Education

Under the federal Family Educational Rights and Privacy Act (FERPA), schools must have parental or adult student (18+ or attending college) consent before sharing personally identifiable information from educational records, except under specific conditions like health emergencies, compliance with subpoenas, or legitimate educational interests. Schools must inform parents and eligible students annually about these policies, including which school officials have access to records and why.

In some states, including California, additional protections such as the Student Online Personal Information Protection Act (SOPIPA) restrict education technology providers from sharing K-12 student data without consent, especially for commercial purposes such as targeted advertising. These state laws complement FERPA's baseline protections.

FERPA gives parents and eligible students (students over 18 or attending college) three fundamental rights: to inspect and review education records, request amendments to inaccurate or misleading records, and provide consent before the school can share personally identifiable information externally. If a school denies your request or violates FERPA rights, you can file a complaint with the U.S. Department of Education within 180 days of the incident.

FERPA does not allow individuals to directly sue for damages. Instead, enforcement is conducted administratively by the Department of Education, which investigates complaints and can require schools to correct violations or risk losing federal funding.

Currently, there are no comprehensive federal laws specifically regulating data collection by educational technology providers. However, many states have passed laws providing additional protections. For example, California’s SOPIPA (K-12) and ELPIPA (early learning settings) prohibit educational technology providers from targeted advertising, profiling students for non-educational purposes, and selling student data. Other states, such as Colorado, Illinois, and New York, offer similar protections.

To limit data collection, you should ask your school to disclose privacy policies and contracts with technology vendors, and exercise any available opt-out rights provided by your state’s laws or your school’s policies.

Start by documenting the issue clearly and communicating your concerns to your school or educational institution directly. If your concerns remain unresolved, FERPA provides a formal complaint process through the U.S. Department of Education's Student Privacy Policy Office. State authorities—like your state's Attorney General—may also offer additional recourse if state-specific student privacy laws are violated.

If your situation involves severe privacy violations or potential harm, consider seeking legal advice to explore all available options.

Generally, no. FERPA requires parental or eligible student consent before schools can share personally identifiable information externally. However, schools may disclose certain "directory information" (such as names, grade levels, or honors) unless you explicitly opt out. Schools must inform you annually about your right to opt out of directory information sharing.

Some states, including California (under SOPIPA), have stronger protections explicitly prohibiting commercial sharing of K-12 student information without consent. However, similar comprehensive protections typically do not yet exist for higher education students, highlighting a gap that Privacy Rights Clearinghouse advocates addressing through new legislation.

Yes. California has passed laws that extend student privacy beyond FERPA, notably SOPIPA (covering K-12) and ELPIPA (covering preschool and early learning settings). These laws prohibit ed-tech providers from engaging in targeted advertising, profiling students for non-educational purposes, and selling student data. However, higher education students currently do not have similar comprehensive protections, highlighting a gap that Privacy Rights Clearinghouse continues to address through our advocacy.

If you suspect your or your child's educational privacy has been violated, you can file a FERPA complaint with the U.S. Department of Education's Student Privacy Policy Office. Many states offer additional privacy protections, so contacting your state's Attorney General or Department of Education can also be helpful. For specific guidance, review your state's educational privacy laws and consult with appropriate state authorities or advocacy groups.