Austria’s data protection authority has ruled that Microsoft unlawfully used tracking cookies on a student’s device through its education software, marking a further regulatory setback for the company’s use of personal data in schools.