Overview
- The Austrian Data Protection Authority found Microsoft set five non‑essential cookies on a schoolgirl’s device without valid consent, deeming the processing unlawful under the GDPR.
- The order requires Microsoft to cease such processing for the complainant within four weeks, with fines possible if the company fails to comply.
- The decision names MC1, FPC, MSFPC, MicrosoftApplicationsTelemetryDeviceId and ai-session as technically unnecessary cookies that analyze usage and may support advertising.
- Microsoft disputes the finding, maintains Microsoft 365 for Education meets legal standards, and is considering reprogramming cookie behavior or pursuing legal remedies.
- Regulators rejected Microsoft’s attempts to shift responsibility to schools and jurisdiction to Ireland, noting key decisions occur in the U.S.; it follows an October 2025 ruling on inadequate data access and could spur wider EU scrutiny.