The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law passed in 1974 that bars the disclosure of personally identifiable data in student records to third parties without parental consent.
Yet FERPA has been considerably weakened in recent years to make it possible to enable schools and districts to share these data with others for a multitude of reasons, including allowing it to be disclosed to vendors, consultants and contractors for administrative, instructional or assessment purposes (known as the “school official/contractor” exception) and/or to organizations or individuals for vaguely-defined evaluation or audit purposes, without either notifying parents or gaining their consent (known as the “authorized representative” exception).
In addition, yet a third loophole allows nonconsensual disclosures (and re-disclosure) of personally identifiable information (or PII) for “studies.” [For more information on how FERPA has been revised, see our fact sheet on FERPA.]
What rights do parents still have under FERPA?
1. The right to inspect the information in their child’s education records, whether this data is held by the state, the local district or their child’s school.
2. The right to correct information in their child’s records if there are errors. If the school, district or state agency refuses to correct the record, the parent has the right to a formal hearing. After the hearing, if the school or agency still refuses to correct the record, the parent has the right to amend the record by placing a statement into the child’s record setting forth his or her view about the contested information.
3. The right to be informed as the school/district’s criteria in determining who constitutes a school official or other third party with a legitimate educational interest to whom the school/district intends to disclose personally identifiable information without parental consent.
4. The right to opt out of any “directory information” about their child being made public. Directory information generally includes a student’s name, address, email, telephone number, date and place of birth, honors and awards, and/or dates of attendance. Schools must tell parents before sharing directory information that they have the right to opt out . (For information on how to opt out of “directory information” please see here.)
5. The right to opt out of having their child’s name, address and telephone from being provided to military recruiters.
6. The right to be informed of their FERPA rights each year by their school or district. The actual means of notification (letter, PTA bulletin, student handbook, or website) is left to the discretion of each school.
7. When students turn 18 or enroll in a postsecondary institution at any age, their rights under FERPA transfer from their parents to themselves.
For FAQs on FERPA, see here: http://www2.ed.gov/policy/gen/guid/fpco/faq.html and http://www2.ed.gov/policy/gen/guid/fpco/hottopics/ht-10-09-02a.html
See also guidance from the Privacy Technical Assistance Center (PTAC) of the US Dept of Education for what to look for in the Terms of Service to ensure that any online operator receiving student data under the “school official” exception complies with FERPA: Protecting Student Privacy While Using Online Educational Services: Model Terms of Service (Revised March 2016).
If you believe that your FERPA rights have been violated, you should first complain to your school, district Superintendent and/or school board. If they refuse to take appropriate action, you should file a complaint with the Family Policy Compliance Office of the US Department of Education. More information about FERPA and instructions on how to how to file a complaint are here: http://www2.ed.gov/policy/gen/guid/fpco/ferpa/parents.html You should try to be as specific as possible.
The Protection of Pupil Rights Amendment (PPRA) (20 U.S.C. § 1232h; 34 CFR Part 98) was enacted in 1978, and applies to student surveys, instructional materials or evaluations funded by the federal government that deal with highly sensitive issues.
What rights to parents have under the PPRA?
1. Parents have the right of written consent before their children are required to participate in any federally funded survey, analysis or evaluation dealing with information concerning:
- Political affiliations;
- Mental and psychological problems potentially embarrassing to the student and his/her family;
- Religious affiliations and beliefs;
- Sex behavior and attitudes;
- Illegal, anti-social, self-incriminating and demeaning behavior;
- Critical appraisals of individuals with whom respondents have close family relationships;
- Legally recognized privileged relationships, such as those of lawyers, physicians, and ministers; or
- Income (other than that required by law to determine eligibility for a program).
If taking the survey is mandatory for students, parents must be provided with the right of prior consent before the survey is administered, whether or not it is federally funded. This is an important parent right often omitted by districts. (You can find the legislative authority for this in 20 U.S.C. § 1232h(b).)
2. If the survey, analysis or evaluation that deals with issues listed above are not federally funded, or are not mandatory, parents must be notified in advance of the survey and have the right to opt their children out of participating.
3. In either case, schools and/or their contractors must make these instructional materials or surveys available for inspection by parents ahead of time, to allow them to decide whether to consent or opt out.
The PPRA also grants parents the right to receive notice and an opportunity to opt their children out of:
4. Any non-emergency, invasive physical exam or screening administered by the school unnecessary to protect the immediate health and safety of a student, except for hearing, vision, or scoliosis screenings, or any physical exam or screening permitted or required under State law; and
5. Activities involving collection, disclosure, or use of personal information obtained from students for marketing or to sell or otherwise distribute the information to others.
If you believe your PPRA rights have been violated, you should take the actions listed above under FERPA.
For more on on PPRA, see here: https://studentprivacy.ed.gov/content/ppra
Congress enacted the Children’s Online Privacy Protection Act (COPPA) in 1998, which is regulated by the Federal Trade Commission, not the US Department of Education.
The primary goal of COPPA is to allow parents to have control over what information is collected online from their children under age 13. The law applies to any operators of websites, online services including web-based testing, programs or “apps” that collect, use, or disclose children’s personal information, whether at home or at school. However, COPPA only applies to personal information collected online from children; it does not cover information collected from adults that may pertain to children.
The personal information can include the child’s name,email, phone number or other persistent unique identifier, and information about parents, friends and other persons. The law recognizes that the school can consent on behalf of the parent to create accounts and enter personal information into the online system– but only where the operator collects personal information for the use and benefit of the school, and for no other commercial purpose. Unfortunately, many schools fail to engage in proper due diligence in reviewing third-party privacy and data-security policies, and inadvertently authorize data collection and data-mining practices that parents find unacceptable.
What rights do parents have under COPPA when online programs are used in schools?
The FTC revised guidance on best practices in March 2015, shifting some parental rights to schools. If your under-13 child is participating in an online program from a service provider or commercial website collecting personal information, whether for instructional, testing, or other purposes, the school and/or vendor or service provider must provide your school with a clear and prominent privacy policy and use practices on its website or elsewhere, including the following:
- The name, address, telephone number, and email address of the vendors collecting or maintaining personal information through the site or service;
- A description of what personal information the operator is collecting, including whether the website or program enables children to make their personal information publicly available, how the operator uses such information, and the operator’s disclosure practices for such information; and
- That the school can review or have deleted the child’s personal information and refuse to permit its further collection or use, and provide the procedures for doing so.
Best practice on the part of the school would also be to require written consent from parents if their child under 13 is using such a program, especially if the program contains ads or any marketing material.
In any event, when an online operator receives consent from the school, the operator must, upon request, provide schools with the following:
- A description of the types of personal student data collected;
- An opportunity to review a student’s information and/or have it deleted;
- The ability to prevent the online program from any further use or collection of a student’s personal information.
For FAQs on COPPA, see here: http://www.business.ftc.gov/documents/0493-Complying-with-COPPA-Frequently-Asked-Questions
You can also contact the FTC to ask questions or issue a complaint if the online operator refuses to provide you with these rights by emailing here: [email protected]
The above summaries of parental rights and opt out forms are aligned with our understanding of federal student privacy laws, which are complex and have changed over time. Any questions, corrections or suggestions for improvement, please email us at [email protected] thanks!