An Austrian privacy regulator has ruled that Microsoft illegally set tracking cookies on a school‑issued device used by a child, even though the issue stemmed from how the school deployed Microsoft 365 services rather than anything Microsoft directly controlled. The decision argues that because Microsoft’s services delivered the content that placed the cookies, the company still shares responsibility for the consent failure — a finding that could have far‑reaching implications for cloud providers operating in tightly regulated environments.
At the height of the COVID-19 pandemic, schools rapidly shifted to online platforms like Microsoft 365 Education and Google Workspace for Education to ensure students weren't held back from learning.
