Student Data Privacy: What Schools Can Share Under FERPA

Your child’s school uses a reading app, a math platform, a learning management system, a communication app and a gradebook. Each one holds information about your child. Who decides what gets shared, and with whom?

The main federal law here is FERPA, the Family Educational Rights and Privacy Act. It gives parents real rights, but it also has exceptions that allow a lot of sharing without asking you first. Knowing where the lines are helps you protect your child’s information and ask better questions.

This guide explains what FERPA covers, what schools can share without consent, how directory information opt-outs work, related laws and the questions to ask about the apps your child uses. This is general information, not legal advice.

What FERPA is and who it covers

FERPA is a federal law passed in 1974 (20 U.S.C. § 1232g, with regulations at 34 CFR Part 99). It protects the privacy of student education records, which are records directly related to a student and kept by a school or someone acting for the school. That includes grades, transcripts, attendance, discipline records, special education records and many records held in school software.

FERPA applies to schools and districts that receive funds under programs administered by the US Department of Education. That covers virtually all public K-12 schools. Many private and religious K-12 schools don’t receive such funds, so FERPA may not apply to them. Ask a private school directly about its privacy policy.

FERPA gives parents 3 core rights:

1. The right to inspect and review your child’s education records. Schools must respond within 45 days of a request.
2. The right to request corrections to records you believe are inaccurate or misleading, and to a hearing if the school refuses.
3. Some control over disclosure, meaning schools generally need your written consent before sharing personally identifiable information from education records, subject to exceptions.

When your child turns 18 or enrolls in college at any age, they become an “eligible student,” and these rights transfer to them.

What schools can share without your consent

This is where most parents are surprised. FERPA includes several exceptions that let schools disclose information without asking first. Some of the most common:

The “school official” exception is the big one for apps. Under Department of Education guidance, a vendor can receive student data without parent consent if it performs a service the school would otherwise do itself, has a legitimate educational interest, is under the school’s direct control regarding the use and maintenance of the data and doesn’t use or re-disclose it for other purposes. In practice, that “direct control” usually comes from the school’s contract or terms of service with the vendor.

Key takeaway: FERPA doesn’t stop schools from using edtech. It sets the rules for how vendors may use your child’s data. The strongest protection comes from the school’s contracts, so ask whether the school vetted the app and has a data privacy agreement in place.

Directory information and how to opt out

Directory information is information that wouldn’t generally be considered harmful or an invasion of privacy if disclosed. Each school decides what it includes, and it must tell parents through an annual notice.

Common examples include:

• Name, address and phone number
• Date and place of birth
• Grade level and dates of attendance
• Participation in sports and activities, including height and weight of athletes
• Honors and awards
• Photos, often used in yearbooks, programs and school social media

Schools can share directory information with anyone, without consent, as long as they’ve given parents notice, the right to opt out and a deadline to do it.

How to opt out:

1. Find your district’s annual FERPA notice, usually in the student handbook, registration packet or district website.
2. Note what’s listed as directory information and the opt-out deadline, often within the first few weeks of the school year.
3. Submit the opt-out form or a written request to the school office.
4. Decide whether to opt out of all directory information or, if your district allows, specific uses.

Think about trade-offs. A full opt-out can mean your child is left out of the yearbook, sports programs, honor roll lists and graduation programs. Some districts offer partial options, so read the form carefully.

Separately, high school families can opt out of having their child’s name, address and phone number shared with military recruiters. This comes from a different federal law, and many districts include it on the same form.

Related laws: PPRA, COPPA and state laws

FERPA isn’t the only law that matters.

• PPRA (Protection of Pupil Rights Amendment) gives parents rights over certain student surveys covering 8 protected areas, including political beliefs, mental health, sexual behavior, illegal behavior, religious practices and family income. It also requires notice and an opt-out for some marketing-related data collection.
• COPPA (Children’s Online Privacy Protection Act) is enforced by the FTC and covers online services that collect personal information from children under 13. The FTC’s amended COPPA Rule took effect June 23, 2025, with most compliance required by April 22, 2026.
• State student privacy laws. Many states have their own laws that limit how edtech companies can use student data, such as banning targeted advertising or the sale of student data. See our US state data privacy laws guide for an overview.

Health information is a common point of confusion. School nurse records for K-12 students are generally education records under FERPA, not HIPAA records. Our article on whether your health app is covered by HIPAA explains why that distinction matters for apps in general.

Questions to ask about school apps

Most families never see the list of apps their child uses. You can ask. Send these to your school’s principal, technology director or data privacy officer:

1. Which apps and online services does my child’s class use, and is there a published list?
2. Has the district reviewed each app’s privacy practices before approving it?
3. Does the district have a signed data privacy agreement with each vendor?
4. What student data does each app collect?
5. Can vendors use student data for advertising, product development or AI training?
6. How long is data kept, and is it deleted when my child leaves?
7. Who do I contact if I believe data was shared improperly?

When you evaluate apps you choose yourself at home, the same thinking applies. Our guide on how to judge a learning app for kids has a privacy checklist.

How to review or correct your child’s records

1. Make a written request to the school or district listing the records you want to review.
2. Expect a response within 45 days. The school arranges a time and place to review records. Schools generally must provide copies only if not doing so would effectively prevent you from accessing them, though many do so anyway.
3. Review carefully. Look for errors in grades, attendance, discipline or contact information.
4. Request a correction in writing, explaining what’s wrong and why.
5. Ask for a hearing if the school refuses. If the school still won’t change it, you have the right to add a statement to the record explaining your view.

For everyday grade tracking, the parent portal is easier. See our guide to tracking grades in a school parent portal.

What to do if you think FERPA was violated

Start by contacting the school or district. Many problems are resolved quickly once raised.

If that doesn’t work, you can file a complaint with the US Department of Education’s Student Privacy Policy Office. Complaints must be in writing, include specific facts and generally be filed within 180 days of the alleged violation or of when you knew or should have known about it. Once rights have transferred to an eligible student, parents generally can’t file.

If you believe your child’s data was exposed in a breach, consider the identity protection steps in how to protect yourself from identity theft, including a credit freeze for minors.

Where to start this week

1. Find your district’s annual FERPA notice and note the directory information opt-out deadline.
2. Decide on opt-outs for directory information and military recruiter disclosure.
3. Ask for the list of approved apps and whether privacy agreements are in place.
4. Talk to your child about what they share in school apps and on school devices. Our guide to school Chromebook monitoring and privacy explains what schools can see.

Conclusion

FERPA gives parents real rights: to see records, correct them and control many disclosures. But exceptions for directory information, school officials and edtech vendors mean plenty of data moves without your signature. Use the opt-outs that matter to your family, ask your school how it vets apps and review your child’s records when something looks off.

Sources

• US Department of Education: What is FERPA? — FERPA basics, parent rights and transfer of rights at 18
• US Department of Education: Model notice for directory information — directory information examples and opt-out notice
• US Department of Education: File a complaint — 180-day deadline and complaint requirements
• US Department of Education: Protecting Student Privacy While Using Online Educational Services — school official exception for edtech vendors
• Federal Register: Children’s Online Privacy Protection Rule (2025) — amended COPPA Rule effective and compliance dates