FERPA (Family Educational Rights and Privacy Act)

· About FERPA (Family Educational Rights and Privacy Act)

Key Takeaways

  • FERPA applies to any public or private elementary, secondary, or postsecondary school that receives funds under a program administered by the U.S. Department of Education, and it protects the privacy of students’ education records[1][5][13].
  • Schools generally must obtain written consent from a parent or eligible student before disclosing personally identifiable information from education records, unless a FERPA exception applies[1][5][13].
  • Parents have FERPA rights until the student turns 18 or attends a school beyond the high school level, after which the student becomes an eligible student and controls those rights[5][13].
  • The Department of Education’s Family Policy Compliance Office enforces FERPA through complaint and compliance processes, and the regulation remains codified at 34 CFR part 99[1][9].
  • As of 6 September 2026, no final 2025–2026 FERPA regulatory amendment has been confirmed in the official materials reviewed, although the Department’s 2025–2026 rulemaking agenda indicated an intent to amend part 99 and listed target dates for proposed and final action that are not themselves effective dates[9].
  • FERPA violations can trigger loss of federal education funds only in the statutory sense, but the Department’s enforcement practice is complaint-driven and uses investigation and corrective action rather than routine monetary fines[1][3][5].

What It Is

FERPA is the federal student privacy law enacted in 1974 as section 444 of the General Education Provisions Act, and its implementing regulations appear at 34 CFR part 99[1][5][13]. It gives parents and eligible students rights to inspect education records, seek amendment of inaccurate records, consent to disclosures, and receive notice of certain privacy policies[5][13].

The law is administered by the U.S. Department of Education, specifically through its Family Policy Compliance Office, which receives and investigates FERPA complaints[1][4]. The Department also issues annual notice requirements to state and local educational agencies that receive federal funds[2].

For dates, FERPA originated in 1974; the current implementing regulations are continuously in force, and the Department’s current FERPA page was updated in 2026 with a 34 CFR part 99 reference and related Federal Register amendment notices[1][5]. A 2025–2026 regulatory agenda entry stated that the Department intended to amend part 99, with timetable entries referencing January 2026 and May 2026 for NPRM and final action, but that agenda item is not itself a binding amendment and no final amended rule was confirmed in the sources reviewed[9].

Who Must Comply

FERPA applies to educational agencies and institutions that receive funds under a program administered by the U.S. Department of Education, which includes public K–12 schools and most public and private postsecondary institutions that receive covered federal funds[1][5][13]. The Department’s guidance also describes FERPA obligations for SEAs and LEAs that receive Department funds[2].

The statute has practical extraterritorial reach in the sense that a foreign school or vendor can be implicated if it acts as part of a recipient’s operations or receives covered data from a FERPA-covered institution, but FERPA directly regulates the recipient institution rather than all downstream data users[1][15]. The core question is whether the entity is a covered recipient and whether the information is an education record or personally identifiable information from such a record[1][13][15].

Common exemptions and limits include records excluded from the definition of education records, such as sole-possession notes, law-enforcement unit records, employment records unrelated to student status, and certain medical records used only for treatment[1][5][13]. FERPA also does not prevent disclosure where a specific exception applies, including school official access, transfer to another school, audit or evaluation, financial aid, health or safety emergencies, judicial orders or subpoenas, and directory information if properly designated and noticed[5][13][15].

Core Requirements

  1. Written consent before disclosure. Schools must obtain written permission from the parent or eligible student before disclosing personally identifiable information from education records unless an exception applies[1][5][13].
  2. Access and review rights. Parents and eligible students must be able to inspect and review education records within FERPA’s access framework, and the Department expects schools to maintain procedures for that access[5][13].
  3. Amendment procedures. Schools must have a process for parents or eligible students to request correction of records they believe are inaccurate, misleading, or violate privacy rights, including a hearing process if the school declines the request[5][13].
  4. Annual notice and policy transparency. Covered institutions must provide notice of FERPA rights and their directory-information policies, and the Department separately requires annual notice to SEAs and LEAs of FERPA and PPRA obligations[2][7].
  5. Control over directory information. A school may disclose directory information only if it has designated that category, given notice, and allowed parents or eligible students the right to opt out where required[7][15].
  6. Use only under recognized exceptions. When sharing without consent, schools must fit the disclosure within a specific FERPA exception, such as legitimate educational interest, transfer, studies, audit or evaluation, financial aid, health or safety, or court process[5][13][15].

