FERPA and Student Records: Coverage, Consent Exceptions and How the Statute Is Enforced

Who FERPA Covers

The Family Educational Rights and Privacy Act is written as a condition on federal education funding. Section 1232g(a)(1)(A) states the mechanism directly: no funds shall be made available under any applicable program to an educational agency or institution that has a policy of denying, or that effectively prevents, parents the right to inspect and review their children's education records.

The regulations translate that into a coverage test at 34 CFR 99.1(a). The part applies to an educational agency or institution to which funds have been made available under any program administered by the Secretary of Education, where the institution provides educational services or instruction to students, or the agency is authorized to direct and control public elementary, secondary or postsecondary institutions.

Section 99.1(c) treats funds as made available whether they arrive by grant, cooperative agreement, contract, subgrant or subcontract, or through students who may pay them to the institution for educational purposes — the provision names the Pell Grant and Guaranteed Student Loan programs. That second route is why private colleges whose students carry federal aid are covered institutions despite receiving no direct appropriation.

Section 99.1(d) then removes a common misreading: where an agency or institution receives covered funds, the regulations apply to the recipient as a whole, including each of its components, such as a department within a university. Section 99.1(b) sets the one clear negative case — an institution is not covered merely because its students receive non-monetary benefits under a covered program, if no program funds reach the institution.

Education Records Defined

The definition at 34 CFR 99.3 has two elements and then a list of exclusions. Education records are records directly related to a student and maintained by an educational agency or institution, or by a party acting for it. The second element is what carries the statute into contracted systems: a records platform operated by an outside company on the school's behalf holds education records.

Four exclusions matter in practice:

• Sole possession records. Records kept in the sole possession of the maker, used only as a personal memory aid, and not accessible or revealed to anyone except a temporary substitute for the maker. A teacher's private notes qualify only while all three conditions hold.
• Law enforcement unit records. Records of a school's law enforcement unit, subject to the separate provisions of 34 CFR 99.8.
• Employment records. Records relating to a person employed by the institution that are made and maintained in the normal course of business, relate exclusively to that person as an employee, and are not available for any other use. The definition then reverses this for work-study and similar cases: records on a student employed as a result of student status are education records.
• Treatment records. Records on a student 18 or older, or attending a postsecondary institution, made or maintained by a physician, psychiatrist, psychologist or other recognized professional in that capacity and used only in connection with treatment.

The definition turns on the record's relationship to the student and to the institution, not on its sensitivity or its format. A routine administrative record directly related to an identifiable student and maintained by the school is an education record even though nothing about it is confidential in the ordinary sense.

Directory Information

Directory information is the category FERPA permits a school to disclose without consent after giving notice. Section 99.3 defines it as information in an education record that would not generally be considered harmful or an invasion of privacy if disclosed, and gives a non-exhaustive list: name, address, telephone listing, electronic mail address, photograph, date and place of birth, major field of study, grade level, enrollment status, dates of attendance, participation in officially recognized activities and sports, weight and height of athletic team members, degrees, honors and awards received, and the most recent institution attended.

The definition then excludes a student's Social Security number outright, and excludes student identification numbers except under a narrowly drawn condition: an ID number, user ID or other unique identifier used to access electronic systems counts as directory information only if it cannot be used to gain access to education records except in conjunction with an authenticating factor such as a PIN or password known only to the authorized user.

Section 99.37(a) conditions any directory information disclosure on public notice to parents and eligible students in attendance, stating the types of information designated, the right to refuse the designation for any or all of those types, and the period within which a refusal must be given in writing. Section 99.37(b) permits disclosure about former students without repeating that notice, while requiring the school to continue honoring an opt-out made while the student was in attendance unless it is rescinded.

Section 99.37(c) sets two limits on the opt-out: it cannot be used to prevent a school from disclosing, or requiring a student to disclose, a name, identifier or institutional email address in a class the student is enrolled in, nor to avoid wearing or displaying a student ID badge showing properly designated directory information. Section 99.37(d) permits a school to specify in its public notice that directory disclosures will be limited to particular parties or purposes, and requires it to observe that limit once stated.

