Under FERPA, three groups can access a student’s education records: the parents (or the student, once rights transfer), school officials inside the institution who need the information to do their jobs, and specific outside parties the law names by category. Everyone else needs written consent. The Family Educational Rights and Privacy Act sets these rules for any school that receives funding from the U.S. Department of Education, and it draws the lines narrowly on purpose.
Which Schools Are Covered
FERPA applies to public schools, school districts, and postsecondary institutions such as colleges and universities that receive federal funding through the Department of Education. That covers nearly every public K–12 school and almost every college in the country. Private and parochial elementary and secondary schools generally do not receive this type of federal funding, so they are not bound by FERPA.1U.S. Department of Education. To Which Educational Agencies or Institutions Does FERPA Apply? A private K–12 school may still have its own privacy policy, but the rules described below do not apply to it.
Parents and the Student
Parents and legal guardians hold the primary right to inspect and review their child’s education records, which include transcripts, report cards, disciplinary files, and anything else directly related to the student that the school keeps.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights When a parent asks to see records, the school has 45 days to comply. It cannot charge for pulling the file, though it can charge a reasonable per-page fee for copies.3National Center for Education Statistics. Forum Guide to Protecting the Privacy of Student Information – Providing Copies or Charging a Fee
When the Student Takes Over
Parental access does not last forever. Once a student turns 18 or enrolls at any postsecondary institution at any age, that student becomes an “eligible student” and all FERPA rights transfer from the parent to the student.1U.S. Department of Education. To Which Educational Agencies or Institutions Does FERPA Apply? From that point on, the school needs the student’s consent before releasing records to anyone, including the student’s own parents. There is one workaround: if a parent still claims the student as a dependent on their federal tax return, the school may share records with that parent.4eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information?
Divorced and Non-Custodial Parents
The default rule surprises some families: both custodial and non-custodial parents have equal rights to their child’s education records. A school can only deny access to a non-custodial parent if it has been shown a court order, state statute, or other legally binding document that specifically revokes that parent’s right.5Protecting Student Privacy. In the Case of a Divorce, Do Both Parents Have Rights Under FERPA? A general custody agreement that awards one parent primary custody, without more, is not enough. The school may ask for proof of parenthood, such as a birth certificate, before granting access.
School Officials Inside the Institution
Not everyone employed by a school gets to browse student files. Access inside the institution is limited to “school officials” who have a “legitimate educational interest,” meaning they genuinely need the information to do their work.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights A teacher reviewing past grades to plan instruction qualifies. A counselor pulling attendance data to address chronic absences qualifies. A teacher who isn’t working with a particular student and wants to peek at that student’s disciplinary file does not.
“School official” isn’t limited to employees. Contractors, consultants, and volunteers who perform services the school would otherwise handle with its own staff can qualify, so long as the school directly controls how they use and maintain the records and they are prohibited from sharing the information further without permission.4eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information? That is how educational technology companies running online gradebooks, learning platforms, and testing software get access to student data. The school treats the vendor as a school official under a contract that restricts what the company can do with the records.
Each school must define, in its annual FERPA notification, exactly who it considers a school official and what counts as a legitimate educational interest. Those definitions vary from one institution to the next.6Protecting Student Privacy. 34 CFR Part 99 – Family Educational Rights and Privacy
Outside Parties Who Can Access Records Without Consent
FERPA names a specific set of situations in which a school may share records without asking a parent or eligible student first. The list is closed, not illustrative.
Another School the Student Is Transferring To
When a student transfers or seeks to enroll at another school district or college, the current school can forward records to the new institution without consent.4eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information?
Government Auditors and Education Authorities
Authorized representatives of the Comptroller General, the U.S. Attorney General, the Secretary of Education, and state or local education authorities can access records to audit or evaluate federally supported education programs.4eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information? Schools may also disclose records to state and local juvenile justice officials where a state statute specifically permits it.