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | FERPA enacted | 1974 | Statutory privacy rights for student education records began. | | Current regulations in force | ongoing | 34 CFR part 99 implements FERPA and remains the operative regulatory framework[1]. | | Annual notice cycle | ongoing each year | SEAs and LEAs receive Department notice of FERPA and PPRA obligations[2]. | | 2025–2026 rulemaking agenda target dates | 2026 (agenda item only) | The Department listed intended NPRM and final-action timing for a possible part 99 amendment, but not a final rule[9]. |

FERPA does not set a typical administrative civil-penalty schedule for covered schools. The principal sanction is Department enforcement through complaint investigation and corrective action, and the statute also contemplates the potential withholding of federal funds for serious noncompliance[1][3][5]. In practice, the Family Policy Compliance Office handles complaints and resolutions, so privacy and security teams should treat FERPA as a federal funding condition backed by compliance enforcement rather than a fine-based regime[1][4][5].

How to Comply

  1. Map records and data flows. Identify all education records, directory-information fields, disclosures, and vendors that receive student data, then classify them against FERPA definitions and exceptions[1][13][15].
  2. Build a consent and notice workflow. Standardize written consent capture, directory-information opt-out handling, and annual privacy notices so disclosures are consistently authorized[2][7].
  3. Tighten access controls and role definitions. Limit access to legitimate educational interests and align access governance with ISO 27001-style access control and asset management practices where they support FERPA obligations.
  4. Document disclosure exceptions. Maintain a decision log for each non-consensual disclosure, showing the applicable FERPA exception, requester, data elements shared, and retention period[5][15].
  5. Set amendment and complaint procedures. Create a tracked workflow for record-correction requests, hearings, and written outcomes, with escalation to compliance counsel for contested cases[5][13].
  6. Harden vendor governance. Use contracts, data-processing addenda, and audit rights for service providers and studies vendors so they only process student data within FERPA-authorized purposes; this maps well to NIST CSF 2.0 governance and protect functions.
  7. Adopt an education-data privacy control system. Use ISO 42001 concepts to assign accountability, risk review, and documentation for AI or automated systems that touch student records, especially where model training or profiling could create unauthorized uses.
  8. Test incident and disclosure response. Run tabletop exercises for subpoena response, health-and-safety emergencies, and accidental disclosure scenarios so staff can apply FERPA exceptions quickly and consistently[5][15].

Related Regulations

  • PPRA overlaps with FERPA in the school notice environment, but PPRA focuses on student surveys and certain personal-information collection rather than education-record disclosure[2].
  • COPPA can overlap when schools or edtech vendors collect data from children under 13 online, but COPPA governs online collection from children while FERPA governs student education records held by schools.
  • State student privacy laws may impose stricter vendor, breach, or biometric limits, and schools must follow both FERPA and any more protective state rule where there is no direct conflict.
  • IDEA interacts with FERPA because special-education records are generally education records, but IDEA also creates separate procedural rights and confidentiality duties.
  • Title IX / civil-rights investigations can create pressure to disclose records, but FERPA exceptions and protected-process rules still control how student information is shared.

FAQ

Does FERPA apply to companies outside the United States?

FERPA applies directly to covered schools and educational agencies that receive U.S. Department of Education funds, not to every foreign company by default[1][13]. A company outside the United States can still be contractually bound or functionally affected if it receives or processes education records for a covered institution, because the institution remains responsible for compliant disclosure[15].

Does FERPA allow schools to share data with edtech vendors?

Yes, but only when the disclosure fits a FERPA exception, such as a school official with legitimate educational interest or a study conducted for the school[5][13][15]. The school must define the permissible purpose, control access, and ensure the vendor does not repurpose the data outside that authorized relationship[15].

Do parents keep FERPA rights after a student turns 18?

Usually no. FERPA rights transfer to the student when the student turns 18 or attends a school beyond the high school level, making the student an eligible student[5][13]. After that point, the institution generally deals with the student rather than the parent unless the student consents or another exception applies.

Can a school disclose directory information without consent?

Yes, if the school has properly designated the data as directory information, given the required notice, and honored any applicable opt-out rights[7][15]. Directory information is not a free pass; schools must still follow their published policy and cannot use the designation to evade FERPA controls.

What happens if a school violates FERPA?

The Department of Education can investigate complaints and require corrective action, and serious noncompliance can threaten federal funding[1][3][4]. FERPA is not mainly a fine-based law, so the operational risk is often enforcement, remediation, and reputational damage rather than a fixed civil penalty schedule[1][5].

Sources

Put it into practice

More compliance guides