Directory Information, the Opt-Out, and What the PPRA Adds

What Directory Information Is

FERPA divides student records in two. Most personally identifiable information from education records cannot be released without written parental consent. Directory information is the exception, defined at 34 CFR 99.3 as "information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed."

The regulation gives an open list: name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status; dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors and awards received; and the most recent educational agency or institution attended. The statutory list at 20 U.S.C. 1232g(a)(5)(A) is shorter; the regulation is the fuller statement.

Two exclusions are absolute in the text. Directory information does not include a social security number, and it does not include a student identification number except in the narrow circumstances at paragraph (c) of the definition — an ID number, user ID or other unique identifier used for accessing electronic systems, or one displayed on an ID badge, and then only where the identifier cannot be used to reach education records without a second authenticating factor such as a PIN or password. Section 99.37(e) closes the loop: a school may not disclose or confirm directory information without written consent where a social security number or other non-directory information is used, alone or in combination, to identify or help identify the student or the student's records.

The Annual Notice and Opt-Out

The permission at 99.37(a) is conditional. A school may disclose directory information "if it has given public notice to parents of students in attendance and eligible students in attendance" of three things:

• The types of personally identifiable information the school has designated as directory information
• The right to refuse to let the school designate any or all of those types as directory information for that student
• The period of time within which a parent or eligible student has to give that refusal in writing

Three features of that structure are easy to miss. The refusal is item-by-item — the text says "any or all of those types" — so a household can decline a photograph while leaving a name in place. It has to be in writing, and it has to arrive inside the window the notice itself sets. And the notice governs: a category the school did not designate publicly is not directory information, whatever else the school does with it.

The obligation outlives enrollment in one direction only. Under 99.37(b), a school may disclose directory information about former students without repeating the notice and opt-out, but "must continue to honor any valid request to opt out of the disclosure of directory information made while a student was in attendance unless the student rescinds the opt out request." A refusal filed in tenth grade does not lapse at graduation.

What Schools May Designate

Designation is a local decision within the regulatory ceiling. The 99.3 list is prefaced with "includes, but is not limited to," so a school can designate elements not enumerated there, subject to the definition's own standard that the information would not generally be considered harmful or an invasion of privacy if disclosed, and subject to the social security number and ID number exclusions.

The Department's Student Privacy Policy Office maintains a template for the notice, and its current entry for that template records that the form "is currently being reviewed and updated," with the document itself not presently posted. The operative requirements are therefore the regulatory ones at 99.37(a) rather than any particular model wording.

The designation decision has downstream effects that reach beyond mailing lists. In its guidance on online educational services, the Department notes that setting up vendor accounts through the directory information exception "may be insufficient for several reasons" — only elements named in the public notice may be disclosed, and given the number of families who opt out, a district may find the exception impractical for that purpose. Information shared as directory information is also not FERPA-protected in the recipient's hands, so the use and redisclosure limits that attach to other exceptions do not follow it.

Limits Districts Have Adopted

The December 2011 FERPA rulemaking, published at 76 FR 75604, added paragraph (d) to 99.37 to make an intermediate option explicit. A school may specify in its public notice that disclosure of directory information will be limited to specific parties, for specific purposes, or both — and having said so, "must limit its directory information disclosures to those specified in its public notice." A limited directory information policy is a middle path between designating a category for everyone and not designating it at all.

The same rulemaking added paragraph (c), which fences the opt-out on the other side. A parent or eligible student may not use the refusal right to prevent a school from disclosing, or requiring a student to disclose, the student's name, identifier or institutional email address in a class in which the student is enrolled; nor to prevent a school from requiring a student to wear or display a student ID card or badge exhibiting information properly designated as directory information in the public notice. The opt-out governs release to outsiders, not identification inside the school's own operations.

The PPRA and Surveys

The Protection of Pupil Rights Amendment, 20 U.S.C. 1232h, is a different statute with a different subject. Where FERPA governs records a school already holds, the PPRA governs what a school may ask students in the first place, and what it may then do with the answers.

