FERPA
Family Educational Rights and Privacy Act
Parent and eligible student rights over education records, and limits on disclosing them.
The law in brief
FERPA protects the privacy of student education records at schools, colleges and universities that receive US Department of Education funding. It gives parents rights over their children's records, and those rights pass to the student at 18 or on entering postsecondary education.
For technology teams and vendors, FERPA matters because education technology providers usually receive student records under the school official exception, which comes with conditions on how the data may be used.
Who it applies to
- Educational agencies and institutions that receive funds under programs administered by the US Department of Education, which covers nearly all public schools and most colleges and universities.
- Education records: records directly related to a student and maintained by the institution or by a party acting for it, in any format.
- Vendors and contractors that receive records as school officials must use them only for the authorized purposes and under the institution's direct control.
What it requires
Consent before disclosure
Get written consent before disclosing personally identifiable information from education records, unless an exception applies.
School officials, including vendors
Disclose without consent to school officials, including contractors and vendors, only where they have a legitimate educational interest, perform a function the institution would otherwise use employees for, are under its direct control for use of the records, and use them only for authorized purposes.
Access within 45 days
Give parents and eligible students access to education records within 45 days of a request.
Annual notification
Notify parents and eligible students each year of their rights under FERPA.
Directory information with opt-out
Directory information may be disclosed without consent after public notice of what it covers and a reasonable time for parents and eligible students to opt out.
People's rights
Parents, and eligible students (18 or older, or attending a postsecondary institution), can inspect and review education records within 45 days of a request, ask for records they believe are inaccurate or misleading to be amended and get a hearing if refused, consent before personally identifiable information is disclosed (subject to exceptions), and complain to the Department of Education.
Enforcement and penalties
FERPA is enforced administratively by the Department of Education's Student Privacy Policy Office. The ultimate sanction is the loss of federal funding, and the office usually seeks voluntary compliance first. There is no private right to sue under FERPA.
What to do first
- Publish the annual notification of FERPA rights and your definition of school official.
- Inventory edtech and vendors that receive education records, and put the school official conditions in contracts.
- Define directory information and give parents and eligible students a chance to opt out.
- Log disclosures where the regulation requires a record.
- Train staff on the health or safety emergency exception and its record-keeping.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
- 34 CFR Part 99, Family Educational Rights and Privacy eCFR · Official text or regulator