Class action will target “Real-Time Bidding” (RTB) data breach in Microsoft’s advertising system, and is anticipated to affect Microsoft’s operations across the EU
26 May 2025 –In the first action of its kind in Ireland, the Irish Council for Civil Liberties (ICCL) will today apply to the High Court to launch a class action lawsuit against Microsoft. The case is intended to target the very large “Real-Time Bidding” (RTB) data breach within Microsoft’s advertising system.
ICCL is taking the legal action on behalf of all affected people in Ireland under the new EU Collective Redress Directive. The organisation hopes to force Microsoft to bring its systems into compliance with the EU’s General Data Protection Regulation (GDPR). This application comes on the seven year anniversary of the GDPR’s introduction on 25 May 2018.
The outcome of this litigation is anticipated to affect Microsoft’s operations across the European Economic Area as the company’s European headquarters are based in Ireland.
Users of Office, Windows, Xbox and the general internet are affected
Microsoft’s RTB system operates behind the scenes on websites and apps to match advertising to specific people.
Users of popular Microsoft products and services, including Windows, Xbox, web-based Office (Word, Excel and Outlook), the Edge web browser that is pre-installed with Windows, and websites and apps that use Microsoft’s Xandr advertising technology, are affected.
Dr Johnny Ryan, Director of ICCL’s Enforce unit, is leading the case and said:
“People’s intimate secrets such as their relationship, work and financial status are broadcast by Microsoft into the Real-Time Bidding advertising system. That system is a black hole of data open to any malicious actor and represents a huge data breach of millions of people’s information”.
Very sensitive data about people exposed, including national security personnel
ICCL Enforce investigations have revealed the extraordinary sensitivity of the data that Microsoft exposes. Posing as a data buyer, ICCL Enforce obtained thousands of RTB data “segments” about Irish people. These include information such as whether a person gambles, their finances and debt, and even such sensitive information as whether the person works in a sensitive national security role.
Dr Ryan said:
“Microsoft has no way of knowing what happens to the personal data after it broadcasts. This a data breach, pure and simple. Microsoft is exposing us all individually to malicious profiling and discrimination, and in doing so it is also undermining European security”.
ICCL is represented by James Doherty SC, Sean O’Sullivan BL and Ahern Rudden Quigley.