The School Official Exception and EdTech Vendors

Section 99.30(a) states the default: signed and dated written consent from the parent or eligible student before disclosure of personally identifiable information from education records, specifying the records, the purpose and the recipients. Section 99.31 then lists the circumstances in which that consent is not required, and the first entry on the list is the one that carries the largest volume of disclosures.

Section 99.31(a)(1)(i)(A) permits disclosure to other school officials, including teachers, whom the institution has determined have legitimate educational interests. Subparagraph (B) extends that status to a contractor, consultant, volunteer or other party to whom the institution has outsourced institutional services or functions, on three conditions stated in the text: the outside party performs a service or function for which the institution would otherwise use employees; is under the direct control of the institution with respect to the use and maintenance of education records; and is subject to the redisclosure requirements of 99.33(a).

Those three conditions are the whole of the legal test for a software vendor holding student records without parental consent. There is no separate edtech provision, no registration, and no approval process — the Department of Education's guidance on online educational services, first issued in February 2014, addresses the question by applying this exception rather than by supplying a distinct regime.

Two further constraints attach. Section 99.31(a)(1)(ii) requires the institution to use reasonable methods to ensure school officials access only records in which they have legitimate educational interests, and provides that an institution not using physical or technological access controls must ensure its administrative policy is effective. Section 99.33(a) provides that a recipient may not redisclose the information to another party without consent, and that its officers, employees and agents may use it only for the purposes for which the disclosure was made.

Section 99.7(a)(3)(iii) closes the loop by requiring the school's annual notification to specify the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest, where the school has a policy of disclosing under this exception.

Parent and Eligible Student Rights

Section 99.5(a)(1) sets the transfer point: when a student becomes an eligible student, the rights accorded to and the consent required of parents transfer to the student. Section 99.3 defines an eligible student as one who has reached 18 or is attending a postsecondary institution — so a 16-year-old enrolled in a college course holds the rights directly, while an 18-year-old high school senior does as well.

The inspection right at 34 CFR 99.10(a) requires that a parent or eligible student be given the opportunity to inspect and review the student's education records, and 99.10(b) requires compliance within a reasonable period and in no case more than 45 days after the request. Section 99.10(c) requires the school to respond to reasonable requests for explanations and interpretations of the records.

The amendment right runs through 99.20 and 99.21. A parent or eligible student who believes a record is inaccurate, misleading or in violation of the student's privacy rights may ask the school to amend it; the school decides within a reasonable time; and if it declines, 99.20(c) requires it to inform the requester of the decision and of the right to a hearing under 99.21. The hearing challenges whether the record is inaccurate, misleading or in violation of privacy rights — it is a records-accuracy mechanism, not an avenue for contesting a grade or a disciplinary judgment on its merits.

Section 99.7(a)(2) requires annual notification to parents or eligible students currently in attendance of four rights: to inspect and review, to seek amendment, to consent to disclosures except where 99.31 authorizes disclosure without consent, and to file a complaint with the Department. Section 99.7(b) requires the notice to be given by means reasonably likely to inform, with specific provision for recipients who are disabled and, at the elementary and secondary level, for parents whose primary or home language is not English.

Consent and Disclosure Exceptions

Beyond the school official exception, section 99.31(a) lists a substantial number of further circumstances permitting disclosure without consent. Several recur often enough to be worth naming from the text.

Section 99.31(a)(2) permits disclosure to officials of another school where the student seeks or intends to enroll, or is already enrolled, for purposes related to enrollment or transfer, subject to 99.34. Section 99.31(a)(3) permits disclosure to authorized representatives of the Comptroller General, the Attorney General, the Secretary of Education, and state and local educational authorities, subject to 99.35. Section 99.31(a)(4) permits disclosure in connection with financial aid the student has applied for or received, where necessary to determine eligibility, amount or conditions, or to enforce the aid's terms.

