What you need to know
- Microsoft has been accused of secretly tracking children's data through Microsoft 365 Education.
- Austrian advocacy group filed two complaints against Microsoft centering around data collection and processing.
- Noyb claims that Microsoft collected the browser data of children for advertising purposes and did so without consent.
- If the claims prove true, hundreds of thousands of students may have been affected by Microsoft's data collection.
- Noyb argues that Microsoft dumps GDPR responsibilities onto the schools without providing the necessary information to comply with regulations.
Microsoft could be in legal trouble if recent accusations made against the company prove accurate. Austrian advocacy group Noyb has filed a pair of complaints against Microsoft that center around the tech giant's collection and processing of the data of children using Microsoft 365 Education. Noyb claims that Microsoft collects browser data without user consent for advertising purposes. The accusation is more serious due to it involving children, which have extra protection when it comes to General Data Protection Regulation (GDPR).
If the violations listed by Noyb are accurate, the European Union could fine Microsoft either €20 million ($21.7 million) or four percent of the tech giant's annual turnover from last year, whichever is greater. Importantly, that turnover figure refers to Microsoft's global turnover, not just its turnover in the European Union.
Noyb argues that Microsoft tries to "dump most of its legal responsibilities under the GDPR on schools that provide Microsoft 365 Education services to their pupils or students." According to Noyb, requests for data are left unanswered and schools cannot comply with GDPR requests in practice. "Schools have no way of complying with the transparency and information obligations," said Noyb data protection lawyer Maartje de Graaf.
According to Maartje de Graaf, schools would need to create contracts with Microsoft that include specific instructions surrounding the processing of student data or have a complete audit of Microsoft in relation to processing the data of children. Neither of these are feasible, according to the lawyer. Maartje de Graaf went as far as to say "everyone knows that such contractual arrangements are out of touch with reality."
At the core of this issue is a lack of transparency by Microsoft, according to Noyb. The outlet refers to "a maze of privacy policies, documents, terms and contracts" that have to be navigated. Allegedly, Microsoft is vague regarding what happens to the data of children. Maartje de Graaf claimed even a professional lawyer would find it difficult to determine how data from Microsoft 365 Education is processed. "It is almost impossible for children or their parents to uncover the extent of Microsoft’s data collection," said Maartje de Graaf.
Another issue Noyb claims occurs is that Microsoft 365 Education installs cookies without consent. Those cookies are then used to analyze behavior, collect data, and use information gathered for advertising. Potentially, hundreds of thousands of students could be affected by Microsoft's data policies and practices.
Microsoft being accused of "secretly tracking children" will likely lead to a legal battle. Noyb wants authorities to "finally step up and effectively enforce the rights of minors" and called on the Austrian data protection authority (DSB) to analyze Microsoft's data processing policies and practices related to Microsoft 365 Education and children.
GDPR includes requirements for transparency, so a key question will be if Microsoft clearly communicated what data is collected and how it is processed.
