What Is FERPA? Family Educational Rights and Privacy Act Explained for Students and Parents
FERPA — the Family Educational Rights and Privacy Act — is a US federal law (20 U.S.C. § 1232g) that protects the privacy of student education records and gives eligible students and parents specific rights to access, amend, and control disclosure of those records. Schools, colleges, and universities that receive federal education funding must comply. This guide explains what FERPA covers, what it does not, directory information rules, penalties for violations, and practical steps — written as a real education explainer, not a thin quiz doorway.
This is not legal advice. Policies vary by institution. Verify with your school's FERPA policy, registrar, or legal counsel, and consult the US Department of Education FERPA resources for official guidance.
What FERPA Protects — Education Records
FERPA regulates education records — records directly related to a student and maintained by an educational agency or institution (or by a party acting for the institution).
Examples commonly treated as education records: grades and transcripts, enrollment, school discipline records, financial aid files, IEP documentation, and attendance maintained by the school.
Typically NOT education records in the usual FERPA sense (other laws may apply): campus clinic treatment records, school law-enforcement unit records (specific conditions), employment records when the student is staff, and alumni-only files created after enrollment ends.
Who Has Rights Under FERPA
| Situation | Who holds rights |
|-----------|------------------|
| K–12 (minor) | Parent generally exercises FERPA rights |
| College (eligible student) | Rights transfer to the student (typically 18+ or attending postsecondary) |
| Dependent college student | Parents may retain some access only in limited IRS-dependent circumstances with proof — institutional policies still gate release |
Eligible student status is why colleges often cannot discuss grades with parents without student consent.
Core Rights — Inspect, Amend, Consent
Right to Inspect and Review
Parents or eligible students may inspect and review the student's education records maintained by the school.
Timeline: Schools must comply with a request within a reasonable period, and in no case more than 45 days after the request.
Plan ahead for transcript deadlines, transfer applications, and dispute resolution — the 45-day clock is a common exam and training fact.
Right to Request Amendment
If records are inaccurate or misleading, FERPA provides a process to request amendment. Schools need not alter opinions or grades deemed accurate, but must respond and offer a hearing if required by policy.
Right to Consent to Disclosure
Generally, schools cannot disclose personally identifiable information (PII) from education records without written consent of the parent or eligible student.
Disclosure under FERPA means permitting access to, release, transfer, or other communication of personally identifiable information (PII) from education records — whether oral, written, or electronic.
Directory Information — What Can Be Shared Without Consent (Sometimes)
Schools may disclose directory information without consent if they:
1. Define which items count as directory information in public notice
2. Allow parents/eligible students to opt out of directory disclosures
Typical directory information examples (if designated by the school):
- Student name
- Address
- Telephone number
- Email address
- Dates of attendance
- Grade level / enrollment status
- Participation in sports or activities
- Degrees and awards received
Critical distinction: Student grades are NOT directory information. Grades are non-directory education records requiring consent (or another FERPA exception) before disclosure to outsiders.
Putting grades on a public honor roll without meeting directory/opt-out rules can violate FERPA — schools use policy designations carefully.
When Records May Be Released Without Consent
FERPA includes exceptions. Common training topics:
| Exception (summary) | Plain-language idea |
|---------------------|---------------------|
| School officials with legitimate educational interest | Staff who need access to do their jobs |
| Transfer to another school | Records sent for enrollment |
| Financial aid | As needed for aid programs |
| Health/safety emergency | Serious immediate threat |
| Judicial order/subpoena | Legal compulsion with notice rules |
| De-identified / anonymized data | Records released when all personally identifiable information has been removed so remaining persons cannot reasonably be identified |
That last point matters: de-identified records without PII are outside typical consent requirements because they are no longer education records identifying a student.
What Happens When Schools Fail FERPA Compliance
Institutions that fail to comply with FERPA may face enforcement by the US Department of Education. The serious institutional consequence emphasized in compliance training:
Schools can lose federal education funding — FERPA ties privacy compliance to federal financial assistance.
Individual employee mistakes trigger institutional responsibility — schools implement training, policies, and registrar controls to reduce risk.
Practical Scenarios — Parents and Students
"Can the professor email my grades to my parents?"
Generally no for eligible college students without student consent — grades are PII in education records, not directory information.
"Can my disciplinary hearing file be shared?"
School discipline records are education records — disclosure rules apply. Internal participants with legitimate educational interest differ from public release.
"Can researchers use student data?"
Only under de-identification standards or consent/exception paths — university IRB review applies.
FERPA vs. Other Privacy Laws
| Law | Focus |
|-----|-------|
| FERPA | Student education records at funded institutions |
| HIPAA | Health care records — usually not school grades |
| COPPA | Children under 13 online — commercial sites |
| State laws | May add stronger local rules |
Registrar grades stay FERPA; campus clinic treatment notes often follow different health-privacy rules.
How to Exercise Your Rights
1. Read the institution's annual FERPA notice
2. Request inspection in writing — track the 45-day window
3. Opt out of directory information if desired
4. Use consent forms for third-party releases
5. Escalate to US Dept. of Education after internal steps fail
Red Flags — Misinformation to Avoid
| Myth | Reality |
|------|---------|
| Grades are directory info | False |
| FERPA only applies to K–12 | False — postsecondary too |
| Email isn't disclosure | PII by email can count |
FAQ
What is FERPA in simple terms?
FERPA is a US law protecting student education records and giving parents/eligible students rights to see records, request corrections, and control most disclosures.
Are student grades directory information?
No. Grades are not directory information. Schools generally need consent or a FERPA exception to release grades to third parties.
What is directory information under FERPA?
Non-sensitive items a school designates in advance — like name, address, phone, dates of attendance — that may be disclosed unless the student/parent opts out.
What happens if a school violates FERPA?
Non-compliance can lead to US Department of Education enforcement, including potential loss of federal education funding for the institution.
When can education records be released without consent?
When a FERPA exception applies — e.g., school officials with legitimate interest, transfers, or when all personally identifiable information has been removed and identification is not reasonably possible.
Is a school discipline record an education record?
Yes — school discipline records maintained by the institution typically qualify as education records protected by FERPA.
What does disclosure mean under FERPA?
Disclosure means allowing access to, release, transfer, or communication of personally identifiable information from education records — in any medium.
How long does a school have to let me review records?
Schools must provide access within 45 days of a proper request (at latest — sooner if reasonable).
Is this article legal advice?
No. Consult your school's policy, counsel, and US Dept. of Education FERPA guidance for your situation.
The Takeaway
FERPA protects personally identifiable education records — including grades and discipline files — while allowing limited directory information only when properly designated and opt-out honored. Disclosure covers any release of PII; de-identified data falls outside typical consent rules. Schools face federal funding risk for serious non-compliance, and you may inspect records within 45 days. Verify with official school policy and US Department of Education resources — not blogs alone.
*Not legal advice. Confirm details with school counsel and official FERPA publications.*