Financial Aid Programs
If a student has applied for or received financial aid, the school can share records necessary to determine eligibility, set the award amount, establish conditions, or enforce the terms of the aid.4eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information?
Health and Safety Emergencies
When a school identifies an articulable and significant threat to the health or safety of a student or others, it can disclose information to those whose knowledge is necessary to address the emergency, such as law enforcement or medical personnel.6Protecting Student Privacy. 34 CFR Part 99 – Family Educational Rights and Privacy The Department of Education will not second-guess the school’s judgment if it had a rational basis at the time.
Judicial Orders and Subpoenas
A school can release records to comply with a lawfully issued judicial order or subpoena. It must generally make a reasonable effort to notify the parent or eligible student first, so they have a chance to object.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights
Research Organizations Working for the School
Records can go to organizations conducting studies on behalf of the school to develop predictive tests, administer student aid programs, or improve instruction. A written agreement is required, the study cannot allow outsiders to identify individual students, and the data must be destroyed when the study ends.4eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information?
Accrediting Bodies
Schools may disclose records to accrediting organizations carrying out their accreditation functions.4eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information?
Military Recruiters
School districts are generally required to provide student names, addresses, and telephone numbers to military recruiters upon request. Parents can opt out, just as they can with other directory information.7Protecting Student Privacy. What Are the Requirements for Access by Military Recruiters to High School Students?
Anyone Asking for Directory Information
Schools may release a category of records called “directory information” without consent. This includes items not generally considered sensitive: a student’s name, address, phone number, date of birth, dates of attendance, degrees and awards received, and participation in officially recognized activities and sports.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights Each school decides which categories it designates as directory information and must give parents and eligible students notice with a reasonable window to opt out in writing.8Protecting Student Privacy. Directory Information If you don’t opt out in time, the school can share this information with anyone who asks. That matters for families with safety concerns, since an address released as directory information is available broadly.
Everyone Else: Written Consent Required
A prospective employer, a scholarship committee, a private tutor, a grandparent, a family friend, or any other outsider who doesn’t fall into one of the categories above needs written permission before the school can share anything. The consent must be signed and dated, and it must specify which records are being released, who will receive them, and the purpose of the disclosure.6Protecting Student Privacy. 34 CFR Part 99 – Family Educational Rights and Privacy Vague or blanket authorizations do not satisfy FERPA.
Records That Aren’t Covered
Some records held by a school are not “education records” under FERPA at all, so the access rules above don’t reach them:
- Personal notes kept by a teacher or staff member as a memory aid, so long as no one else sees them except a temporary substitute.
- Records created by a school’s law enforcement unit for law enforcement purposes and kept by that unit. A campus police report can be released under the school’s own policy or state law.
- Records about a school employee that relate only to their role as an employee, not as a student. A student worker’s records tied to their student status are still education records.
- Treatment records for students 18 or older, or attending a postsecondary institution, that are created by a health professional for treatment purposes and shared only with treatment providers. If those records are shared beyond the treatment team, they lose that protected status.
- Records created or received after someone is no longer a student, when unrelated to their time as a student.
- Grades on papers graded by other students, before a teacher collects and records them.
If a School Gets Access Wrong
If you believe a school has released records to someone who shouldn’t have seen them, or has refused to let you see records you have a right to, you can file a written complaint with the Student Privacy Policy Office at the U.S. Department of Education. The complaint must set out specific facts and be submitted within 180 days of the violation or within 180 days of when you learned about it.10Protecting Student Privacy. File a Complaint
The enforcement lever is financial. If a school does not come into compliance after being notified, the Department can withhold federal funding, issue a cease-and-desist order, or terminate the school’s eligibility to receive federal funds. Third parties who misuse student data can be banned from receiving records from the school for at least five years.6Protecting Student Privacy. 34 CFR Part 99 – Family Educational Rights and Privacy FERPA does not give individuals the right to sue a school directly for a privacy violation; the complaint to the Department is the enforcement route available to parents and students.