Under the Family Educational Rights and Privacy Act, FERPA directory information is a category of student data that a school may release without written consent, as long as the school first tells parents and eligible students what it plans to disclose and gives them a chance to say no. The category typically covers items like a student’s name, major, dates of attendance, and participation in athletics. It never covers a Social Security number. The protection for families is procedural: notice, then a written opt-out submitted by the school’s deadline.
What Counts as Directory Information
Federal regulations list the data points a school may designate. The list is illustrative, not mandatory, so each school decides which items to include. Common designations pulled from 34 CFR § 99.3 include:1eCFR. 34 CFR 99.3 – What Definitions Apply to These Regulations
- Name, address, telephone listing, and email address
- Date and place of birth, photograph
- Major field of study, grade level, enrollment status, and dates of attendance
- Participation in officially recognized activities and sports, plus weight and height of athletic team members
- Degrees, honors, and awards received
- The most recent educational institution the student previously attended
A school does not have to designate every item, and it can designate only some. Anything not explicitly listed in the school’s own designation cannot be released as directory information, even if it appears on the federal list.
The Public Notice a School Must Give First
A school cannot disclose directory information until it gives public notice to parents of enrolled students and to eligible students. An eligible student is one who is at least 18 or who attends a postsecondary institution at any age.2U.S. Department of Education. If a Student Under 18 Is Enrolled in Both High School and a Local College, Do Parents Have the Right to Inspect A 16-year-old taking community college classes holds FERPA rights at the college, while the student’s parents still hold FERPA rights at the high school.
The notice has to do three things:3eCFR. 34 CFR 99.37 – What Conditions Apply to Disclosing Directory Information
- List the specific categories the school has designated as directory information
- Tell parents and eligible students they can refuse to let any or all of those categories be treated as directory information
- State the deadline for submitting a written objection
FERPA does not set a universal number of days for the objection window. Each school picks its own. Schools commonly deliver the notice through student handbooks, registration packets, annual mailings, or their official websites. Skipping the notice costs the school the exception entirely: without it, directory information cannot be released without consent.
What a School Cannot Designate
A student’s Social Security number can never be treated as directory information under any circumstances.4U.S. Department of Education. May a Social Security Number or Other Student Identification Number Be Listed as Directory Information
Student ID numbers fall into a middle zone. A school may designate a student’s user ID or electronic identifier as directory information only if that identifier cannot be used on its own to access education records. It has to be paired with a second authentication factor, like a password or PIN.4U.S. Department of Education. May a Social Security Number or Other Student Identification Number Be Listed as Directory Information If an ID number printed on a badge could be typed into a portal to pull up grades or disciplinary records without additional verification, that number does not qualify.
Limiting Who Gets the Information
A school is not stuck with an all-or-nothing policy. Under 34 CFR § 99.37(d), a school can announce in its public notice that directory information disclosures will be limited to certain parties, certain purposes, or both.5eCFR. 34 CFR 99.37 – What Conditions Apply to Disclosing Directory Information A university might state that it will release directory information only to other educational institutions and to prospective employers, but not to the general public. Once the school makes that commitment, the restriction binds it. The data cannot then go to a commercial mailing list company or a data broker.
This matters because FERPA itself does not broadly prohibit sharing directory information with commercial entities. If a school’s notice sets no limits, nothing in federal law stops a marketer or data aggregator from asking. A limited directory information policy is the main tool schools use to prevent that. Families concerned about commercial data use should check whether their school has adopted one, and if not, weigh opting out.
How to Opt Out
Parents and eligible students block directory information releases by submitting a written objection to the school within the deadline stated in the annual notice.6U.S. Department of Education. Directory Information Once the school receives the request, it flags the student’s record and stops public disclosure of that student’s directory information. Registrars often call this a directory hold or a FERPA block.
The opt-out does not expire when the student leaves. Under 34 CFR § 99.37(b), a school must keep honoring any valid opt-out made while the student was enrolled, even after graduation or transfer, unless the student later rescinds it.5eCFR. 34 CFR 99.37 – What Conditions Apply to Disclosing Directory Information To lift the hold, the former student has to contact the school and rescind. The regulation does not specify a format for rescission, so practices vary.
What an Opt-Out Does Not Cover
A directory hold is designed to prevent external public disclosure, not to keep a student anonymous on campus. Even with an opt-out on file, a school can still:3eCFR. 34 CFR 99.37 – What Conditions Apply to Disclosing Directory Information
- Require the student to disclose their name, student identifier, or institutional email address in a class in which the student is enrolled
- Require the student to wear or publicly display an ID card or badge showing information the school has properly designated as directory information
Military Recruiters and High School Students
High school students face an extra disclosure rule that runs alongside FERPA. Under 20 U.S.C. § 7908, every local school district that receives federal funding under the Elementary and Secondary Education Act must give military recruiters and institutions of higher education the name, address, and telephone listing of each secondary school student on request.7Office of the Law Revision Counsel. 20 USC 7908 – Armed Forces Recruiter Access to Students and Student Recruiting Information That requirement applies even if the school has not designated those three items as directory information under FERPA.
Parents can opt out of this disclosure by submitting a written request, and schools must tell parents the option exists. If a school combines its FERPA directory information notice with its military recruiter notice, and a parent opts out of disclosing names, addresses, or phone numbers to third parties generally, that opt-out covers military recruiters too.8U.S. Department of Education. If a Parent Opts Out of the Public Non-Consensual Disclosure of Directory Information, Must the Three Data Elements Be Released to Military Recruiters If the school uses separate notices, parents need to opt out of each one. Read the notice carefully to see which situation applies.
If a School Gets It Wrong
FERPA enforcement runs only through the U.S. Department of Education. The Supreme Court held in 2002 that students and parents cannot sue a school for damages over a FERPA violation. The only recourse is an administrative complaint to the Department’s Student Privacy Policy Office.
A complaint must be in writing and filed within 180 days of the alleged violation or of when you learned about it. It has to include specific factual allegations. The Department encourages trying to resolve the issue directly with the school first. Complaints can be emailed to FERPA.Complaints@ed.gov or mailed to the Student Privacy Policy Office at 400 Maryland Ave, SW, Washington, DC 20202-8520.9U.S. Department of Education. File a Complaint
On paper, the Department can withhold federal funding, issue cease-and-desist orders, or terminate a school’s eligibility for federal programs.10U.S. Department of Education. 34 CFR Part 99 – Family Educational Rights and Privacy In practice, the Department has never cut off funding to a school for a FERPA violation. Enforcement typically involves an investigation, notice to the school, and required corrective action. Set expectations accordingly: most of the leverage comes from a school’s interest in avoiding a federal investigation, not from the threat of lost funds.