noyb has achieved a significant victory against Microsoft regarding its Microsoft 365 Education platform. The Austrian data protection authority (DSB) found that Microsoft installed tracking cookies on the devices of a student without obtaining proper consent. These cookies are designed to analyze user behavior, gather browser data, and serve advertising purposes. Microsoft now has four weeks to stop using these tracking cookies. The DSB's decision follows noyb's complaints filed in June 2024. Initially, in October 2025, the DSB ruled that Microsoft violated the right of access under Article 15 of the GDPR. The more recent ruling specifically addresses the unlawful tracking of minors. Both the Austrian Ministry of Education and the school involved stated they were unaware of the tracking practices before noyb's complaints. Felix Mikolasch, a data protection lawyer with noyb, criticized Microsoft's disregard for privacy, noting that the company only appears concerned when it comes to its marketing image. During the proceedings, Microsoft attempted to shift responsibility to its Irish subsidiary, arguing it oversees Microsoft 365 products in Europe. The DSB dismissed this claim, asserting that the decisions come from Microsoft US. This ruling has broader implications for Microsoft 365, which is used by millions of students and educators across Europe. Other data protection authorities, including Germany’s, have echoed concerns that Microsoft 365 doesn't meet GDPR standards. Max Schrems highlighted the need for EU entities to adopt compliant software, underlining that Microsoft has once again failed to adhere to legal requirements.