FERPA
Also known as: Family Educational Rights and Privacy Act, Buckley Amendment, student records privacy
FERPA -- the Family Educational Rights and Privacy Act -- is a US federal law enacted in 1974 that grants parents the right to access their children's education records, request corrections, and consent before those records are disclosed to third parties.
When a student turns 18 or attends a post-secondary institution, these rights transfer to the student. Educational institutions that receive federal funding -- virtually all public schools, colleges, and universities -- must comply or risk losing that funding.
FERPA, explained at three levels
At home
FERPA means your school cannot share your grades, disciplinary history, or personal records with just anyone who asks -- not your employer, not a journalist. Your parents have the right to see your school records when you are a child; when you turn 18 or go to college, those rights become yours. Schools that violate this face losing federal funding.
At work
FERPA defines education records broadly as any records directly related to a student and maintained by the school or a party acting on its behalf. Key exceptions allow sharing without consent: to school officials with a legitimate educational interest, to other schools the student is transferring to, in compliance with a judicial order, and in health or safety emergencies. Directory information -- typically name, enrollment status, degrees, and activities -- can be shared unless the student has opted out.
At home
FERPA distinguishes between education records (subject to FERPA) and sole-possession records (notes kept only by the educator for personal memory aid, never shared). Grades, transcripts, disciplinary files, financial aid records, and attendance records are all education records. Third-party contractors that maintain education records on behalf of the school become 'school officials' under FERPA and must comply -- schools are responsible for ensuring vendors have appropriate data use agreements.
At work
The 2008 FERPA regulations expanded what schools can do under the school official exception. Schools can designate contractors, consultants, and volunteers as school officials if they perform a function the school would otherwise use employees for, are under the school's direct control regarding education records, and are subject to FERPA's re-disclosure prohibition. This allows schools to use cloud-based educational tools without violating FERPA, provided proper agreements are in place.
At home
FERPA enforcement is handled by the Department of Education's Student Privacy Policy Office. Unlike HIPAA, FERPA does not allow individual students to sue schools for violations -- enforcement is administrative, and the ultimate sanction is loss of federal funding. In practice, the DOE usually seeks corrective action through compliance agreements. The intersection of FERPA and technology is increasingly complex: cloud storage, AI tutoring tools, and learning analytics systems all create potential FERPA obligations for deploying schools.
At work
From a practitioner standpoint, the most common FERPA failures involve inadequate vendor contracts, overly broad directory information policies, and inadequate staff training on what constitutes an education record. When a school adopts a new ed-tech tool, a FERPA compliance review should ask: What student data does the vendor receive? Is it covered by a data use agreement? Does the vendor use student data for commercial purposes? Student data from FERPA-covered records cannot be used for targeted advertising even with parental consent under many state laws.
Real-world examples
At home
Fatima is a college freshman whose parents wanted to discuss her grades with her academic advisor. Because Fatima is 18, the FERPA rights transferred to her -- the advisor could not discuss her records with her parents without Fatima's written consent, even though her parents pay tuition.
At work
The registrar's office at Lakewood University received a subpoena from a law firm requesting transcripts for a former student without the student's consent. The general counsel reviewed the subpoena against FERPA's judicial order exception, confirmed it met the requirements, notified the student as soon as legally permitted, and then complied.
Common confusions
- FERPA applies to educational institutions, not to health apps, employers, or parents asking about a child's health data stored by a consumer company. If a student uses a fitness tracker for a PE class, the fitness data on the company's servers is not covered by FERPA -- FERPA governs what the school maintains, not what a consumer app collects independently.
- FERPA rights belong to the student once they turn 18 or enroll in post-secondary education -- not to both the student and their parents simultaneously. A parent asking a university registrar for their adult child's transcript is making a request the university is legally not required to fulfill without the student's signed consent.
- Directory information -- name, major, enrollment status, graduation date -- can be disclosed without consent unless the student has filed a FERPA opt-out request. Schools are not required to keep directory information private by default; students must actively request privacy. This surprises many students who assume all their school records are protected from disclosure.
For analysts
In BA artefacts for ed-tech systems or school information systems, FERPA requirements appear as data handling constraints, vendor agreement requirements, and access control NFRs. Document which data fields constitute education records, which users are designated school officials, and how the system prevents secondary use of student data. Vendor selection criteria should include a requirement for a signed data use agreement compliant with FERPA. Useful NFR: 'The system must not use student education records for any purpose other than fulfilling the contracted educational service, including advertising, profiling, or sale to third parties.'
History & origin
FERPA was enacted on August 21, 1974, sponsored by Senator James Buckley of New York, and is sometimes called the Buckley Amendment. It emerged from growing concerns about school records being shared with employers, military recruiters, and government agencies without families' knowledge. The HITECH Act (2009), the USA PATRIOT Act (2001), and the 2008 and 2011 regulatory updates significantly clarified the school official exception, allowing schools to use cloud-based educational tools -- learning management systems, student information systems -- provided proper data agreements are in place.