What Is FERPA? The Student Privacy Law, Simply Explained

If you have ever wondered who is allowed to see a student’s grades, attendance, or disciplinary history, FERPA is the law that answers that question. It gives students and their parents certain rights over those records, and it sets rules for when a school can share that information and when it cannot.

The basics are simpler than they sound. This blog walks through what FERPA covers, who it protects, what counts as an education record, and what a violation actually looks like, so you can understand your rights or your responsibilities without wading through legal language.

Main Takeaways

• FERPA (the Family Educational Rights and Privacy Act) protects student education records at every school that receives federal money. All rights transfer to students at age 18 or upon college enrollment.
• A FERPA waiver on the Common App covers only recommendation letters. It does not authorize the ongoing release of records to parents after enrollment.
• Most FERPA violations stem from human error, like emailing grades to an entire class or posting names publicly, not from intentional breaches.
• Schools must issue annual FERPA notifications, document non-consensual disclosures, and train staff who handle records, or risk federal funding loss.
• Ongoing FERPA training for all staff who handle records reduces violation risk more than a once-a-year orientation session.

What Is FERPA? What It Covers and Who It Protects

The Family Educational Rights and Privacy Act, or FERPA, is a federal law signed in 1974. It gives students and parents in K-12 two basic protections: the right to see their own education records, and the right to decide who else can see them. The U.S. Department of Education enforces FERPA through its Student Privacy Policy Office (SPPO).

Who does FERPA apply to? Every school, public or private, that receives federal funding. That includes K-12 districts, community colleges, and four-year universities. If your school accepts federal dollars, FERPA bars you from releasing personally identifiable information from education records without consent.

What Counts as an Education Record

Under FERPA, an education record is any record your school maintains that is directly related to a student. Common examples include grades and transcripts, class schedules, disciplinary files, financial aid records, attendance records, and student identification information.

What FERPA does not cover:

• Campus security camera footage
• Campus police reports (these are law enforcement records, not education records)
• Grouped or anonymized demographic data
• Information a teacher shares verbally in conversation

How FERPA Rights Shift From K–12 to College

At the K-12 level, parents and legal guardians hold all FERPA rights. The moment a student turns 18 or enrolls in college, those rights transfer entirely to the student, who becomes an “eligible student” under the law. For parents, this shift is real: the college cannot confirm whether your child is enrolled, share grades, or discuss disciplinary matters, unless your student provides written consent.

Directory Information

FERPA defines a category called directory information that your school may release without consent unless the student or parent opts out. Typical directory information includes name, address, phone number, email, enrollment status, dates of attendance, and degrees or honors received. The SPPO provides a Model Notice for Directory Information that schools can use as a template, including the opt-out procedure every school must offer before sharing this data.

When FERPA Allows Sharing Without Consent

Federal rules (34 CFR § 99.31) permit disclosure without consent in multiple cases. Your faculty and staff need to know each one and its limits.

1. School officials with a legitimate educational interest: a teacher, advisor, or admin who needs the record to do their job, not someone who is simply curious.
2. Transfer to another school where the student seeks or intends to enroll.
3. Federal or state education authorities conducting audits, reviews, or enforcement.
4. Financial aid purposes connected to aid the student has applied for or received.
5. Groups conducting studies on behalf of the institution.
6. Accrediting organizations carrying out their accrediting functions.
7. Judicial orders or lawfully issued subpoenas: you must make a fair effort to notify the student or parent before releasing records, unless the order bars it.
8. Health or safety emergencies: this exception is narrow and applies only when the threat is immediate and serious.
9. State and local juvenile justice authorities acting under state law.
10. Parents of a dependent student: if the student is claimed as a dependent for IRS tax purposes, a school may share records with either parent without the student’s consent (34 CFR 99.31(a)(8)).
11. Parents of a student under 21: a postsecondary institution may notify parents of the student’s violation of alcohol or controlled-substance laws or policies (34 CFR 99.31(a)(15)).

FERPA Waivers, Violations, and What They Mean for You

Millions of students and thousands of school employees encounter FERPA waivers and potential violations every year, and the two are frequently confused.

