the data flows is very worrying. Microsoft 365 Education seems to track users regardless of their age. This practice is likely to affect hundreds of thousands of pupils and students in the EU and EEA. The authorities must finally step in and effectively enforce the rights of minors.”

Noyb also claims that Microsoft is offloading its General Data Protection Regulation (GDPR) responsibilities onto schools without providing any access or insight into their privacy policies or data collection.

Maartje de Graaf, another of Noyb’s data protection lawyers, said in a statement: “Microsoft keeps all the important information about data processing in its software, but when it comes to exercising rights, it points the finger at schools. There is no way for schools to comply with their transparency and information obligations.”

The GDPR lays down strict rules for the protection of minors’ data and focuses on extra protection, transparency and accountability for the individual. Violating the GDPR can lead to a fine of €20 million ($22 million), or four percent of a company’s annual worldwide turnover in the previous year.