EnglishEspañol
Privacy LawsLegal Information

Student Data Privacy & FERPA Guide: School Records Rights (2026)

By Recording Law Editorial TeamReviewed September 3, 202613 min read
Student Data Privacy & FERPA Guide: School Records Rights (2026)

FERPA (20 U.S.C. § 1232g) gives parents and eligible students the right to access student education records and controls when schools may disclose that information. The law applies to virtually every public K-12 school and most colleges and universities that receive federal funding.

Schools collect an enormous volume of data about students: grades, attendance records, disciplinary actions, health information, special education evaluations, standardized test scores, and increasingly, digital activity through learning management systems and ed-tech platforms. The Family Educational Rights and Privacy Act, known as FERPA, is the primary federal law governing who can access this information and under what circumstances.

This guide covers FERPA's core requirements, the exceptions that allow disclosure without consent, the growing role of state student privacy laws, and how ed-tech vendors fit into the picture. For related children's privacy topics, see our COPPA Compliance Guide and Children's Online Privacy by State.

What Is FERPA?

Congress enacted the Family Educational Rights and Privacy Act in 1974 (20 U.S.C. § 1232g), also known as the Buckley Amendment. The law applies to all educational agencies and institutions that receive funding from programs administered by the U.S. Department of Education.

FERPA grants two fundamental rights:

  1. The right to inspect and review education records maintained by the school
  2. The right to request amendment of records the parent or student believes are inaccurate or misleading

The law also restricts schools from disclosing personally identifiable information (PII) from education records without written consent, subject to specific exceptions.

The U.S. Department of Education's Student Privacy Policy Office (SPPO), formerly the Family Policy Compliance Office, administers and enforces FERPA. Unlike COPPA, which carries civil monetary penalties, FERPA enforcement works through the funding mechanism: schools that violate FERPA risk losing federal funding, though the Department has never actually terminated funding over a FERPA violation. Instead, SPPO investigates complaints and issues findings and corrective actions.

Who Is Protected Under FERPA?

FERPA protects "education records" of students at institutions that receive federal education funding. This covers:

  • Virtually every public elementary and secondary school in the United States
  • Most public and private colleges and universities (those accepting federal financial aid, Pell Grants, or other DOE-administered funds)
  • Some vocational and technical schools
  • State education agencies

A small number of private schools that receive no federal funding at any level are not subject to FERPA. Religious schools that decline federal funding may also fall outside FERPA's scope, though they may still be subject to state student privacy laws.

What Are Education Records?

Under 34 C.F.R. § 99.3, "education records" are records that are directly related to a student and maintained by an educational agency or institution, or by a party acting for the agency or institution.

Education records include:

  • Transcripts, grades, and GPA
  • Class schedules and enrollment information
  • Financial aid records
  • Disciplinary records
  • Special education records (IEPs, 504 plans)
  • Attendance records
  • Student ID numbers and Social Security numbers
  • Email and digital records maintained by the school or its vendors

Records specifically excluded from FERPA's definition include:

  • Sole possession records: Notes kept by a school official that are not shared with anyone else (a teacher's personal notes about a student's behavior)
  • Law enforcement unit records: Records created and maintained by a school's campus police unit for law enforcement purposes
  • Employment records: Records of a student who is employed by the school (unless employment is contingent on student status)
  • Treatment records of adult and postsecondary students: Records on a student who is 18 or older, or who is attending a postsecondary institution, that are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional and used only in connection with treatment (20 U.S.C. § 1232g(a)(4)(B)(iv)). This narrow exclusion does not reach K-12 school health and counseling records, which are generally education records under FERPA
  • Alumni records: Information collected after the individual is no longer a student

Parent Rights vs. Student Rights

FERPA rights initially belong to the parent or guardian. These rights transfer to the student when the student turns 18 or enrolls in a postsecondary institution at any age. The student then becomes an "eligible student" under FERPA.

Once rights transfer, the school must obtain the student's consent before disclosing education records, even to the student's parents. However, FERPA includes an exception allowing schools to disclose records to parents of a dependent student as defined under Section 152 of the Internal Revenue Code (26 U.S.C. § 152). Most traditional-aged college students qualify as dependents on their parents' tax returns.

Schools can also disclose records to parents if the student has violated a law or school policy regarding alcohol or controlled substances and the student is under 21. This exception, added by the Higher Education Amendments of 1998, was designed to address binge drinking on college campuses.

