What Are the Penalties for a FERPA Breach of Confidentiality?

The penalties for a FERPA breach of confidentiality are narrower than most people expect. The only sanction written into the statute itself is loss of federal education funding, and the U.S. Department of Education has never actually pulled a school’s funding over a privacy violation. Individual employees face no fine or prison sentence under FERPA. But a breach can still cost someone their job, and when the conduct overlaps with identity theft, computer intrusion, or fraud, separate federal statutes carry sentences of up to 30 years.

What FERPA Actually Punishes

FERPA’s enforcement tools sit entirely with the Secretary of Education. The Secretary can withhold further payments to the institution, issue a cease-and-desist order, or terminate the school’s eligibility to receive federal funding entirely.¹ For a university that depends on federal financial aid revenue, losing eligibility would be catastrophic. For a public school district, it could mean losing Title I funds, special education dollars, and school lunch subsidies.

In practice, the Department treats funding termination as a last resort. The Student Privacy Policy Office (SPPO), which handles FERPA complaints and investigations, follows a process designed to bring schools into compliance rather than punish them. When the office finds a violation, it issues a written notice describing the specific steps the school must take and gives the school a reasonable period to fix the problem voluntarily.¹ Schools that cooperate and implement corrective measures keep their funding. The SPPO has never escalated to an actual funding cutoff.²

That leaves FERPA’s formal penalty scheme largely theoretical. The threat of a funding cutoff motivates institutions to take complaints seriously, but the actual outcome of a substantiated FERPA complaint is almost always a corrective action plan, not a check that stops arriving.

Why Individuals Do Not Face FERPA Fines

FERPA directs its penalties at institutions, not individual employees. A teacher, registrar, or administrator who improperly shares student records will not be fined or charged under FERPA itself. The practical consequences can still be serious. Schools routinely discipline employees for privacy violations through reprimands, suspension, or termination. For licensed professionals like teachers and counselors, a pattern of careless handling of student data can put professional certifications at risk depending on the state’s licensing standards.

The more damaging career consequence often comes from the investigation itself. Once a complaint reaches the SPPO, the school needs to identify what went wrong and who was responsible. Employees involved in a substantiated violation frequently become the focus of internal corrective action, even when the school as a whole escapes federal sanctions.

No Private Lawsuit for Damages

Parents and students cannot sue a school for a FERPA violation and collect damages. The Supreme Court closed that door in Gonzaga University v. Doe, holding that FERPA’s confidentiality provisions “create no personal rights to enforce” in court. The statute speaks only to the Secretary of Education, directing that funding be withheld from noncompliant institutions. That language is “two steps removed from the interests of individual students and parents” and does not create the kind of individual right that supports a lawsuit.³

That ruling also forecloses a FERPA claim brought under 42 U.S.C. § 1983. Some lower courts had allowed that workaround before Gonzaga, but the Supreme Court shut it down. A parent whose child’s records were improperly shared can still pursue other legal theories, including state privacy torts, breach of contract, or negligence, but those claims stand or fall on their own merits and have nothing to do with FERPA.

Prison Time Under Related Federal Laws

FERPA carries no criminal penalties. No one goes to prison for violating FERPA. The conduct involved in a breach, though, sometimes overlaps with conduct that is separately criminalized under other federal statutes. When it does, the criminal exposure is real.

Identity Theft and Aggravated Identity Theft

If someone uses student records to steal identities, federal identity theft charges under 18 U.S.C. § 1028 carry up to 15 years in prison. The maximum rises to 20 years when the offense is connected to drug trafficking or a crime of violence, and to 30 years when it facilitates domestic or international terrorism.⁴

Aggravated identity theft under 18 U.S.C. § 1028A works differently. Anyone who uses another person’s identity during and in relation to a qualifying felony receives a mandatory two-year prison sentence added on top of the sentence for the underlying crime. For terrorism-related offenses, that mandatory add-on increases to five years.⁵

Computer Fraud and Abuse Act

When a breach involves hacking into a school’s computer system or exceeding authorized access to obtain student records, the Computer Fraud and Abuse Act (18 U.S.C. § 1030) applies. The penalties scale with severity. A first-time offender who simply accesses records without authorization faces up to one year in prison. That rises to five years if the access was for financial gain or in furtherance of another crime. A repeat offender under the same provision faces up to ten years, and the most serious CFAA offenses, such as accessing national defense information, carry up to twenty years for repeat violators.⁶

Mail Fraud and Wire Fraud

If stolen student information feeds into a broader fraud scheme, mail fraud (18 U.S.C. § 1341) and wire fraud (18 U.S.C. § 1343) each carry up to 20 years in prison.⁷⁸ When the fraud affects a financial institution or involves a presidentially declared disaster, both statutes increase the maximum to 30 years and add a potential fine of up to $1,000,000. Mail fraud covers schemes that use the postal service or commercial carriers. Wire fraud covers anything transmitted electronically, which today captures most fraud schemes involving email, online forms, or electronic transfers.

What FERPA Does Not Require After a Breach

FERPA does not require schools to notify students or parents when their records have been improperly disclosed or stolen. The Department of Education has stated explicitly that it lacks authority under FERPA to require direct notification after an unauthorized disclosure. The only record-keeping obligation is that the school must log the disclosure so that a parent or student who inspects the record will see that it happened.⁹

The Department recommends that schools voluntarily notify affected individuals when the compromised data includes Social Security numbers or other information that could lead to identity theft. Many states have their own data breach notification laws that may independently require disclosure. Under FERPA alone, though, a school could suffer a large data breach and have no federal obligation to tell anyone directly.

How to File a FERPA Complaint

The only formal enforcement channel available to a parent or student is a complaint to the Student Privacy Policy Office at the U.S. Department of Education. You have 180 days from the date of the alleged violation, or 180 days from the date you learned about it, to file.¹⁰

Before filing, the Department encourages you to try resolving the issue directly with the school. If that doesn’t work, the complaint must be in writing and must include specific facts describing what happened. Only a parent can file for a minor child; once the student turns 18 or begins attending a postsecondary institution at any age, only the student can file.

You can submit the complaint by completing the FERPA complaint form available on the Department’s website and either emailing it to FERPA.Complaints@ed.gov or mailing it to:

U.S. Department of Education
Student Privacy Policy Office
400 Maryland Ave, SW
Washington, DC 20202-8520

The SPPO will investigate to determine whether a violation occurred. If one did, the office works with the school to achieve voluntary compliance. The 180-day deadline is firm. Miss it, and the office will likely dismiss the complaint regardless of the merits.¹⁰

1
U.S. Department of Education. Family Educational Rights and Privacy Act (FERPA) – Subpart E
2
Institute of Education Sciences. Forum Guide to Protecting the Privacy of Student Information – Section 6
3
Justia Law. Gonzaga Univ v Doe – 536 US 273 (2002)
4
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
5
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
6
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
7
Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles
8
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
9
U.S. Department of Education. Data Breach Response Checklist
10
U.S. Department of Education. File a Complaint