Microsoft told to stop tracking school children

Microsoft has been ordered to stop tracking school children by the Austrian data protection authority (DSB). The order is a win for noyb, who brought two cases against Microsoft over its Microsoft 365 Education product. The DSB has already ruled against Microsoft, saying that it uses student data for its own purposes. Now it has gone further.

The case revolves around the use of cookies that are placed on the machines of any student using that product. noyb reports that the Microsoft Documentation states that the cookies “analyse user behaviour, collect browser data and are used for advertising.” Additionally, students are not offered the opportunity to opt out.

No hiding place in Ireland

When the two cases were originally brought against Microsoft, it argued that the DSB could not bring an action against it.  also argued that the only authority that could bring the case was the Irish DPA. It claimed that Microsoft Ireland was the responsible body for setting policy. The DSB rejected that argument, saying that in its view, Microsoft US was making the relevant decisions.

The DSB has ordered Microsoft to cease its tracking within four weeks. Whether that will happen remains to be seen. It will also be interesting to see if Microsoft removed the cookies from any computer on which they have been installed.

What is not clear is how this will impact the performance of the software. Microsoft makes it clear in its documentation that blocking cookies will stop various features from working. Will it now deliver a new version of Microsoft 365 Education that is fully functional without cookies?

Another part of this that is not clear is how many third-party cookies get installed with Microsoft 365 Education. If there are any, they will also have to be removed or, at the very least, seek consent from users.

Did Microsoft hide the use of cookies?

The answer is no. It raises the question of why the software was allowed to be approved for use by students.

Prior to the noyb complaint to the DSB, both the Austrian Ministry of Education and the school where the complainant studies claim that they were unaware of the tracking cookies. Those statements need to be considered in more detail.

As noyb showed, the use of cookies and the purposes for which they are designed are documented by Microsoft. It raises a question as to why nobody checked the user agreements before providing the software to students. It suggests that there was a failure to check if the software is safe to use.

Enterprise Times: What does this mean?

Education bodies are keen to ensure that they get software into the hands of students to improve how they learn. But with the rush to deploy software, there are serious questions to be answered here.

What is the liability of education bodies from governments to schools when it comes to verifying safety? Are they just relying on statements from vendors without performing any due diligence? When they use specialist companies to manage their IT, do they ask about the safety of user data and how the software complies with privacy laws?

The software that educators are deploying is increasingly AI-enabled. Many of those AI tools are known to track, store and reuse personal data. Students and their parents need to trust that the recommended tools are safe. The name of the company providing them, as in this case, is no guarantee of that.

As Max Schrems said, “Companies and authorities in the EU should use compliant software. Microsoft has once again failed to comply with the law.”

The post Microsoft told to stop tracking school children appeared first on Enterprise Times.