The Right to Inspect and Review

Parents or eligible students have the right to inspect and review education records within 45 days of making a request. Schools are not required to provide copies of records (and may charge for copies) but must provide access. Schools cannot destroy records if a pending request to inspect them exists.

The Right to Request Amendment

If a parent or eligible student believes a record is inaccurate, misleading, or in violation of the student's privacy rights, they can request that the school amend the record. If the school refuses, the parent or student has the right to a formal hearing. If the hearing does not resolve the dispute, the parent or student can place a statement in the record explaining their objection.

This right does not extend to grade challenges. FERPA does not give parents or students the right to challenge a grade on substantive grounds; it only addresses whether the record accurately reflects the grade that was given.

Directory Information

Directory information is a category of education records that schools may disclose without consent. Under 34 C.F.R. § 99.3, directory information can include:

  • Student's name
  • Address and telephone number
  • Email address
  • Date and place of birth
  • Dates of attendance
  • Grade level and enrollment status
  • Degrees, honors, and awards received
  • Most recent previous school attended
  • Participation in officially recognized activities and sports
  • Weight and height of athletic team members
  • Photograph

Schools must notify parents annually of what information the school designates as directory information and provide a reasonable period for parents to opt out of disclosure. If a parent opts out, the school must suppress that student's information from all directory disclosures, including yearbooks, graduation programs, and sports rosters.

Schools set their own directory information policies. A school could designate only the student's name and grade level as directory information, or it could include all categories permitted under FERPA.

FERPA's general rule requires written consent before disclosing education records. The exceptions listed in 34 C.F.R. § 99.31 are specific and enumerated:

School Officials with Legitimate Educational Interest

Schools can disclose records to other school officials (teachers, administrators, counselors, school nurses) within the institution who have a legitimate educational interest. Schools must define "legitimate educational interest" in their annual FERPA notification. This exception also covers contractors, consultants, and volunteers performing services the school would otherwise use its own employees to perform, which is the primary basis for sharing data with ed-tech vendors.

Transfer to Another School

Schools can disclose records to officials at another school where the student seeks to enroll or is already enrolled, as long as the disclosure is for enrollment or transfer purposes. The school must make a reasonable attempt to notify the parent or eligible student.

Financial Aid

Records can be disclosed to determine eligibility for financial aid, determine the amount, determine conditions, or enforce the terms of the aid.

Accreditation Organizations

Disclosure to accrediting organizations for accreditation purposes is permitted.

Judicial Order or Subpoena

Schools can disclose records in response to a judicial order or lawfully issued subpoena. The school must make a reasonable effort to notify the parent or eligible student before complying, unless the court order specifically prohibits notification (as with certain grand jury or law enforcement subpoenas).

Health or Safety Emergency

In connection with an emergency, schools can disclose records to appropriate parties (law enforcement, public health officials, medical personnel) if the information is necessary to protect the health or safety of the student or other individuals. This exception is strictly construed: the threat must be articulable and significant, and the disclosure must be limited to the period of the emergency.

State and Local Education Authorities

State and local education officials can access records for auditing, evaluating, or enforcing federal or state education programs. These officials must maintain the data in compliance with FERPA.

Studies and Research

Schools can disclose records to organizations conducting studies for or on behalf of the school for purposes of developing or administering predictive tests, administering student aid programs, or improving instruction. The receiving organization must maintain data security, destroy information when it is no longer needed, and refrain from disclosing PII.

Ed-Tech Vendor Obligations

The expansion of digital learning has created a significant FERPA compliance challenge. When schools adopt learning management systems, student information systems, assessment platforms, and classroom tools, the vendors operating those platforms access student education records.

Under FERPA, ed-tech vendors can receive student data through the "school official" exception if:

  • The vendor performs a service that the school would otherwise perform itself
  • The vendor is under the school's direct control regarding the use and maintenance of education records
  • The vendor uses the records only for the purposes for which the disclosure was made
  • The vendor does not re-disclose the information without consent

The Department of Education's Privacy Technical Assistance Center (PTAC) provides guidance on vendor agreements. PTAC recommends that schools execute written agreements specifying the data to be disclosed, the purposes for use, data security requirements, and breach notification obligations.

The critical distinction: a vendor receiving data under the school official exception cannot use that data for its own commercial purposes (advertising, product development outside the contract, building user profiles). The FTC's 2023 enforcement action against Edmodo illustrated this principle: the proposed order announced on May 22, 2023 prohibits the company from using children's information for non-educational purposes such as advertising or building user profiles.

