Executive Summary: What is it?
The Family Educational Rights and Privacy Act (FERPA) is a US federal law that protects the privacy of student education records. It applies to all educational institutions that receive funds under programs administered by the US Department of Education, effectively all US public K-12 schools and universities. FERPA grants parents and eligible students the right to inspect, amend, and control the disclosure of education records. The legal obligation rests on the institution, not on the software that stores or transmits that data.
CFO / Business Impact: What does it cost/risk?
- EdTech Market Access: FERPA sets no eligibility status for software. A vendor that hosts or processes education records for an institution may receive them without consent as a "school official". It qualifies when it performs a service the institution would otherwise use employees for, works under the institution's direct control over the use and maintenance of the records, is subject to the redisclosure limits of 34 CFR 99.33(a), and the institution has determined it has a legitimate educational interest.
- Liability Exposure: Unauthorized disclosure of student records (grades, disciplinary history, financial aid data) exposes the institution to enforcement by the US Department of Education, which can withhold or terminate its program funding (34 CFR 99.67(a)); a vendor that improperly rediscloses the records can be denied access to them for at least five years (34 CFR 99.67(e)).
Technical Reality: How does it work?
- Data Minimization: Collect and retain only the minimum student data necessary for the defined educational purpose. Broad telemetry collection is a common FERPA violation vector.
- Access Control ("Legitimate Educational Interest"): The institution must use reasonable methods so that school officials reach only the records in which they have a legitimate educational interest. Physical or technological access controls, such as role-based access, are one way; an effective administrative policy is the other (34 CFR 99.31(a)(1)(ii)).
- Third-Party Disclosure Logging: The institution must record each disclosure of personally identifiable information from education records, except disclosures to the parent or eligible student, to school officials (which include qualifying vendors acting for it), to parties with written consent, of directory information, and under certain subpoenas (34 CFR 99.32(a), (d)). Outside the exceptions in 34 CFR 99.31, a disclosure needs written consent from the parent or eligible student (34 CFR 99.30).
What the Label Means in a Solution Profile
FERPA binds schools and universities, not software, and no official FERPA certification exists.
- Self-Hosted line: No self-hosted line carries a FERPA label: the law sets no technical requirement for software.
- Managed service line: A managed service shows "FERPA (Self-Assessed)" only when its published terms make the vendor a school official under the institution's direct control, bound by the redisclosure limits of 34 CFR 99.33(a).