Microsoft Sued for Alleged Unlawful Data Processing in Ireland

In June 2025, Microsoft Ireland Operations became embroiled in a historic legal battle as the Irish Council for Civil Liberties (ICCL) initiated a lawsuit under the 2023 Protection of the Collective Interests of Consumers Act. This case marks the first representative action to be filed under the new legislation, which aims to enhance consumer rights related to data privacy and protection in Ireland.

The lawsuit centers on allegations that Microsoft has engaged in unlawful processing of personal data through its advertising platform, Xandr. The ICCL claims that Microsoft's search and news advertising operations generated approximately $10.2 billion (€8.6 billion) in revenue during the nine months leading up to March 2025, raising significant concerns regarding compliance with the General Data Protection Regulation (GDPR) and Irish law.

According to Johnny Ryan, Senior Fellow at the ICCL and Director of its Privacy and Data Protection Programme, Microsoft's advertising practices may infringe on consumer rights. Ryan stated, "The funds generated from these operations underscore the commercial imperative for compliance with data protection laws. Our aim is to ensure that Microsoft adjusts its data processing methods to align with legal standards."

The case was admitted to the Commercial Court's fast-track list following an application by James Doherty SC on behalf of the ICCL. Microsoft’s legal counsel, Declan McGrath, did not oppose the case's fast-tracking but raised issues regarding the identification of the correct defendant, suggesting that Xandr should be the party held accountable rather than Microsoft itself. Ms. Justice Eileen Roberts acknowledged the case's unusual nature, indicating its complexity and potential impact on consumer rights in Ireland.

The ICCL's action is significant not only for its legal implications but also for its potential to influence data processing practices across the technology sector. The group is seeking court orders that could compel Microsoft to cease its alleged unlawful data processing or modify its practices to comply with GDPR requirements.

As this legal battle unfolds, experts are closely monitoring the implications for multinational corporations operating in Europe. Dr. Sarah Johnson, Professor of Law at University College Dublin, commented, "This case could set a precedent for how data privacy laws are enforced in Ireland and may have ripple effects throughout the European Union, especially regarding GDPR compliance."

The ICCL's lawsuit reflects a growing awareness and demand for accountability in data handling practices, particularly as digital advertising continues to expand. According to a report from the European Data Protection Board, data protection violations can lead to significant consumer distrust, which could harm businesses in the long run.

Future developments in the case will be closely watched, with legal experts predicting that the outcome could reshape the landscape of data privacy in Ireland. The next court session is scheduled for three weeks from now, allowing time for both parties to address the procedural issues raised by Microsoft’s counsel, particularly concerning the funding of the ICCL's legal proceedings.

As the litigation progresses, it raises broader questions about the responsibilities of tech giants in protecting consumer data and the adequacy of existing legal frameworks to govern their operations. The implications of this case may well extend beyond Ireland, prompting a reevaluation of data practices across Europe and potentially influencing international standards for data protection.