EU accuses Micrsoft of secretly collecting children's data

Microsoft is back under the microscope in the European Union, but Teams is finally not to blame. Austrian advocacy group Noyb has filed two complaints against Microsoft over operations of its 365 Education software in schools and children's privacy. The group is also responsible for past complaints against OpenAI, Meta, Spotify and more tech giants.

Noyb alleges that Microsoft 365 Education "installed cookies that, according to Microsoft's own documentation, analyse user behaviour, collect browser data and are used for advertising" — without the school's knowledge. The advocacy group further alleges that Microsoft is "consistently vague" about what it's doing with the students' data and could be tracking children in secret.

"Our analysis of the data flows is very worrying. Microsoft 365 Education appears to track users regardless of their age," Felix Mikolasch, a data protection lawyer at Noyb, expressed in a statement. "This practice is likely to affect hundreds of thousands of pupils and students in the EU and EEA. Authorities should finally step up and effectively enforce the rights of minors."

Noyb also claims Microsoft is dumping its General Data Protection Regulation (GDPR) responsibilities on schools without providing them with any access or insight into its privacy policies or data collection. "Microsoft holds all the key information about data processing in its software, but is pointing the finger at schools when it comes to exercising rights," Maartje de Graaf, another data protection lawyer at Noyb, said in a statement. "Schools have no way of complying with the transparency and information obligations."

The GDPR sets out strict guidelines for protecting minors' data, focusing on extra protections for the individual, transparency and accountability. Violating the GDPR could lead to a fine of €20 million ($22 million) or four percent of a company's annual worldwide turnover the previous year — whichever is the larger amount.