The Protection of Pupil Rights Amendment (PPRA)

The Protection of Pupil Rights Amendment (PPRA) (20 U.S.C. § 1232h) is a separate federal law often discussed alongside FERPA. PPRA governs surveys, analyses, and evaluations funded by the U.S. Department of Education.

PPRA requires schools to:

  • Obtain written parental consent before administering surveys that reveal information about political affiliations, mental health, sexual behavior, illegal conduct, religious practices, income, or other sensitive topics
  • Notify parents of any survey collecting sensitive information and provide the opportunity to opt out
  • Allow parents to inspect survey materials before administration
  • Notify parents of the school's policies regarding surveys and physical examinations

PPRA was amended by the No Child Left Behind Act in 2002 to expand its scope to include activities funded by any source, not just federal programs. The Department of Education enforces PPRA through the same complaint process used for FERPA.

State Student Privacy Laws

Recognizing that FERPA's enforcement mechanism (potential loss of federal funding) rarely results in consequences, many states have enacted their own student privacy laws with stronger teeth.

California: SOPIPA

California's Student Online Personal Information Protection Act (SOPIPA) (SB 1177, 2014) was the first major state student privacy law. SOPIPA applies directly to operators of websites, online services, and apps used for K-12 school purposes.

Under SOPIPA, covered operators cannot:

  • Use student information for targeted advertising
  • Sell student information
  • Create advertising profiles of students
  • Use student data for non-educational commercial purposes

SOPIPA applies to the vendor, not to the school, which distinguishes it from FERPA. A vendor that violates SOPIPA faces enforcement by the California Attorney General. For California's broader data privacy framework, see our California Data Privacy Laws guide.

New York: Education Law 2-d

New York's Education Law § 2-d (enacted 2014, regulations finalized 2020) requires educational agencies to adopt data security and privacy policies, ensure that third-party contractors protect student data, and report data breaches within specified timeframes.

Key requirements include:

  • Schools and districts must adopt a Parents' Bill of Rights for Data Privacy and Security
  • Third-party contractors must adopt data security and privacy plans
  • Unauthorized release of student data can result in penalties and contract termination
  • The Chief Privacy Officer at the New York State Education Department oversees compliance

See New York Data Privacy Laws for additional context.

Colorado: Student Data Transparency and Security Act (SB 16-068)

Colorado's Student Data Transparency and Security Act (SB 16-068, 2016) requires schools to adopt data governance policies, restricts commercial use of student data by third-party service providers, and mandates transparency about what data is collected and how it is used.

Colorado's approach emphasizes data governance: schools must maintain a public list of all data elements collected and the third-party services that access student data.

Other State Laws

The Student Privacy Pledge, coordinated by the Future of Privacy Forum and the Software and Information Industry Association, was a voluntary commitment signed by ed-tech companies, not something states adopted. The Future of Privacy Forum retired the Pledge on April 25, 2025 and maintained the public signatory list only through July 31, 2025.

Illinois, Louisiana, Maryland, Oregon, and Virginia have all enacted student data privacy laws that impose obligations on ed-tech vendors, restrict commercial use of student data, and require breach notification. The Student Privacy Compass, which tracked state student privacy legislation, was a Future of Privacy Forum resource rather than a Department of Education product, and its domain now redirects to FPF's education page.

How FERPA Connects to Recording Laws and Family Law

Recording policies in schools intersect with FERPA when recordings capture student education records. A parent recording an IEP meeting, a school recording a disciplinary hearing, or a security camera capturing student behavior all raise FERPA questions about who can access the resulting recordings and under what circumstances.

For state-specific recording laws that apply in school settings, explore our state recording law pages. For family law context covering custody, child support, and parental rights, see our United States Child Support Laws hub.

This article provides general legal information about FERPA and student data privacy. It does not constitute legal advice. Consult an attorney for advice specific to your situation.

Frequently Asked Questions

What is FERPA and who does it protect?

FERPA (20 U.S.C. § 1232g) is a federal law that protects the privacy of student education records at institutions receiving federal education funding. This covers virtually every public K-12 school and most colleges and universities. FERPA gives parents the right to access and request amendments to their children's education records and restricts schools from disclosing personally identifiable information without consent.

When do FERPA rights transfer from parents to students?

