Education Privacy Law

Educational institutions from preschools to universities collect and maintain detailed records about students, including academic performance, health information, disciplinary records, and increasingly, vast amounts of digital data through educational technology. Protecting student privacy while enabling effective education requires careful navigation of federal laws like FERPA, state student privacy statutes, and general privacy regulations like COPPA and state consumer privacy laws.

The Statutes That Apply, and When

Student privacy is governed by several statutes that overlap without lining up. FERPA, at 20 U.S.C. 1232g and 34 CFR Part 99, is the central one: it attaches to educational agencies and institutions receiving funds under an applicable Department of Education program, which covers effectively all public schools and most colleges and universities. Many private K-12 schools take no such funds and sit outside it entirely, while most private colleges participate in federal student aid and are covered.

COPPA applies on a different axis. It regulates operators of online services directed to children under 13, or with actual knowledge that they collect personal information from such a child, regardless of whether a school is involved. The Protection of Pupil Rights Amendment at 20 U.S.C. 1232h governs surveys funded by the Department of Education that ask students about protected topics, and the collection of student information for marketing. State statutes add another layer: California’s SOPIPA regulates operators of school-directed services directly, and New York’s Education Law 2-d imposes contract and data security terms on educational agencies and their vendors.

What Counts as an Education Record

FERPA protects education records, defined as records directly related to a student and maintained by the institution or a party acting for it. In practice that reaches transcripts and grades, enrolment and schedule information, disciplinary files, financial aid and billing records, health and immunisation records held by the school, special education evaluations and individualised education programs, standardised test scores, attendance, and evaluative material from teachers and counsellors.

The exclusions are as consequential as the definition. Sole possession records, meaning a staff member’s private notes not shared with anyone else, are outside it, but sharing those notes with a colleague generally brings them in. Records maintained by a law enforcement unit for law enforcement purposes are excluded. So are employment records of a student employed by the institution, treatment records created by a healthcare professional in the course of treating an eligible student, and alumni records created after the individual has ceased to be a student.

Rights, and Who Holds Them

Parents hold FERPA rights while the student is under 18 in a K-12 setting. Those rights transfer to the student at 18 or on enrolment in a postsecondary institution, whichever happens first, and the statute then calls that person an eligible student. The transfer is not conditioned on the student’s financial independence, which routinely surprises parents of first-year undergraduates.

The rights themselves are procedural rather than substantive. There is a right to inspect and review the records, which the institution must satisfy within 45 days of the request. There is a right to request amendment of a record believed to be inaccurate or misleading, and if the institution declines, a right to a hearing and then to place a statement in the file. There is a right to consent before personally identifiable information is disclosed, subject to a long list of exceptions. And there is a right to complain to the Student Privacy Policy Office at the Department of Education.

Disclosure Without Consent

The exceptions carry most of the operational weight. Disclosure is permitted to school officials with a legitimate educational interest, to another school to which the student is transferring, in connection with financial aid, to accrediting organisations, to comply with a judicial order or lawfully issued subpoena, and in a health or safety emergency where the information is needed to protect someone.

Directory information is a separate mechanism. An institution may designate items such as name, address, telephone listing, dates of attendance, participation in activities and degrees or honours received as directory information and disclose them without consent, but only after giving public notice of what it has designated and allowing a reasonable period to opt out. The designation is discretionary, and the scope of what an institution chooses to treat as directory information is one of the more consequential decisions it makes.

Educational Technology and the School Official Exception

Most edtech deployments rest on the school official exception. A vendor can be treated as a school official with a legitimate educational interest where it performs a function the institution would otherwise perform itself, is under the direct control of the institution with respect to use and maintenance of the education records, and does not redisclose or repurpose the data. That last condition is where arrangements most often fail: a contract permitting the vendor to use student data to improve unrelated products, or to build advertising profiles, does not sit within the exception.

COPPA runs alongside this. Where a service is directed to children under 13, verifiable parental consent is required, and the FTC has recognised that a school can provide consent in the educational context, but only for the educational purpose and not for commercial use of the data. State laws are more direct: SOPIPA prohibits targeted advertising based on information acquired through a school service, and prohibits selling student information or building non-educational profiles, without relying on a consent mechanism at all.

Where Student Records Meet Other Law

Special education records under the Individuals with Disabilities Education Act carry FERPA protections plus additional confidentiality requirements and their own destruction rules once the information is no longer needed. Title IX investigations generate records that implicate the privacy interests of complainant and respondent simultaneously, and the Department has issued guidance on how disclosure obligations interact. The Children’s Internet Protection Act conditions certain federal discounts on internet safety measures, which is a filtering and monitoring obligation rather than a privacy protection, and it can pull in the opposite direction.

State consumer privacy statutes generally exempt information already covered by FERPA, but that exemption is narrower than it sounds: it typically covers the records, not the institution, so data collected outside the education record, such as marketing lists, alumni giving data or website analytics, can remain in scope.

Enforcement

FERPA has no private right of action. The Supreme Court settled that in Gonzaga University v. Doe, so a student or parent cannot sue a school under the statute. Enforcement runs through the Student Privacy Policy Office, whose ultimate sanction is withdrawal of federal funding, a remedy severe enough that it has never been used and mild enough in practice that most matters end in a negotiated corrective action.

The practical exposure sits elsewhere. State student privacy statutes may carry attorney general enforcement or private remedies, COPPA carries FTC civil penalties per violation, and a breach of student records triggers state breach notification law like any other breach.

Frequently Asked Questions