What Is a FERPA Waiver

A FERPA waiver appears in many college application processes, including the Common App and institution-specific applications. The most common example is the recommendation letter waiver, which asks applicants whether they want to waive their right to review letters of recommendation after enrolling. Nearly 1.5 million first-year applicants used the Common App in 2024-25, where students were asked whether to waive this right. Signing the waiver tells admissions offices the letters are candid, and many counselors encourage students to do so.

The second is the records-release form a student signs after enrolling in postsecondary education. This is a separate decision: through it, a student lets the college share grades, billing details, or other records with a parent or guardian. Signing the waiver through the college application process does not affect this choice. A student can give up access to recommendation letters and still keep full control over every other record.

What Is a FERPA Violation

A FERPA violation happens whenever a school releases personally identifiable information from education records without proper permission. Three scenarios show how easily it occurs:

1. A school secretary reads a student’s disciplinary record aloud over the phone to a caller claiming to be a relative, without verifying who they are.
2. A coach posts team GPA eligibility rankings, with names attached, to a group chat that includes parents and other students.
3. A district uploads a spreadsheet of special-education service records to a public-facing website folder, leaving it accessible to anyone with the link.

These are not edge cases. New York’s education agencies alone logged 384 data incidents in 2024, an 88% jump from the prior year, most of them traced back to human error, according to the NYSED 2024 Data Privacy and Security Annual Report. When someone believes a violation has occurred, they can file a complaint with the DOE’s Student Privacy Policy Office, which then checks whether the school has a “policy or practice” of non-compliance, looking for patterns rather than one-off mistakes. Regular FERPA training for all staff, not just administrators, is the best way to prevent these scenarios.

What FERPA Requires of Schools, in Brief

Every school that accepts federal funding has ongoing FERPA obligations: issue an annual notification of rights, document every non-consensual disclosure, and maintain the training and procedures that prevent violations. A pattern of failing them can put federal funding at risk.

Building FERPA compliance into an ongoing program, rather than a single orientation slide, is what keeps schools out of trouble. Platforms like Vector LMS help schools assign FERPA training to all staff and track completion automatically.

Build a Compliance Program That Protects Your School With Vector Solutions

You now have a clear picture of what FERPA protects, who holds the rights, and how records can and cannot be disclosed, whether you oversee a K-12 district or a college campus.

Vector Solutions helps schools build FERPA compliance into daily operations, not just annual paperwork: every staff member finishes required training on schedule, you keep documented records of who completed what and when, and your school lowers the risk of violations that threaten the funding your programs depend on.

Frequently Asked Questions About FERPA

Can a parent access their college student’s grades without the student’s permission?

Usually no. Once a student enrolls in college or turns 18, FERPA rights transfer to the student, and the school cannot share grades, billing, or disciplinary records with parents without written consent, typically a records-release form naming specific people and information. There are two common exceptions: if the student is claimed as a dependent for IRS tax purposes, the school may disclose records to either parent without consent (though it is not required to); and for a student under 21, a college may notify parents of an alcohol or controlled-substance violation. A separate nuance applies to dual enrollment: a minor taking college classes holds the rights at the college, while parents keep their rights at the high school, and the two schools may exchange information about the student.

What does FERPA stand for, and what does it do?

FERPA stands for the Family Educational Rights and Privacy Act, a 1974 federal law that protects the privacy of student education records. It gives students (or their parents, for minors in K-12) the right to inspect their records, request amendments, consent to most disclosures, and file a complaint with the U.S. Department of Education. It applies to every school that receives federal funding.

How do I know if my school’s annual FERPA notice meets federal requirements?

Your notice must cover four rights: inspecting records, requesting amendments, consenting to disclosures, and filing complaints. Deliver it through a method likely to reach students and parents, such as a student handbook, email, or posted notice, and issue it annually even if the content has not changed. The SPPO provides a Model Notice for Directory Information that schools can use as a template.

What happens if a teacher accidentally emails a student’s grade to the wrong recipient?

That is a FERPA violation: the teacher shared personally identifiable information from an education record without permission. The affected student or parent can file a complaint with the Department of Education’s Student Privacy Policy Office, which checks whether the school has a “policy or practice” of non-compliance. Repeated incidents signal weak training or controls. The school should document the incident, notify affected parties, and review its disclosure procedures and training schedule.