Subsection (b) sets a consent rule. No student may be required, as part of any applicable program, to submit to a survey, analysis or evaluation revealing information concerning eight listed categories — political affiliations or beliefs of the student or parent; mental or psychological problems of the student or family; sex behavior or attitudes; illegal, anti-social, self-incriminating or demeaning behavior; critical appraisals of others with whom respondents have close family relationships; legally recognized privileged or analogous relationships such as those with lawyers, physicians and ministers; religious practices, affiliations or beliefs of the student or parent; and income other than that required by law to determine program eligibility. Consent means the student's own where the student is an adult or emancipated minor, and prior written parental consent otherwise.

Subsection (c) adds a second, broader layer built on notice rather than consent. Local educational agencies receiving funds under an applicable program must develop and adopt policies, in consultation with parents, covering inspection of third-party surveys before administration, arrangements to protect privacy when a survey touches the eight categories, inspection of instructional material used in the curriculum, the administration of physical examinations and screenings, and the collection or use of student information for marketing. Notice of those policies must go directly to parents at least annually at the start of the school year and within a reasonable period after any substantive change, and must offer an opportunity to opt the student out of the activities the statute lists.

Marketing Information Under PPRA

The marketing provision is the one that most often surprises. Under 1232h(c)(2)(C)(i), activities involving "the collection, disclosure, or use of personal information collected from students for the purpose of marketing or for selling that information" require direct annual notification and an opt-out, and the notification must state the specific or approximate dates when those activities are scheduled. Personal information is defined narrowly for this purpose at 1232h(c)(6)(E): a student or parent's first and last name, a home or other physical address including street name and city or town, a telephone number, or a social security identification number.

The exceptions at 1232h(c)(4)(A) are equally specific. The marketing provision does not apply to collection, disclosure or use of student information "for the exclusive purpose of developing, evaluating, or providing educational products or services for, or to, students or educational institutions," and the statute then lists what it has in mind: postsecondary or military recruitment; book clubs, magazines and programs providing access to low-cost literary products; curriculum and instructional materials used by elementary and secondary schools; tests and assessments used to provide cognitive, evaluative, diagnostic, clinical, aptitude or achievement information, and the analysis and public release of aggregate data from them; sales by students to raise funds for school-related activities; and student recognition programs.

The Student Privacy Policy Office's guidance document SPPO-21-01 restates the same architecture from the parent's side, listing the rights to consent, to notice and an opt-out, and to inspect — including the right to inspect "[a]ny instrument used by an LEA to collect personal information for the purpose of marketing or sale," before it is administered. That guidance carries its own disclaimer: other than statutory and regulatory requirements included in it, its contents "do not have the force and effect of law and are not meant to bind the public in any way."

How the Two Statutes Interact

Congress addressed the overlap directly. The PPRA's rule of construction at 1232h(c)(5)(A)(i) states that "[t]his section does not supersede section 1232g of this title." The two run in parallel: a school can satisfy FERPA's directory information conditions and still owe PPRA notice for a marketing activity, because the statutes regulate different acts. They do share one mechanic — rights under both transfer from parent to student when the student turns 18 or becomes an emancipated minor.

One asymmetry is worth naming plainly, because it explains why the regulations are a poor guide here. The PPRA's implementing regulations at 34 CFR Part 98 derive from a 1984 Federal Register publication and reflect the statute as it then stood: § 98.3 covers inspection of instructional material used in research or experimentation, and § 98.4 covers psychiatric or psychological examination, testing or treatment across seven categories. The statutory text now runs to eight categories, adds religious practices and beliefs, and carries the entire subsection (c) apparatus of local policies, annual direct notification, marketing activities and inspection rights that Part 98 never mentions. The complaint machinery at §§ 98.5 through 98.10 remains usable, and the Department's own guidance cites both the statute and Part 98, but for the substance of what is protected the statute is where the current answer lives.

Enforcement of both runs through the Department rather than through litigation between families and schools. The PPRA directs the Secretary to take such action as the Secretary determines appropriate to enforce it, with termination of assistance available only after a finding of non-compliance that cannot be secured by voluntary means, and requires an office and review board to investigate, process, review and adjudicate violations. FERPA's enforcement provisions at 20 U.S.C. 1232g(f) and (g) are framed the same way.

Frequently Asked Questions