noyb has scored another win in its proceedings against Microsoft 365 Education: The Austrian data protection authority (DSB) has decided that the company illegally installed cookies on the devices of a pupil without consent. According to Microsoft’s own documentation, these cookies analyse user behaviour, collect browser data and are used for advertising. Microsoft now has four weeks to comply and cease the use of tracking cookies.
Why aren’t there harsher penalties for behavior like this? They’re given 4 weeks to comply, and then all is fine as long as they stop? Seems like the message they’re sending is “you can track our kids, just be more careful not to get caught next time… If you do, you can at least rest assured that there’s no real punishment”