Section 99.36(a) permits disclosure to appropriate parties in connection with an emergency where knowledge of the information is necessary to protect the health or safety of the student or others. Section 99.36(b) separately preserves a school's ability to record disciplinary action taken for conduct posing a significant risk to safety or well-being, and to disclose that information to teachers and school officials — within the institution and at other schools — determined to have legitimate educational interests in the student's behavior.

Section 99.31(b) addresses de-identified data, permitting release without consent after removal of all personally identifiable information provided the releasing party has made a reasonable determination that the student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information.

Section 99.32 requires records of requests and disclosures to be maintained, which is what makes the exceptions auditable after the fact rather than merely asserted.

Enforcement Mechanism

FERPA's enforcement structure is the feature that most distinguishes it from the other federal sectoral privacy statutes, and it follows from the statute being a funding condition.

Section 1232g(g) directs the Secretary to establish or designate an office and review board to investigate, process, review and adjudicate violations and complaints. Section 1232g(f) directs the Secretary to take appropriate actions to enforce the section, and provides that action to terminate assistance may be taken only after a finding of failure to comply and a determination that compliance cannot be secured by voluntary means.

The regulations set out how that plays out. Section 99.66(b) requires the Office, following investigation, to provide written notice of its findings and their basis. Where it finds noncompliance, 99.66(c) requires the notice to state the specific steps needed to comply and to give a reasonable period for voluntary compliance. Only if the recipient does not comply within that period does 99.67(a) authorize the Secretary to withhold further payments, issue a complaint to compel compliance through a cease and desist order, or terminate eligibility for funding.

Section 99.67(c) supplies the sanction aimed at third parties: where the Office finds a party outside the school violated the conditions on disclosures to authorized representatives, the school the information came from may not allow that party access to personally identifiable information from education records for at least five years.

What the statute does not provide is a lawsuit. In Gonzaga University v. Doe, 536 U.S. 273 (2002), a former student sued under 42 U.S.C. 1983 over the release of personal information, and the Supreme Court held the action foreclosed because the relevant provisions of FERPA create no personal rights enforceable under that section. The Court reasoned that spending legislation confers individually enforceable rights only where Congress speaks with a clear voice and manifests an unambiguous intent to do so, and that FERPA's nondisclosure provisions, addressed to institutional policy and practice rather than phrased with an unmistakable focus on a benefited class, do not.

State Student Privacy Statutes

Because FERPA regulates schools rather than the companies they contract with, and because it offers no damages remedy, states have legislated directly against vendors. Two statutes illustrate the two things state law has added.

California's K–12 Pupil Online Personal Information Protection Act, at Business and Professions Code section 22584, regulates the operator of a site, service or application used for K–12 school purposes rather than the school. Subdivision (b) bars an operator from knowingly engaging in targeted advertising based on covered information, from using information gathered through the service to amass a profile about a pupil except in furtherance of K–12 school purposes, and from selling a pupil's information. Subdivision (d) requires the operator to implement and maintain reasonable security procedures and to delete a pupil's covered information at the request of the school or local educational agency.

Illinois's Student Online Personal Protection Act, at 105 ILCS 85, adds breach mechanics FERPA has none of. It requires an operator, within the most expedient time possible and without unreasonable delay but no later than 30 calendar days after determining a breach has occurred, to notify the school; and requires the school, no later than 30 calendar days after receiving that notice or determining a breach of its own, to notify the parent of any student whose covered information is involved. The Act also requires contracts with operators to describe how breach investigation and remediation costs will be allocated between operator and school, and provides that an agreement entered into in violation of the Act is void and unenforceable as against public policy.

This guide describes those two statutes from their text. A majority of states have enacted student privacy legislation of some kind since 2014, and the provisions vary considerably in whom they bind and what they require; the pattern in the remaining states is not inferred from California and Illinois.

Frequently Asked Questions