In the wake of the pandemic, schools in the European Union have increasingly begun to implement digital services for online learning. While these modernisation efforts are a welcome development, a small number of big tech companies immediately tried to dominate the space – often with the intention of getting children used to their systems and creating a new generation of future “loyal” customers. One of them is Microsoft, whose 365 Education services violate children’s data protection rights. When pupils wanted to exercise their GDPR rights, Microsoft said schools were the “controller” for their data. However, the schools have no control over the systems.