FERPA rights transfer to the student when the student turns 18 or enrolls in a postsecondary institution at any age, whichever comes first. After the transfer, the student becomes an 'eligible student' and the school must obtain the student's consent (not the parent's) before disclosing records. Schools can still share records with parents if the student is a tax dependent under IRS rules.

What is directory information under FERPA?

Directory information includes categories like a student's name, address, phone number, email, date of birth, dates of attendance, grade level, degrees, and participation in activities. Schools can disclose directory information without consent, but must notify parents annually of what they designate as directory information and give parents a reasonable period to opt out.

Can schools share student records with ed-tech vendors?

Yes, under the 'school official' exception in 34 C.F.R. § 99.31. The vendor must perform a service the school would otherwise handle itself, remain under the school's direct control regarding data use, use the records only for the agreed purposes, and refrain from re-disclosing the information. Vendors cannot use student data for commercial purposes like advertising.

What happens if a school violates FERPA?

FERPA is enforced by the Department of Education's Student Privacy Policy Office (SPPO), formerly the Family Policy Compliance Office. Parents or eligible students can file complaints with SPPO, and the office investigates and issues findings. The ultimate sanction is termination of federal funding, though the Department has never actually cut funding over a FERPA violation. Instead, SPPO typically requires corrective action.

Does FERPA apply to private schools?

FERPA applies only to schools that receive funding from programs administered by the U.S. Department of Education. Most private K-12 schools do not receive direct DOE funding and are not subject to FERPA. However, private colleges that participate in federal financial aid programs (Pell Grants, federal student loans) are covered. State student privacy laws may also apply to private schools independently of FERPA.

What is SOPIPA and how does it differ from FERPA?

California's Student Online Personal Information Protection Act (SOPIPA) applies directly to ed-tech vendors, prohibiting them from using student data for targeted advertising, selling student data, or creating advertising profiles. Unlike FERPA, which primarily regulates schools, SOPIPA regulates the companies that provide digital tools to schools. The California Attorney General enforces SOPIPA, giving it more direct enforcement power than FERPA's funding-based mechanism.

Can a parent record an IEP meeting under FERPA?

FERPA does not specifically address whether parents can record IEP meetings. Recording policies are typically governed by state recording consent laws and local school board policies. Some states explicitly permit parents to record IEP meetings, while others leave the decision to school districts. The resulting recording, if maintained by the school, could become an education record subject to FERPA protections.

Updates

Corrected the FERPA enforcement office to the Department of Education's Student Privacy Policy Office, narrowed the medical treatment record exclusion to students 18 or older or in postsecondary education as the statute provides, fixed the misattributed Student Privacy Compass and retired Student Privacy Pledge references, and replaced two dead citations with live official sources.

Governing law re-checked for recent changes

Governing law re-checked for recent changes

Sources and References

  1. Family Educational Rights and Privacy Act (20 U.S.C. § 1232g)(uscode.house.gov).gov
  2. FERPA Regulations (34 C.F.R. Part 99)(ecfr.gov).gov
  3. Education Records Definition (34 C.F.R. § 99.3)(ecfr.gov).gov
  4. FERPA Consent Exceptions (34 C.F.R. § 99.31)(ecfr.gov).gov
  5. U.S. Department of Education FERPA Overview(www2.ed.gov).gov
  6. Student Privacy Policy Office (SPPO)(studentprivacy.ed.gov).gov
  7. FERPA Directory Information FAQ(studentprivacy.ed.gov).gov
  8. Protection of Pupil Rights Amendment (PPRA)(studentprivacy.ed.gov).gov
  9. California SOPIPA (SB 1177)(leginfo.legislature.ca.gov).gov
  10. New York Education Law § 2-d(nysenate.gov).gov
  11. Colorado Student Data Transparency and Security Act (SB 16-068)(leg.colorado.gov).gov
  12. IRS Tax Dependent Definition (26 U.S.C. § 152)(uscode.house.gov).gov
  13. FTC Edmodo Enforcement Action (2023)(ftc.gov).gov
  14. Filing a FERPA Complaint with the Student Privacy Policy Office (U.S. Department of Education)(studentprivacy.ed.gov)
  15. FERPA statutory text, 20 U.S.C. § 1232g (GovInfo, 2023 edition)(govinfo.gov)
  16. FTC Says Ed Tech Provider Edmodo Unlawfully Used Children's Personal Information for Advertising (May 22, 2023)(ftc.gov)
  17. Future of Privacy Forum, Student Privacy Pledge (retired April 25, 2025)(fpf.org)
Share: