Contents

• Education Records and Covered Persons
• Owasso Independent School District v. Falvo
• What Materials Are Excluded from the Definition of "Education Records"?
• Whose Information Is Protected from Disclosure?
• Parental Access to Education Records
• Access and Review
• Parental Access to Information About Students' Gender Identity at School
• FERPA Carve-Outs: Directory Information and De-Identified Data
• FERPA Exceptions
• School Officials Exception
• Online Educational Services
• Law Enforcement Unit
• Threat Assessment Teams
• Health and Safety Emergency Exception
• Subpoena Exceptions
• Studies and Audits Exceptions
• State Law Juvenile Justice System Exception
• Victims of Crimes at Postsecondary Institutions
• FERPA Enforcement
• How Does FERPA Interact with Other Legal Requirements?
• Military Recruiters
• Title IX of the Education Amendments of 1972
• Considerations for Congress

Summary

Schools generate and maintain numerous student records, including grades, standardized test scores, disciplinary accounts, contact information, mental health records, and more. The Family Educational Rights and Privacy Act (FERPA), which applies to educational agencies and institutions that receive financial assistance from the Department of Education (ED), regulates the handling of education records in several ways. 20 U.S.C. § 1232g. The law sets forth two key requirements for covered entities. First, FERPA requires schools to allow parents to access and review their children's education records. Id. at § 1232g(a)(1). Second, it prohibits schools from releasing students' education records, including personally identifiable information, without the written consent of their parents, subject to several exceptions. Id. at § 1232g(b). FERPA defines "education records" as materials that (1) "contain information directly related to a student" and (2) "are maintained by an educational agency or institution or by a person acting for such agency or institution." Id. at § 1232g(a)(4)(A).

FERPA does not govern all materials that may contain information about a student. The statute exempts certain categories of information from its definition of "education records" altogether. Id. at § 1232g(a)(4)(B). For instance, FERPA's requirements do not apply to records independently generated by a school's law enforcement unit (LEU) for law enforcement purposes. Id. at § 1232g(a)(4)(B)(ii). The statute's prohibition against disclosing education records also has a carve-out for "directory information," as long as schools follow specific procedures when doing so. Id. at § 1232g(a)(5). Under ED regulations, schools may also disclose "de-identified" records without consent. 34 C.F.R. § 99.31(b). FERPA also has exceptions that permit disclosure of student records in different situations. For example, disclosure of education records absent consent can be permitted to appropriate "school officials," which can include online educational services, LEUs, and threat assessment teams; 20 U.S.C. § 1232g(b)(1)(A); and to appropriate parties in emergency situations if necessary to protect the health and safety of students. Id. at § 1232g(b)(1)(I). In addition, schools may disclose education records without consent for the purpose of certain studies, audits, and evaluations. Id. at § 1232g(b)(1)(F). Disclosure can also be permitted to a state law juvenile justice system in order for that system to serve the student effectively. Id. at § 1232g(b)(1)(E). In these situations and others, FERPA imposes requirements on the recipients of student records regarding use and redisclosure. Id. at § 1232g(b)(4)(B). FERPA does not create a private right of action to sue schools for non-compliance. Enforcement of the statute is primarily conducted by ED's Student Privacy Policy Office, which can review and investigate violations. Id. at § 1232g(g). When non-compliance is not resolved through the administrative process, ED can withhold federal funds or terminate eligibility to receive federal funds. Id at § 1232g(f).

In addition to complying with FERPA's requirements concerning disclosure of student records, schools that receive federal financial assistance must also abide by the requirements of Title IX of the Education Amendments of 1972. In May 2020, regulations were issued under Title IX that prescribe how schools must respond to allegations of sexual harassment at school. 34 C.F.R. Part 106. Those regulations require that during a grievance process in response to a formal complaint of harassment, schools must make certain information available to relevant parties. Although FERPA does not have an express "exception" for disclosures in Title IX sexual harassment proceedings, these requirements may nonetheless be reconcilable.

One developing area of dispute under FERPA concerns state and local policies regarding parental access to information about their children's gender identity at school. States and school districts have different rules regarding whether parents must be notified when students experience gender dysphoria and/or pursue gender transition. Some states have passed laws requiring schools to affirmatively disclose to parents when a minor requests a change in pronouns used to identify the student. See, e.g., Iowa Code § 279.78 (2026); Ind. Code § 20-33-7.5-2 (2026). A number of public schools in other states, by contrast, have implemented policies prohibiting disclosure of a student's gender identity to parents without the student's consent. In some cases, parents have sued school districts that have implemented these latter policies, arguing that denying parents access to critical information about their children violates their constitutional rights. In 2026, the Supreme Court issued a decision on this matter on its "emergency docket" that will likely inform how courts examine these questions going forward. In that case, the Court ruled that parents had adequately alleged violations of the Free Exercise and Due Process Clauses of the Constitution. Mirabelli v. Bonta, 146 S. Ct. 797, 802 (2026) (per curiam). On March 28, 2025, ED issued guidance indicating that school policies that prohibit disclosure of information about a student's gender identity to parents violate FERPA and has since initiated several investigations into states and school districts that allegedly have such policies.

---

Schools generate and maintain numerous records that concern their students, including contact information, disciplinary accounts, mental health records, grades, standardized test scores, and more. Concerns about protecting these materials from improper disclosure have increased with the rise of technology that is used to store and maintain school records.¹ The expansion of third-party software to enable school instruction at home has further increased concern about the security of students' information.² In addition, the recent adoption and spread of artificial intelligence tools in the education context may raise novel issues with respect to ensuring student privacy.³

The Family Educational Rights and Privacy Act (FERPA), which applies to educational agencies and institutions⁴ that receive financial assistance from the Department of Education (ED),⁵ regulates the handling of student records in several ways.⁶ FERPA has two key features. First, it requires schools to allow parents to access and review their children's education records.⁷ Second, it prohibits schools from releasing students' education records, including personally identifiable information (PII), without the written consent of their parents.⁸ As this report explains, however, this prohibition is not absolute. For instance, FERPA has numerous exceptions that allow for limited disclosure of otherwise protected education records to specific entities and for particular reasons, including to other school officials with legitimate education interests, or when disclosure is necessary to protect health and safety in case of an emergency.⁹ In addition, the statute has a general carve-out that authorizes disclosure of students' "directory information," subject to several procedural requirements.¹⁰

As discussed in more detail below, FERPA does not contain a private right of action authorizing individuals such as parents or students to initiate a lawsuit to enforce the law's requirements.¹¹ Instead, the statute is primarily enforced by ED, which can investigate allegations of a violation and ultimately terminate funding for non-compliance.¹² One implication of this framework is that courts do not routinely interpret FERPA's statutory and regulatory provisions in the context of lawsuits to directly enforce its provisions against schools. Courts more often have occasion to interpret the statute in other contexts, such as in the course of discovery disputes that involve access to school records;¹³ under the Individuals with Disabilities Education Act, which contains implementing regulations incorporating FERPA's definition of "education record;"¹⁴ and in the relatively limited situations in which the Department of Justice (DOJ) brings a lawsuit to enforce FERPA against a school.¹⁵

This report begins with a discussion of what counts as an education record under FERPA.¹⁶ It continues by examining parental rights to access information about their children at school. The report then turns to the circumstances in which FERPA permits the disclosure of student records without parental consent. Next, the report looks at how FERPA is enforced,¹⁷ as well as how it interacts with other legal requirements that apply to schools, such as regulations under Title IX of the Education Amendments of 1972 (Title IX), which set standards for adjudicating allegations of sexual harassment at school.¹⁸

Education Records and Covered Persons

FERPA's protections and requirements apply to student education records. The statute defines education records as materials that (1) "contain information directly related to a student" and (2) "are maintained by an educational agency or institution or by a person acting for such agency or institution."¹⁹ While this definition of education records is broad, it is not unlimited. Some "records" are exempt, such as employee records, records created by a school's law enforcement unit, and peer-graded papers that have not been entered into a gradebook.

Owasso Independent School District v. Falvo

The Supreme Court considered the scope of this definition in a 2002 decision, Owasso Independent School District v. Falvo.²⁰ There, the Court examined whether the process of peer grading in classrooms violated FERPA requirements.²¹ The plaintiffs argued that the practice of students grading one another's papers and calling out those grades to the teacher for recording violated FERPA by disclosing students' "education records" without parental consent.²² The Court disagreed, ruling that the grades of students' papers, at least before being entered into the teacher's gradebook, are not "education records" because they are not "maintained" within the meaning of the term's definition.²³ The term "maintain," the Court noted, suggested that education records subject to FERPA would be "kept in a filing cabinet in a records room at the school or on a permanent secure database."²⁴ When students grade one another's papers, the Court explained, they do not "maintain" records in the manner that the school registrar does.²⁵

What Materials Are Excluded from the Definition of "Education Records"?

FERPA expressly states that certain materials are not "education records," including employment records,²⁶ as well as records that are created by educational personnel, that are in the sole possession of the creator (e.g., notes taken by a teacher regarding a conversation with a student), and that are not accessible to anyone except a substitute.²⁷

One category of materials excluded from FERPA's definition of "education records" is materials created and maintained by a school's law enforcement unit (LEU) for law enforcement purposes.²⁸ Importantly, this category only applies to records that are (1) "created by a law enforcement unit," (2) "created for a law enforcement purpose," and (3) "maintained by the law enforcement unit."²⁹ The category does not include records maintained by a component of the school other than law enforcement. FERPA regulations clarify that the category does not include records, even if created and maintained by the LEU, that are used exclusively for non-law enforcement purposes, such as a disciplinary proceeding.³⁰ If a school's LEU independently generates an investigative report on a student for law enforcement purposes and maintains those records itself, however, FERPA does not prohibit the local LEU from disclosing that information.³¹ Because of this distinction, ED advises that local LEUs maintain law enforcement records separately from education records.³²

In addition to these exclusions, FERPA and its implementing regulations include a number of other categories of materials that do not qualify as "education records."³³ Table 1 lists materials exempted from the definition of "education records."

Whose Information Is Protected from Disclosure?

A related issue under FERPA concerns whose information is protected from disclosure. As an initial matter, the law shields student education records from disclosure without parental consent, but not those of school employees.³⁴ Who exactly counts as a student, however, is not always clear. For instance, medical residents at a teaching hospital might have a relationship to the institution that reflects aspects of both a student and an employee.³⁵ In guidance from 1995, ED indicated that medical residents do not count as students under FERPA.³⁶ ED explained that, because medical residents generally have earned their terminal degree, "[e]valuative records pertaining to their practical experience as doctors who have completed their education are not 'education records' under FERPA."³⁷ However, several courts have subsequently taken a broader view of the statute, interpreting "student" to include medical residents.³⁸

Parental Access to Education Records

Covered schools must allow parents certain access to their children's records at school. As explained below, the scope of this requirement has been the subject of dispute in recent years for some states and school districts with respect to education records that concern students' gender identity.

Access and Review

FERPA requires schools that receive financial assistance from ED to allow parents to access and review the education records of their children.³⁹ Under the statute, schools must establish procedures that facilitate this process, and those procedures must ensure that parents can access their children's records within forty-five days of a request.⁴⁰ Parents must also have the option to challenge the content of those records to ensure their accuracy, including through a hearing if requested.⁴¹ According to FERPA regulations, schools must annually give parents notice of their rights under the law.⁴²

Although the rights under FERPA transfer from parents to students when they turn eighteen or enter postsecondary education,⁴³ those students' right of access to records is limited in several ways. For instance, FERPA does not require colleges to make parents' financial records available to students.⁴⁴

Parental Access to Information About Students' Gender Identity at School

One developing area of dispute under FERPA concerns state and local policies regarding parental access to information about student gender identity at school. States and school districts have different rules regarding whether parents must be notified when students experience gender dysphoria and/or pursue gender transition. For instance, some states have passed laws requiring schools to affirmatively disclose to parents when a minor requests a change in pronouns used to identify the student.⁴⁵ By contrast, a number of public schools in other states have implemented policies prohibiting disclosure of a student's gender identity to parents without the student's consent.⁴⁶ Some parents have sued school districts that have implemented these latter policies, arguing that denying parents access to critical information about their children violates their constitutional rights.⁴⁷

A 2026 Supreme Court decision on the matter, issued pursuant to its "emergency docket," will likely inform how courts examine these questions going forward.⁴⁸ In Mirabelli v. Bonta, the Supreme Court partially reinstated a district court's injunction against California's policies that prohibit public schools from informing parents about their children's gender transition at school absent the child's consent.⁴⁹ In a per curiam decision, the Court concluded that the parents were likely to succeed on the merits of their constitutional claims under the Free Exercise and Due Process Clauses and that denial of their constitutional rights during the litigation process would cause irreparable harm.⁵⁰ As to the free exercise claim, the Court determined that the state policies likely triggered strict scrutiny—the most searching form of constitutional judicial review—because they substantially interfered with the right of parents to guide their children's religious development, and that the policies were unlikely to survive that standard of review.⁵¹ Further, the Court ruled that the parents were likely to succeed on their due process claim, as the state policies appeared to violate parents' constitutional right to control the raising and education of their children under Supreme Court precedent.⁵²

ED has also explained how FERPA applies to school policies that limit disclosure of a student's gender identity to parents. On March 28, 2025, ED issued a Dear Colleague Letter (DCL) to state and local educational agencies (SEAs and LEAs) informing them of their obligations under FERPA and identifying "priority concerns."⁵³ According to the DCL, many LEAs (with approval from, or under the direction of, SEAs) might have policies that conflict with FERPA's requirements regarding parental inspection and review of student records.⁵⁴ For example, the DCL observed, some schools create "gender plans" for students but claim those plans are not "education records" that parents may access under FERPA, as they are not part of an "official student record."⁵⁵ According to the DCL, FERPA allows for no such distinction.⁵⁶ With certain statutory exceptions, the DCL stated that all information related to a student and maintained by an educational institution is an education record which parents have a right to inspect and review.⁵⁷

On January 28, 2026, ED announced that, following an investigation, it had found the California Department of Education (CDE) out of compliance with FERPA "for policies that pressure school officials to conceal information about students' 'gender identity.'"⁵⁸ ED's announcement described CDE as maintaining "gender support plans" that were kept in separate filing systems in order to hide the records from parents.⁵⁹ According to ED, "CDE's guidance asserts these plans are not part of a student's cumulative record accessible to parents, which directly violates parents' rights under FERPA to inspect all education records related to their minor children."⁶⁰ The announcement indicated that ED had offered CDE the opportunity to voluntarily resolve the matter by taking certain actions. On February 11, 2026, CDE issued an update to schools in the state, explaining that student support plans with information on a student's gender identity are subject to parental access and review consistent with FERPA.⁶¹ It is unclear at this point whether the announcement resolves the issue for ED. The agency has also made a similar determination as to the policies of several school districts in Kansas regarding parental notification in cases of gender transition.⁶²

FERPA Carve-Outs: Directory Information and De-Identified Data

As mentioned above, FERPA prohibits ED funds from going to schools that have a policy permitting disclosure of students' education records, including PII, without written parental consent.⁶³ Although the prohibition on releasing "education records" broadly encompasses information directly related to a student and maintained by a school,⁶⁴ FERPA nonetheless provides an important carve-out from this prohibition: basic student data—directory information—may be released without affirmative consent as long as certain requirements are met.⁶⁵ Directory information includes material that "would not generally be considered harmful or an invasion of privacy if disclosed."⁶⁶ Schools must give prior public notice of the types of records designated as directory information and an opportunity for parents in writing to refuse to allow specific records to be so designated.⁶⁷

Under FERPA and its implementing regulations, directory information includes a student's identification number,⁶⁸ as well as a student's

name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors and awards received; and the most recent educational agency or institution attended.⁶⁹

The carve-out of directory information from FERPA's disclosure prohibition allows schools to include certain student information in various publications, such as playbills for theatre productions, programs at athletics competitions, student directories, yearbooks, graduation programs, and honor rolls.⁷⁰ Directory information also can be distributed to companies that provide class photos, yearbooks, and class rings.⁷¹

FERPA's regulations also provide that schools, as well as parties authorized to receive education records under a relevant exception (e.g., the exception for audits and evaluations),⁷² may disclose "de-identified" records absent consent.⁷³ For this exception to apply, the entity must remove all PII and make "a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information."⁷⁴

FERPA Exceptions

The statute also contains numerous exceptions that allow for disclosure of student education records in certain situations. While the carve-out for directory information allows for disclosure as a general matter (provided schools satisfy the notice requirement), FERPA exceptions are more specific in that they typically limit disclosure to specific entities for particular reasons. For many FERPA exceptions,⁷⁵ the regulations also impose requirements on recipients of student records regarding the use and re-disclosure of that information.⁷⁶ When schools disclose PII from an education record pursuant to an applicable exception, they must do so on the condition that the recipient will not re-disclose the information absent consent.⁷⁷ When recipients receive student information, they may only use the information for the purposes for which it was disclosed.⁷⁸ The regulations provide, however, that schools may disclose PII to a recipient with the understanding that the recipient may make further disclosures on behalf of the school if a relevant exception applies.⁷⁹ Schools must keep a record of which individuals or entities (other than a student's parents) requested or obtained access to a student's records, including the legitimate interest such entities had in the information.⁸⁰ Some of the most commonly utilized FERPA exceptions are discussed in detail below.⁸¹

School Officials Exception

Schools may disclose education records to appropriate "school officials" without parental consent.⁸² School officials include other teachers in the institution if the school has determined they have "legitimate educational interests."⁸³ According to FERPA regulations, outside parties, such as contractors, volunteers, or consultants to whom a school has "outsourced institutional services or functions," may also qualify as school officials if (1) the school determines they have a legitimate educational interest; (2) they conduct "an institutional service or function for which" the school would otherwise use employees; (3) they are "under the direct control" of the school regarding the maintenance and use of the records; and (4) they are subject to FERPA's use and re-disclosure requirements.⁸⁴

Finally, schools must "use reasonable methods" to ensure school officials only access those records in which they have legitimate educational interests.⁸⁵ According to guidance from ED, a school official has a legitimate educational interest "if he or she needs to review an education record in order to fulfill his or her professional responsibilities."⁸⁶

Online Educational Services

While not explicitly set forth in statute or regulations, ED guidance documents interpret the school official exception to permit disclosure of education records to third-party providers of online educational software.⁸⁷ Schools often use online tools to facilitate instruction provided by third parties. These tools can include programs that students or their parents access through the internet to participate in a school activity. The use of such tools has expanded with the increase in at-home learning due to the COVID-19 pandemic.⁸⁸

Schools may disclose education records to third-party providers under the school official exception as long as the requirements discussed above are met.⁸⁹ ED has noted that the "direct control" requirement above can be met through a contract signed by the school and online software provider; in some cases, the "Terms of Service" may satisfy this obligation as well.⁹⁰ As mentioned above, providers that receive education records under the school official exception may only use those records for the specific purpose for which they were disclosed.⁹¹ In other words, providers may only use those education records to perform the outsourced function assigned by the school. This requirement generally precludes providers from selling such information to another party or reusing it for another purpose.⁹²

Under FERPA's regulations, however, providers may disclose without consent records that are properly "de-identified," or stripped of all PII.⁹³ According to guidance from ED, this anonymizing includes metadata that the provider collects through its software.⁹⁴ For instance, providers might collect information about how long it takes students to perform a discrete task.⁹⁵ As long as such information is stripped of PII, providers may disclose that information without consent.⁹⁶

Law Enforcement Unit

If a school has outsourced the duties of providing safety and security to LEU officials, such as school resource officers, it may consider them to be "school officials" when certain requirements are met.⁹⁷ As noted above, records created and maintained by an LEU official for law enforcement purposes are not education records under FERPA.⁹⁸ This distinction means that if a school's LEU official independently generates records on a student for law enforcement purposes, it will not violate FERPA if it discloses that information without consent. However, a school may not disclose a student's education records to its LEU without consent unless one of FERPA's exceptions is met.⁹⁹

When schools outsource the function of providing safety and security on campus to LEU officials, they may sometimes disclose education records without consent to those LEU officials under the school official exception.¹⁰⁰ To do so, the LEU official must meet the four requirements laid out in FERPA's regulations governing when outside parties may serve as school officials.¹⁰¹ That means (1) the school must determine that the LEU officials have a legitimate educational interest in the records;¹⁰² and the LEU officials must (2) perform an institutional service or function for the school;¹⁰³ (3) maintain the records under the direct control of the school;¹⁰⁴ and (4) follow FERPA's use and re-disclosure requirements.¹⁰⁵

LEU officials to whom a school has outsourced the function of providing safety and security on campus can satisfy requirement (2) because ensuring school safety constitutes an "institutional service or function."¹⁰⁶ As mentioned above, a school can satisfy the "legitimate educational interest," requirement (1), if an LEU official needs to review the information to fulfill his job responsibilities.¹⁰⁷ For instance, a school might disclose to its LEU official the disciplinary record of a student who is barred from campus.¹⁰⁸

A school may enter a memorandum of understanding with its LEU official that establishes data protection and use requirements to satisfy requirement (3).¹⁰⁹ Application of requirement (4), FERPA's use and re-disclosure requirements, means that LEU officials may only use education records for the purpose for which the disclosure was made, such as ensuring school safety.¹¹⁰ In addition, LEU officials may not re-disclose covered education records to outside parties, such as a police department, unless one of FERPA's exceptions is satisfied.¹¹¹

Threat Assessment Teams

Schools may also use the school official exception to disclose education records to threat assessment teams. According to guidance documents issued by ED, a threat assessment team may "review incidents of threatening behavior by students (current and former), parents, school employees, or other individuals."¹¹² This group, "relying on their collective expertise," provides guidance to a school on how to respond to a potential threat.¹¹³ It appears that such teams can assist schools to determine whether student records should be disclosed under the health or safety emergency exception.¹¹⁴ The members of a threat assessment team can include individuals not employed by a school, such as medical and mental health professionals, as well as law enforcement officers.¹¹⁵

Members of threat assessment teams are subject to the limitations that apply to all school officials. Consequently, the members may only use education records for the purposes for which they were disclosed, and they may not re-disclose the records absent a FERPA exception.¹¹⁶ ED guidance documents specifically give an example: if a representative from a police department serves on a threat assessment team, he or she may not disclose PII from education records accessed as a member of the team to their police department (absent an applicable FERPA exception).¹¹⁷

Health and Safety Emergency Exception

FERPA also provides that student records may be released in emergency situations if necessary to protect the health and safety of students.¹¹⁸ The statute's regulations spell out in detail how this exception operates.¹¹⁹ Schools "may take into account the totality of the circumstances" in determining if an emergency exists.¹²⁰ If a school determines that there is an "articulable and significant threat" to the health or safety of a student or other person, it may disclose an education record to any person whose knowledge of that information is necessary to protect health and safety.¹²¹ As long as a school has a rational basis for this decision, ED will not "substitute its judgment" for that of the school.¹²²

According to ED, examples of a significant and articulable emergency include an impending natural disaster, terrorist attacks, campus threats, or the outbreak of an epidemic disease.¹²³ For instance, during the COVID-19 pandemic, ED issued guidance explaining that the health and safety emergency exception will sometimes authorize disclosure without consent of PII from education records to appropriate public health officials to protect public safety.¹²⁴ State and local law enforcement officials, public health officials, medical personnel, and parents might need to receive records to protect the health and safety of students and others.¹²⁵ Any time that a school discloses a student's PII from education records under the emergency exception, it must record the threat and the parties to whom records were disclosed.¹²⁶

According to guidance from ED, FERPA does not prohibit a school official from disclosing information obtained not through a record but from personal knowledge or observation.¹²⁷ For instance, if a teacher overhears a student make a threat, FERPA does not prohibit that information from being disclosed.¹²⁸ Consequently, the teacher could disclose what he or she overheard to appropriate authorities.¹²⁹

Subpoena Exceptions

FERPA contains multiple exceptions and related requirements for situations involving subpoenas. Schools may release education records to respond to judicial orders and "lawfully issued" subpoenas.¹³⁰ However, FERPA generally requires the school to notify students and their parents "of all such orders or subpoenas in advance of the compliance."¹³¹ ED has explained that this notice requirement provides an opportunity for parties to move to quash or narrow the scope of a subpoena before a school complies.¹³² Many federal district courts have applied an interpretation of this exception that places "a significantly heavier burden on a party seeking access to student records to justify disclosure," requiring that party "to demonstrate a genuine need for the information that outweighs the privacy interest of the students."¹³³

A separate provision states that education records can be disclosed to "the entity or persons designated in a Federal grand jury subpoena" or in response to "any other subpoena issued for a law enforcement purpose."¹³⁴ FERPA appears to contemplate that both courts and other agencies may issue subpoenas for law enforcement purposes.¹³⁵ The statute also contains provisions related to the disclosure of subpoenas for grand jury or law enforcement purposes when used to obtain education records. In the case of grand jury subpoenas, a court must, for good cause shown, order the entity that is served not to disclose (1) that the subpoena exists or (2) any of the records turned over in response.¹³⁶ Courts issuing subpoenas for law enforcement purposes may order these same restrictions on disclosure, but FERPA does not require them to do so.¹³⁷

Studies and Audits Exceptions

FERPA also allows disclosing education records for the purpose of certain studies,¹³⁸ as well as for audits and evaluations.¹³⁹ The studies exception allows schools to disclose records to organizations conducting studies in order to (1) develop, administer, or validate predictive tests; (2) administer student aid programs; or (3) improve instruction.¹⁴⁰ For instance, a school might disclose education records to an organization that compares student outcomes across different school districts.¹⁴¹ Disclosures under the studies exception are permitted only if the study does not authorize the personal identification of students or parents other than to members of the organization with legitimate interests in the information.¹⁴² In addition, when no longer needed for the study, the information must be destroyed.¹⁴³ Finally, to disclose education records to an organization under the studies exception, schools must enter into written agreements with the organization that specify the scope of the study and limit the use of PII in various ways.¹⁴⁴

The audit and evaluation exception permits schools to release education records without consent to authorized representatives of state and local educational authorities.¹⁴⁵ Information under the exception must be used to audit or evaluate a federal or state-supported education program or to enforce or ensure compliance with federal legal requirements connected to those programs.¹⁴⁶ As with the studies exception, schools must enter into written agreements with recipients of the information that specify how the information will be used and when it will be destroyed.¹⁴⁷ Further, written agreements must establish policies and procedures that protect information from further disclosure.¹⁴⁸

State Law Juvenile Justice System Exception

FERPA also authorizes disclosing education records to a state or local juvenile justice system without consent in certain situations.¹⁴⁹ If a state has adopted a statute after November 19, 1974, that specifically allows disclosure of student education records to state and local officials, then disclosure without consent is allowed if the disclosure concerns the juvenile justice system's "ability to effectively serve, prior to adjudication, the student whose records are released."¹⁵⁰ Officials to whom this information is disclosed must certify in writing that they will not re-disclose the information except as provided under state law or with consent.¹⁵¹ Guidance from the DOJ, in coordination with ED, indicates that disclosure under this exception is limited to a local or state juvenile justice system agency.¹⁵² For instance, in situations where the above conditions are met, if a student is arrested for a crime for the first time, a police department's juvenile division can receive education records from a school about the student in order to serve the student effectively prior to adjudication.¹⁵³

The juvenile justice system exception appears to authorize some disclosures of education records by a school district to a local juvenile justice agency, although the outer bounds of when a disclosure concerns the juvenile justice system's ability to serve a student effectively are uncertain. Because the statute imposes this requirement for "the student whose records are released," disclosure under this exception may require a specific finding of need for a particular student. This reading of the statute seems consistent with ED and DOJ guidance describing how the exception operates.¹⁵⁴

Victims of Crimes at Postsecondary Institutions

Postsecondary institutions may disclose certain disciplinary records of an alleged perpetrator of a crime of violence or a nonforcible sex offense.¹⁵⁵ First, institutions may disclose to the alleged victim of such a crime the final results of disciplinary proceedings that are conducted against the alleged perpetrator of the crime.¹⁵⁶ Second, if an institution determines through a disciplinary proceeding that a student violated its rules or policies with respect to a crime of violence or nonforcible sex offense, then it may disclose the final results of that proceeding to anyone.¹⁵⁷ The final results are limited to the name of the student, the violation committed, and any sanction the institution imposes.¹⁵⁸ The names of other students, however, such as other victims or witnesses, may only be disclosed with their consent.¹⁵⁹

Importantly, while FERPA authorizes postsecondary institutions to disclose the results of disciplinary proceedings to the alleged victim of a crime of violence or a nonforcible sex offense, a statutory provision outside of FERPA, contained in the Higher Education Act (HEA), requires institutions of higher education to do so in certain circumstances.¹⁶⁰ As a condition of receiving funds under Title IV of the HEA, institutions of higher education must enter a Program Participation Agreement that requires them to, upon written request, disclose to the alleged victim of a crime of violence or a nonforcible sex offense the report on the results of a disciplinary proceeding against the student who is the alleged perpetrator of that offense.¹⁶¹

FERPA Enforcement

As explained above, FERPA prohibits federal funding of schools that have a policy of denying parents the right to review the education records of their children, as well as schools that have a policy or practice of disclosing student education records to unauthorized entities.¹⁶² The enforcement of FERPA's provisions is statutorily entrusted to the Secretary of Education, who is responsible for designating an office and review board for investigating and reviewing complaints of violations.¹⁶³ The Student Privacy Policy Office in ED reviews and investigates complaints and violations of FERPA.¹⁶⁴ Following an investigation, it will provide any complainant, as well as the school, written notice of its findings.¹⁶⁵ In cases where ED finds that a school has not complied with FERPA and that failure was based on a school's policy or practice, the notice to the school will include the specific steps needed to comply with FERPA and provide a reasonable time to comply.¹⁶⁶ If the school does not comply within the time given, the Secretary can enforce FERPA in a variety of ways, including by withholding further payments under any educational program, issuing a complaint to compel compliance through a cease and desist order, or terminating eligibility to receive funding under any educational program.¹⁶⁷ Another option is for DOJ to bring a lawsuit on behalf of the United States against a noncompliant school.¹⁶⁸ As mentioned above, ED has investigated several states and school districts for policies that allegedly prohibit disclosing to parents information about their children's' gender identity.¹⁶⁹

Aside from the possibility of a lawsuit brought by DOJ, the administrative scheme implemented by ED is the primary enforcement mechanism for FERPA. Whereas some other federal requirements for schools, such as Title IX of the Education Amendments of 1972,¹⁷⁰ are enforceable through a private right of action brought in federal court directly against a school for violations, FERPA does not create such a private right of action for students or parents. Courts have recognized that the statute itself does not explicitly establish a private right of action to sue for violations,¹⁷¹ and in the 2002 case of Gonzaga University v. Doe, the Supreme Court ruled that FERPA also does not create any personal rights enforceable under 42 U.S.C. § 1983 (which provides a remedy for violations of federally conferred rights against state officials).¹⁷² According to the Court, because Congress did not clearly and unambiguously establish an enforceable right in the statute, FERPA could not be enforced via a lawsuit under § 1983.¹⁷³

How Does FERPA Interact with Other Legal Requirements?

Military Recruiters

While FERPA generally prohibits schools from disclosing student education records without consent unless an exception applies, other statutes require schools to disclose certain student information to military recruiters. The Elementary and Secondary Education Act (ESEA) imposes certain requirements on local educational agencies that receive federal funds under its provisions.¹⁷⁴ Those schools must disclose the name, address, and telephone listing of secondary school students upon request to a military recruiter.¹⁷⁵ Parents may opt out of this disclosure for their children, and schools must notify parents of this option.¹⁷⁶ Another statute generally directed at the Department of Defense imposes similar requirements¹⁷⁷ but defines covered schools somewhat differently.¹⁷⁸

In the context of postsecondary education, a different statute requires institutions of higher education (IHEs) that receive certain federal funds to allow military recruiters to access student information "for purposes of military recruiting."¹⁷⁹ Specifically, IHEs must provide access to the following information for enrolled students who are aged seventeen or older: name, address, e-mail, phone number, date and place of birth, level of education, academic majors, degrees received, and school of most recent enrollment.¹⁸⁰

Title IX of the Education Amendments of 1972

In addition to complying with FERPA's requirements concerning disclosure of student records, schools that receive federal financial assistance must also abide by the requirements of Title IX of the Education Amendments of 1972.¹⁸¹ That statute generally prohibits schools from discriminating on the basis of sex.¹⁸² In May 2020, ED issued regulations under Title IX that prescribe how schools must respond to allegations of sexual harassment at school.¹⁸³ Those regulations require that, during a grievance process in response to a formal complaint of harassment, schools must provide both parties the opportunity to review any evidence obtained through an investigation related to the allegations.¹⁸⁴ They also require schools to allow parties to have an advisor present during any proceeding of the grievance process.¹⁸⁵ Schools must create an investigative report that is sent to each party and their advisor,¹⁸⁶ and issue written determinations of responsibility that include various findings that are disclosed to the parties.¹⁸⁷ ED issued updated regulations in 2024,¹⁸⁸ but they were vacated by a federal district court.¹⁸⁹ ED is currently enforcing the 2020 regulations.¹⁹⁰

Schools that receive federal financial assistance generally must comply both with FERPA and these Title IX requirements. Although FERPA does not have an express "exception" for disclosures in Title IX sexual harassment proceedings, these requirements may nonetheless be reconcilable. According to ED, the requirements of FERPA and the Title IX regulations do not contradict each other.¹⁹¹ In cases where a direct conflict arises, ED asserts that Title IX's requirements override FERPA.¹⁹² For support, ED points to the larger General Education Provisions Act (GEPA)—of which FERPA is a part—which provides that nothing in its provisions "shall be construed to affect the applicability of" Title IX.¹⁹³ In addition, Title IX regulations themselves provide that a recipient's obligation to comply with Title IX's requirements "is not obviated or alleviated by the FERPA."¹⁹⁴

Further, ED asserts that these Title IX regulations help protect a party's right to procedural due process under the Constitution.¹⁹⁵ In certain student disciplinary cases involving public schools, the Constitution requires that parties be given adequate notice of the charges against them and a meaningful opportunity to respond.¹⁹⁶ ED is precluded from enforcing Title IX or FERPA in a manner that deprives students of their constitutional rights.¹⁹⁷ According to this line of reasoning, FERPA cannot prohibit a school from disclosing to an accused student the evidence collected against him or her in a disciplinary proceeding because that would violate due process.¹⁹⁸

In addition, ED points to the FERPA requirement that parents (or eligible students) have access to their own education records.¹⁹⁹ FERPA's definition of education records includes records that "contain information directly related to a student."²⁰⁰ ED notes that the evidence and investigative report disclosed pursuant to Title IX regulations directly relates to the allegations in a complaint, and therefore "directly relate" to the students at issue.²⁰¹

Moreover, as a practical matter, even if compliance with certain Title IX requirements might appear to conflict with FERPA's provisions in a particular situation, schools that comply with Title IX regulations by disclosing evidence to parties in a disciplinary proceeding are unlikely to face legal repercussions, at least absent a shift in ED's policy approach. As noted above, FERPA does not create a private right of action, meaning that ED conducts most enforcement of the statute.²⁰² But here, ED has explicitly acknowledged that, as it administers both FERPA and Title IX, it will "not interpret compliance with its regulations under Title IX to violate requirements in its regulations under FERPA."²⁰³

Considerations for Congress

Although FERPA's prohibition on disclosing student records without consent is framed broadly, the various exceptions to that mandate have provided schools flexibility to respond to situations in which certain information merits release. Congress's original purpose in enacting FERPA included two broad aims: to assure parents of access to education records and to protect privacy by limiting the transferability of those records absent consent.²⁰⁴ The latter goal responded to the widespread "abuse of student records across" the country.²⁰⁵ At the time, Congress was concerned about "clear evidence of frequent, even systematic violations" of student privacy through the unauthorized collection of personal information and inappropriate disclosure of that information to different individuals and organizations.²⁰⁶ Congress aimed to balance the concern for student privacy with considerations for those with legitimate interests in accessing education records. When drafting FERPA in 1974, Congress noted its intent to "assure that requests for information associated with evaluations of Federal education programs do not invade the privacy of students."²⁰⁷ That original exception, allowing the disclosure of de-identified education records for the evaluation of federal education programs, sought to balance "[t]he need to protect students' . . . against legitimate Federal needs for information."²⁰⁸

Over time, Congress has added additional exceptions to FERPA's general prohibition. As discussed above, schools may now disclose materials to ensure school safety, to participate in certain studies aimed at improving education outcomes, and to adapt to changes in how education is generally offered, including through developments in technology.

Some have expressed larger concerns with the handling of student records.²⁰⁹ As explained above, a number of schools have implemented policies that prohibit the disclosure of a student's gender identity to parents without the student's consent.²¹⁰ In a case challenging these policies in California, the Supreme Court reinstated a district court's injunction against California, determining that the state's policies likely violated the rights of parents under the Constitution's Free Exercise and Due Process Clauses and that denying their constitutional rights during the litigation process would cause irreparable harm.²¹¹ ED has also issued guidance indicating that such school policies violate FERPA's requirements.²¹² In addition, the maintenance and use of student records by third parties authorized to receive them for a particular purpose has generated controversy.²¹³

Similarly, reports of immigration enforcement at schools has raised concerns about student privacy.²¹⁴ For instance, one issue that can arise is whether FERPA allows schools to release information about a student in response to a request from Immigration and Customs Enforcement (ICE), such as in response to a lawfully issued subpoena.²¹⁵ In a letter from 1998, ED observed that it had "consistently" taken the position that school districts are in the best position to determine if a subpoena has been issued "lawfully," as the standards for subpoenas can vary by state.²¹⁶ States have issued varying guidance to their school districts concerning whether and how to respond to requests for information from immigration authorities consistent with FERPA's provisions.²¹⁷ There may be less question as to the lawfulness of immigration administrative subpoenas, which are authorized by federal law rather than state law; if an immigration administrative subpoena is issued consistent with federal statutory parameters, it might qualify as a lawfully issued subpoena under FERPA.²¹⁸ However, administrative subpoenas are not self-executing,²¹⁹ and some schools may take the position that a court order is necessary to ensure that a subpoena is "lawfully issued."²²⁰ If lawmakers seek to address these issues, they could consider amending FERPA to define schools' and parties' obligations more specifically (subject to the constitutional limitations identified by the Supreme Court).

Further, because the statute lacks a private right of action for students or parents to bring suit in response to FERPA violations, Congress could consider, and some bills have proposed, adding such a right to the statute. For instance, a bill introduced in the 119th Congress would create a private right of action and authorize courts to issue declaratory relief, injunctions, and award attorney's fees where violations are found.²²¹ At the same time, Congress's ability to authorize private enforcement of FERPA may be limited in part by the Constitution's Article III standing requirements, including the requirement that a plaintiff suffer a concrete injury-in-fact.²²² The Supreme Court has ruled that Article III "requires a concrete injury even in the context of a statutory violation,"²²³ and that "courts should assess whether the alleged injury to the plaintiff has a 'close relationship' to a harm 'traditionally' recognized" by American courts.²²⁴ Certain tangible injuries, such as physical or monetary harm, easily qualify as concrete,²²⁵ but intangible harms may require a more searching inquiry as to whether the harm is sufficiently similar to traditionally recognized harms like intrusion upon seclusion, forced disclosure of private information, reputational harms, or harms specified by the Constitution.²²⁶

Footnotes

1.	See, e.g., Betsy Morris, Schools Wrestle With Privacy of Digital Data Collected on Students, Wall St. J. (July 10, 2019, at 8:33 ET), https://www.wsj.com/articles/one-parent-is-on-a-mission-to-protect-children-from-digital-mistakes-11562762000.
2.	See, e.g., Shawn Hubler, Keeping Online Testing Honest? Or an Orwellian Overreach? N.Y. Times (May 10, 2020), https://www.nytimes.com/2020/05/10/us/online-testing-cheating-universities-coronavirus.html; Anushka Patil & Jonah Engel Bromwich, How It Feels When Software Watches You Take Tests, N.Y. Times (Sep. 29, 2020), https://www.nytimes.com/2020/09/29/style/testing-schools-proctorio.html.
3.	See, e.g., John Higginson, Artificial Intelligence and Student Privacy: Building Trust Through Responsible Design, The AI Journal (Jan. 20, 2026), https://aijourn.com/artificial-intelligence-and-student-privacy-building-trust-throughresponsible-design/ [https://perma.cc/MFP6-EQV5]; Brian Horowitz, How to Secure AI Tools Within Your K-12 Digital Environment, EdTech: Focus on K-12, EdTech Magazine (May 30, 2025), https://edtechmagazine.com/k12/article/2025/05/how-secure-ai-tools-in-k12-environment-perfcon [https://perma.cc/2C9U-LZZ6]; Student and Educator Data Privacy, Nat'l Educ. Ass'n (June 20, 2025), https://www.nea.org/professional-excellence/student-engagement/tools-tips/student-and-educator-data-privacy [https://perma.cc/4FCT-D8LM].
4.	Educational agencies and institutions include local educational agencies (LEAs), elementary and secondary schools, and postsecondary educational institutions. See ED, Priv.Tech. Assistance Ctr., School Resource Officers, School Law Enforcement Units, and the Family Educational Rights and Privacy Act (FERPA) 6 (2019) [hereinafter Law Enforcement Units], https://studentprivacy.ed.gov/sites/default/files/resource_document/file/SRO_FAQs.pdf [https://perma.cc/8J6V-TBXM]. For ease of reference, this report refers to the recipient educational agencies and institutions subject to FERPA simply as "schools."
5.	FERPA applies when schools receive funds "made available under any applicable program." 20 U.S.C. § 1232g(a)(1)(A). "Applicable program" is defined as "any program for which the Secretary or the Department has administrative responsibility as provided by law or by delegation of authority pursuant to law." 20 U.S.C. § 1221(c)(1); 34 C.F.R. § 99.60(c) (2026). ED administers a number of programs that distribute financial assistance to schools and students, including the Elementary and Secondary Education Act, which authorizes aid for elementary and secondary schools (often through state and local educational agencies). See Elementary and Secondary Education Act of 1965, Pub. L. No. 89-10, 79 Stat. 27 (codified as amended at 20 U.S.C. §§ 6401–6577). ED also provides financial assistance to colleges and universities, including through grants and loans extended to students, as well as direct financial assistance to certain institutions of higher education, under the Higher Education Act. See Higher Education Act of 1965, Pub. L. No. 89-329, 79 Stat. 1219 (codified as amended at 20 U.S.C. §§ 1001–1161aa-1). For more on the Elementary and Secondary Education Act, see CRS Report R45977, The Elementary and Secondary Education Act (ESEA), as Amended by the Every Student Succeeds Act (ESSA): A Primer, by Rebecca R. Skinner (2024). For more on the Higher Education Act, see CRS Report R43351, The Higher Education Act (HEA): A Primer, by Kyle D. Shohfi and Rita R. Zota (2023).
6.	20 U.S.C. § 1232g. The Protection of Pupil Rights Amendment also has implications for student privacy. Id. § 1232h. Among other things, the law prohibits certain surveys of students absent consent, grants parents of students the right to inspect potential surveys, and requires schools to allow parents to opt out of certain activities, including physical examinations. Id. § 1232h(b), (c)(1)(A), (c)(2).
7.	Id. § 1232g(a)(1)(A). When a student reaches the age of eighteen or attends a postsecondary institution, the rights of the parent transfer to the student. Id. § 1232g(d); 34 C.F.R. §§ 99.3, 99.5.
8.	20 U.S.C. § 1232g(b)(1). FERPA rights transfer to students once they reach the age of eighteen or attend a postsecondary institution. Id. § 1232g(d); 34 C.F.R. §§ 99.3, 99.5.
9.	20 U.S.C. § 1232g(b)(1)(A)–(K).
10.	20 U.S.C. § 1232g(b)(1).
11.	See infra "FERPA Enforcement."
12.	20 U.S.C. § 1262g(f), (g).
13.	See, e.g., Shophar v. Pathway Fam. Servs., LLC, No. 22-CV-2333, 2026 WL 84377, at *3 (N.D. Ill. Jan. 12, 2026) ("Second, the Court finds the subpoena should be quashed considering the Family Educational Rights and Privacy Act."); Daywalker v. Univ. of Tex. Med. Branch at Galveston, No. 3:20-CV-00099, 2021 WL 4099827, at *3 (S.D. Tex. Sep. 9, 2021) ("Importantly, 'a party seeking disclosure of education records protected by FERPA bears a significantly heavier burden to justify disclosure than exists with respect to discovery of other kinds of information, such as business records.'" (quoting Ragusa v. Malverne Union Free Sch. Dist., 549 F. Supp. 2d 288, 292 (E.D.N.Y. 2008))), aff'd sub nom. Daywalker v. UTMB at Galveston, No. 22-40813, 2024 WL 94297 (5th Cir. Jan. 19, 2024).
14.	34 C.F.R. § 300.611(b); Burnett v. San Mateo Foster City Sch. Dist., 739 F. App'x 870, 873 (9th Cir. 2018) ("An 'education record' under IDEA is defined by the regulations implementing the Family Educational Rights and Privacy Act ('FERPA').").
15.	See United States v. Miami Univ., 294 F.3d 797, 812 (6th Cir. 2002).
16.	Because FERPA penalizes schools that have a policy or practice of violating its provisions, 20 U.S.C. § 1232g(b)(1), some disagreement exists with regard to how the statute should interact with state open records laws. Mathilda McGee-Tubb, Deciphering the Supremacy of Federal Funding Conditions: Why State Open Records Laws Must Yield to FERPA, 53 B.C. L. Rev. 1045, 1049 (2012); see Miami Univ., 294 F.3d at 812 (affirming a district court decision that granted an injunction brought by the United States against a university from releasing records in violation of FERPA). This report only examines the ways in which FERPA directly regulates the disclosure of student records. It does not consider the degree to which FERPA may also have a preemptive effect on inconsistent state or local measures. See generally Caledonian-Record Pub. Co. v. Vt. State Coll., 833 A.2d 1273, 1275–76 (Vt. 2003) (collecting cases reaching different conclusions on FERPA's preemptive effect and observing that "state and federal courts are sharply divided on this issue. Some have questioned whether the federal law, merely by withholding funds from educational institutions that release education records to anyone other than certain enumerated persons, affirmatively prohibits disclosure of student records.").
17.	See infra "FERPA Enforcement."
18.	See infra "How Does FERPA Interact with Other Legal Requirements?"
19.	20 U.S.C. § 1232g(a)(4)(A).
20.	Owasso Indep. Sch. Dist. No. I-011 v. Falvo, 534 U.S. 426, 428 (2002).
21.	Id. at 428. As explained infra, the Court explicitly did not resolve whether FERPA contains a private right of action to bring suit to enforce its provisions in federal court. Id. at 430–31. The Court later held that FERPA did not create a private right of action. Gonzaga Univ. v. Doe, 536 U.S. 273, 276 (2002).
22.	Owasso Indep. Sch. Dist., 534 U.S. at 432.
23.	Id. at 432–33. The Court declined to decide whether FERPA protects grades once they are given to a teacher. See id. at 436 ("For these reasons, even assuming a teacher's grade book is an education record, the Court of Appeals erred, for in all events the grades on students' papers would not be covered under FERPA at least until the teacher has collected them and recorded them in his or her grade book. We limit our holding to this narrow point, and do not decide the broader question whether the grades on individual student assignments, once they are turned in to teachers, are protected by the Act."). It appears that ED and a few lower courts have concluded that FERPA protects grades entered into a gradebook. See What is an Education Record?, ED: Protecting Student Priv., https://studentprivacy.ed.gov/faq/what-education-record [https://perma.cc/5R84-U2FU] (last visited May 8, 2026) ("These records include but are not limited to grades, transcripts, class lists, student course schedules, health records (at the K-12 level), student financial information (at the postsecondary level), and student discipline files."); Greenfield v. Newman Univ., Inc., No. 218CV02655DDCTJJ, 2020 WL 2766172, at *2 (D. Kan. May 28, 2020) ("FERPA is intended to protect records" such as "transcripts, test scores, grade information or information related to student academic performance."); Ragusa v. Malverne Union Free Sch. Dist., 549 F. Supp. 2d 288, 293 (E.D.N.Y. 2008) ("[D]ocuments relating to students' grades, evaluations, and academic performance are undoubtedly 'education records' within the meaning of FERPA.").
24.	Owasso Indep. Sch. Dist., 534 U.S. at 432–33.
25.	Id.
26.	20 U.S.C. § 1232g(a)(4)(B)(iii); 34 C.F.R. § 99.3. Klein Indep. Sch. Dist. v. Mattox, 830 F.2d 576, 579 (5th Cir. 1987) ("It cannot be disputed that the statute was enacted to prevent an educational agency or institution from releasing the record of one of its own students. Excluded from FERPA's protections are records relating to an individual who is employed by an educational agency or institution.").
27.	20 U.S.C. § 1232g(a)(4)(B)(i). See What Records Are Exempted From FERPA?, ED: Protecting Student Priv., https://studentprivacy.ed.gov/faq/what-records-are-exempted-ferpa [https://perma.cc/EUM5-VGD6] (last visited May 8, 2026). In addition, medical treatment records for students eighteen years of age or older or in college are not considered education records. To meet this definition, treatment records must be made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student's choice. 20 U.S.C. § 1232g(a)(4)(B)(iv) (emphasis added).
28.	20 U.S.C. § 1232g(a)(4)(B)(ii); 34 C.F.R. § 99.8 (a)(1).
29.	34 C.F.R. § 99.8 (b)(1); see Bauer v. Kincaid, 759 F. Supp. 575, 590 (W.D. Mo. 1991).
30.	34 C.F.R. § 99.8 (b)(2).
31.	Law Enforcement Units, supra note 4, at 15.
32.	Id.
33.	FERPA regulations contain two exceptions that are not explicitly mentioned in the statute. The first is for records of a former student not directly related to the individual's attendance as a student. 34 C.F.R. § 99.3. ED states that this provision simply clarifies that such materials do not qualify as "education records" under FERPA. Family Educational Rights and Privacy, 73 Fed. Reg. 74806, 74811 (Dec. 9, 2008). The second is for student grades from peer-graded papers before recording by the teacher. 34 C.F.R. § 99.3. This regulatory exception reflects the Supreme Court's decision in Owasso Indep. Sch. Dist. No. I-011 v. Falvo, 534 U.S. 426, 428 (2002); see also Family Educational Rights and Privacy, 73 Fed. Reg. at 74811 (explaining changes to FERPA regulations).
34.	20 U.S.C. § 1232g(a)(4)(B)(iii)); 34 C.F.R. § 99.3. Klein Indep. Sch. Dist. v. Mattox, 830 F.2d 576, 579 (5th Cir. 1987) ("It cannot be disputed that the statute was enacted to prevent an educational agency or institution from releasing the record of one of its own students. Excluded from FERPA's protections are records relating to an individual who is employed by an educational agency or institution.").
35.	See Doe v. Mercy Cath. Med. Ctr., 850 F.3d 545, 558–60 (3d Cir. 2017).
36.	Letter from Leroy Rooker, Dir., Fam. Pol'y Compliance Off., to Judith Richter, Off. of the Gen. Counsel, Univ. of Md. Med. Sys. (June 22, 1995), https://studentprivacy.ed.gov/sites/default/files/resource_document/file/Richter%20Medical%20Interns%20and%20Residents%2006_22_1995_508.pdf [https://perma.cc/6QBZ-CWQ4].
37.	Id. at 1.
38.	See Daywalker v. UTMB at Galveston, No. 22-40813, 2024 WL 94297, at *4 (5th Cir. Jan. 19, 2024) ("We disagree and hold that the magistrate judge did not err in applying FERPA to UTMB's medical residents."); Craig v. Yale Univ. Sch. of Med., No. 3:10 CV 1600 JBA, 2012 WL 1579484, at *2 (D. Conn. May 4, 2012); MacKenzie v. Ochsner Clinic Found., No. CIV.A. 02-3217, 2003 WL 21999339, at *4 (E.D. La. Aug. 20, 2003).
39.	20 U.S.C. § 1232g(a)(1)(A). FERPA applies to schools that receive federal financial assistance under an applicable program of ED.
40.	Id. § 1232g(a)(1)(A).
41.	Id. § 1232g(a)(2); 34 C.F.R. §§ 99.20–99.21
42.	34 C.F.R. § 99.7(a). If a school has a policy of disclosing records under the school official exception, the notice must also include the criteria used to determine who qualifies as a school official and "what constitutes a legitimate educational interest." Id. § 99.7(a)(3)(iii).
43.	20 U.S.C. § 1232g(d); 34 C.F.R. §§ 99.3, 99.5.
44.	20 U.S.C. § 1232g(a)(1)(C). The statute provides that the right of access does not extend to letters of recommendation in some situations. The statute has different provisions for letters of recommendation from before January 1, 1975, and after. Compare id. § 1232g(a)(1)(C)(ii) (letters of recommendation written before January 1, 1975, are not subject to student right of access if not used for their original purpose), with id. § 1232g(a)(1)(C)(iii) (student right of access does not apply to certain confidential recommendations if a student has signed a waiver pursuant to 20 U.S.C. § 1232g(a)(1)(D)).
45.	See, e.g., Iowa Code § 279.78 (2026); Ind. Code § 20-33-7.5-2 (2026).
46.	Lee v. Poudre Sch. Dist. R-1, 146 S. Ct. 26 (2025) (mem.) (statement of Alito, J., joined by Thomas, J., and Gorsuch, J., respecting the denial of certiorari) ("Petitioners tell us that nearly 6,000 public schools have policies—as respondent allegedly does—that purposefully interfere with parents' access to critical information about their children's gender-identity choices and school personnel's involvement in and influence on those choices.").
47.	Mirabelli v. Bonta, 146 S. Ct. 797, 806 (2026) (per curiam) (Kagan, J., dissenting).
48.	CRS Legal Sidebar LSB11391, The "Interim Docket" or "Shadow Docket": Non-Merits Matters at the Supreme Court, by Joanna R. Lampe (2026).
49.	Order Granting Plaintiffs' Motion for a Class-Wide Permanent Injunction, Mirabelli v. Olsen, No. 3:23-CV-00768, 2025 WL 3712993 (S.D. Cal. Dec. 22, 2025).
50.	Mirabelli, 146 S. Ct. at 802.
51.	Id. at 802–03.
52.	Id. at 803 (citing Pierce v. Society of Sisters, 268 U.S. 510 (1925), and Meyer v. Nebraska, 262 U.S. 390 (1923)).
53.	DCL from Linda E. McMahon, Sec'y of Educ., Enforcement of the Family Educational Rights and Privacy Act (FERPA) and Protection of Pupil Rights Amendment (PPRA), attach., U.S. Dep't of Educ. (Mar. 28, 2025) [hereinafter ED DCL], https://studentprivacy.ed.gov/sites/default/files/resource_document/file/Secretary_Comb_SPPO_DCL_Annual%20Notice_0.pdf [https://perma.cc/87CH-B3HX].
54.	Id.
55.	Id.
56.	Id.
57.	20 U.S.C. § 1232g(a)(4)(B).
58.	Press Release, ED, U.S. Department of Education Finds California Department of Education Violated Federal Law by Hiding Students' "Gender Transitions" from Parents (Jan. 28, 2026) [hereinafter ED-California Findings Press Release], https://www.ed.gov/about/news/press-release/us-department-of-education-finds-california-department-of-education-violated-federal-law-hiding-students-gender-transitions-parents [https://perma.cc/2PSW-N4Q3]; Press Release, ED, U.S. Department of Education Launches Investigation into California Department of Education for Alleged FERPA Violations (Mar. 27, 2025), https://www.ed.gov/about/news/press-release/us-department-of-education-launches-investigation-california-department-of-education-alleged-ferpa-violations [https://perma.cc/8W6A-L7Y2].
59.	ED-California Findings Press Release, supra note 58.
60.	Id.
61.	Letter from David Schapira, Chief Deputy Superintendent, Chief of Staff, and Ingrid Roberson, Chief Deputy Superintendent, CDE, to Cnty. & Dist. Superintendents & Charter Sch. Adm'rs (Feb. 11, 2026), https://www.cde.ca.gov/nr/fa/yr26cosoltr0211.asp [https://perma.cc/GSR7-Q6LQ].
62.	Press Release, ED, U.S. Department of Education Finds Four Kansas School Districts Violated Federal Law (Apr. 17, 2026), https://www.ed.gov/about/news/press-release/us-department-of-education-finds-four-kansas-school-districts-violated-federal-law [https://perma.cc/LV5E-9MY4].
63.	20 U.S.C. § 1232g(b). FERPA prohibits disclosing "education records" absent consent or a relevant exception. Id. § 1232g(b)(1). But the regulations implementing FERPA permit disclosing records without consent if all PII is removed "provided that the educational agency or institution or other party has made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information." 34 C.F.R. § 99.31(b)(1).
64.	20 U.S.C. § 1232g(a)(4)(A).
65.	Id. § 1232g(b)(1), (a)(5)(A).
66.	34 C.F.R. § 99.3.
67.	20 U.S.C. § 1232g(a)(5)(a); 34 C.F.R. § 99.37(a)(1)–(3).
68.	A student's identification number counts as directory information as long as "the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user's identity, such as a personal identification number (PIN), password or other factor known or possessed only by the authorized user." 34 C.F.R. § 99.3.
69.	Id. § 99.3; 20 U.S.C. § 1232g(a)(5)(A).
70.	The A-B-C's of Student Directory Information, ED: Protecting Student Priv. (Aug. 3, 2016), https://studentprivacy.ed.gov/training/b-cs-student-directory-information [https://perma.cc/VA6J-EEK8].
71.	Id.
72.	20 U.S.C. § 1232g(b)(1)(C), (b)(3), (b)(5); 34 C.F.R. §§ 99.31(a)(3), 99.35.
73.	34 C.F.R. § 99.31(b)(1).
74.	Id.
75.	The regulations provide that the use and re-disclosure requirements do "not apply to disclosures under §§ 99.31(a)(8), (9), (11), (12), (14), (15), and (16), and to information that postsecondary institutions are required to disclose under the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act, 20 U.S.C. 1092(f) (Clery Act), to the accuser and accused regarding the outcome of any campus disciplinary proceeding brought alleging a sexual offense." 34 C.F.R. § 99.33(c).
76.	Id. § 99.33.
77.	Id. § 99.33(a)(1).
78.	Id. § 99.33(a)(2).
79.	Id. § 99.33(b).
80.	20 U.S.C. § 1232g(b)(4)(A). This provision appears to exempt disclosures to school officials from this requirement. Id.; 34 C.F.R. § 99.32(d)(2).
81.	A brief summary of all FERPA exceptions can be found in CRS In Focus IF13155, The Family Educational Rights and Privacy Act (FERPA) and Its Exceptions, by Madeline W. Donley (2026).
82.	20 U.S.C. § 1232g(b)(1)(A); 34 C.F.R. § 99.31. Doe v. Woodford Cnty. Bd. of Educ., 213 F.3d 921, 927 (6th Cir. 2000) ("For these reasons, we find there was no violation of John Doe's rights under the Act. Any disclosure is protected by the [school official and health and safety] exceptions under the Act.").
83.	20 U.S.C. § 1232g(b)(1)(A); 34 C.F.R. § 99.31(a)(1)(i)(A).
84.	34 C.F.R. § 99.31(a)(1)(i).
85.	Id. § 99.33(a)(ii).
86.	See Law Enforcement Units, supra note 4, at 11.
87.	Kala Shah Suprenant, Student Priv. Pol'y Off., ED, FERPA & Virtual Learning During COVID-19 (2020) [hereinafter FERPA & Virtual Learning], https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FERPAandVirtualLearning.pdf [https://perma.cc/JCF5-N7BL].
88.	Lisa Ward, Data Privacy in the Age of Online Learning, Wall St. J. (Dec. 8, 2020, at 15:02 ET), https://www.wsj.com/articles/data-privacy-in-the-age-of-online-learning-11607457738.
89.	See FERPA & Virtual Learning, supra note 87. Of course, particular states may have their own privacy laws that restrict when information may be disclosed. See, e.g., Conn. Gen. Stat. Ann. §§ 10-234aa–10-234dd (West 2026); see Conn. Exec. Order No. 7I (Mar. 21, 2020) (authorizing the Commissioner of Education to waive student data privacy requirements "in order to provide quality online educational opportunities" during the COVID-19 pandemic), https://portal.ct.gov/-/media/Office-of-the-Governor/Executive-Orders/Lamont-Executive-Orders/Executive-Order-No-7I.pdf [https://perma.cc/Y66B-LMJ2].
90.	Priv. Tech. Assistance Ctr., ED, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, at 4 (2014) [hereinafter Protecting Student Privacy], https://studentprivacy.ed.gov/sites/default/files/resource_document/file/Student%20Privacy%20and%20Online%20Educational%20Services%20%28February%202014%29_0.pdf [https://perma.cc/B4Z8-PGRV].
91.	34 C.F.R. § 99.31(a)(1)(i).
92.	Protecting Student Privacy, supra note 90, at 5.
93.	34 C.F.R. § 99.31(b)(1). The regulations provide that such de-identified information may be disclosed "provided that the educational agency or institution or other party has made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information." Id.
94.	Protecting Student Privacy, supra note 90, at 2–3.
95.	Id. at 5.
96.	Id. at 5.
97.	See Law Enforcement Units, supra note 4, at 11. According to ED, an LEU official who is a school or school district employee "generally would be considered a school official to whom the school or district may disclose, without consent, education records (or PII contained in those records), if the law enforcement unit official meets the criteria specified in the school or district's annual notification of FERPA rights to parents and eligible students for being a 'school official' with a 'legitimate educational interest' in the education records." Id.; see 34 C.F.R. § 99.7(a)(3)(iii).
98.	20 U.S.C. § 1232g(a)(4)(B)(ii).
99.	Id. § 1232g(b)(1).
100.	See Law Enforcement Units, supra note 4, at 11.
101.	See supra note 84 and associated text.
102.	34 C.F.R. § 99.31(a)(1)(i)(A).
103.	Id. § 99.31(a)(1)(i)(B)(1).
104.	Id. § 99.31(a)(1)(i)(B)(2).
105.	Id. § 99.31(a)(1)(i)(B)(3).
106.	Law Enforcement Units, supra note 4, at 12.
107.	Id. at 11.
108.	Id. at 15.
109.	Id. at 12.
110.	Id.
111.	Id.
112.	Id.
113.	Id.
114.	Id.; see supra "Health and Safety Emergency Exception."
115.	Law Enforcement Units, supra note 4, at 13.
116.	34 C.F.R. § 99.33.
117.	Law Enforcement Units, supra note 4, at 14.
118.	20 U.S.C. § 1232g(b)(1)(I). Doe v. Woodford Cnty. Bd. of Educ., 213 F.3d 921, 927 (6th Cir. 2000) ("For these reasons, we find there was no violation of John Doe's rights under the Act. Any disclosure is protected by the [school official and health and safety] exceptions under the Act.").
119.	34 C.F.R. §§ 99.31(a)(10), 99.36.
120.	Id. § 99.36(c).
121.	Id.
122.	Id.; see ED, Addressing Emergencies on Campus 4 (2011) [hereinafter Emergency Guidance] ("This is a flexible standard under which the Department defers to school administrators so that they may bring appropriate resources to bear on the situation, provided that there is a rational basis for the educational agency's or institution's decisions about the nature of the emergency and the appropriate parties to whom the information should be disclosed."), https://studentprivacy.ed.gov/sites/default/files/resource_document/file/emergency-guidance.pdf [https://perma.cc/B8RS-46RS].
123.	See Law Enforcement Units, supra note 4, at 17; Emergency Guidance, supra note 122, at 3.
124.	Student Priv. Pol'y Off., ED, FERPA & Coronavirus Disease 2019 (COVID-19), Frequently Asked Questions (FAQs) (2020), https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FERPA%20and%20Coronavirus%20Frequently%20Asked%20Questions_0.pdf [https://perma.cc/T3NP-W2VA]; see also CRS Report R46542, Digital Contact Tracing and Data Protection Law, by Jonathan M. Gaffney, Eric N. Holmes, and Chris D. Linebaugh (2020).
125.	Emergency Guidance, supra note 122, at 3.
126.	34 C.F.R. § 99.32(a)(5).
127.	Emergency Guidance, supra note 122, at 4.
128.	Id. According to ED, "this general rule does not apply where a school official personally learns of information about a student through his or her official role in making a determination about the student and the determination is maintained in an education record." Id.
129.	Id.
130.	20 U.S.C. § 1232g(b)(2)(B); 34 C.F.R. § 99.31(a)(9)(i).
131.	20 U.S.C. § 1232g(b)(2)(B); 34 C.F.R. § 99.31(a)(9)(ii). This provision creates an exception to the parental notification requirement: parental notification is not required "when a parent is a party to a court proceeding involving child abuse and neglect (as defined in section 3 of the Child Abuse Prevention and Treatment Act (42 U.S.C. 5101 note)) or dependency matters, and the order is issued in the context of that proceeding." 20 U.S.C. § 1232g(b)(2)(B).
132.	See Letter from LeRoy Rooker, Dir., Fam. Pol'y Comp. Ctr., to Leslie Cochran, President, Youngstown Univ. (Feb. 16, 1999), https://studentprivacy.ed.gov/sites/default/files/resource_document/file/youngstownoh.pdf [https://perma.cc/4CEA-G5VT]; Letter from LeRoy Rooker, Dir., Fam. Pol'y Comp. Ctr., to Linda C.T. Simlick, Pinnel & Kingsley (June 22, 1998) [hereinafter Rooker-Simlick Letter], https://studentprivacy.ed.gov/sites/default/files/resource_document/file/california.pdf [https://perma.cc/LZE9-EA75].
133.	Rios v. Read, 73 F.R.D. 589, 598–99 (E.D.N.Y. 1977); see, e.g., U.S. v. Pleau, No. CR 10-184-1 S., 2012 WL 4369302, at *2 (D.R.I. Sep. 24, 2012) (holding former student's privacy interests outweighed by "the government's genuine need" to access education records that were "highly relevant" to the merits and sentencing in a criminal case with the possibility of capital punishment); Davids v. Cedar Falls Cmty. Schs., No. C96–2071, 1998 WL 34112767, *3 (N.D. Iowa Oct. 28, 1998) (holding parent of deceased student's need for disclosure of education records to prove a school had racially disparate discipline policies outweighed privacy interests of students involved). But see Maggard v. Essar Global Ltd., No. 2:12cv00031, 2013 WL 6158403, at *7 (W.D. Va, Nov. 25, 2013).
134.	20 U.S.C. § 1232g(b)(1)(J); 34 C.F.R. § 99.31(a)(9)(ii)(A)-(B).
135.	20 U.S.C. § 1232g(b)(1)(J)(ii) (stating "in which case the court or other issuing agency may order . . . ."). At least one federal district court has held that subpoenas issued by federal executive agencies for law enforcement purposes satisfy this exception. See, e.g, K.E. v. Nat'l Sci. Found., No. 1-15-MC-023 RP, 2015 WL 12734167 (W.D. Tex. Mar. 2, 2015).
136.	20 U.S.C. § 1232g(b)(1)(J)(i); 34 C.F.R. § 99.31(a)(9)(ii)(A).
137.	20 U.S.C. § 1232g(b)(1)(J)(ii); 34 C.F.R. § 99.31(a)(9)(ii)(B).
138.	20 U.S.C. § 1232g(b)(1)(F); 34 C.F.R. § 99.31(a)(6).
139.	20 U.S.C. § 1232g(b)(1)(C), (b)(3), (b)(5); 34 C.F.R. §§ 99.31(a)(3), 99.35.
140.	20 U.S.C. § 1232g(b)(1)(F); 34 C.F.R. § 99.31(a)(6)(i).
141.	Priv. Tech. Assistance Ctr., ED, The Family Educational Rights and Privacy Act: Guidance for Reasonable Methods and Written Agreements 1–2 (2015), https://studentprivacy.ed.gov/sites/default/files/resource_document/file/Guidance_for_Reasonable_Methods%20final_0_0.pdf [https://perma.cc/9DNH-HRQE].
142.	34 C.F.R. § 99.31(a)(6)(iii)(A).
143.	Id. § 99.31(a)(6)(iii)(B).
144.	Id. § 99.31(a)(6)(iii)(C). In particular, the regulations provide that schools enter into a written agreement that: (1) Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed; (2) Requires the organization to use personally identifiable information from education records only to meet the purpose or purposes of the study as stated in the written agreement; (3) Requires the organization to conduct the study in a manner that does not permit personal identification of parents and students, as defined in this part, by anyone other than representatives of the organization with legitimate interests; and (4) Requires the organization to destroy all personally identifiable information when the information is no longer needed for the purposes for which the study was conducted and specifies the time period in which the information must be destroyed. Id.
145.	20 U.S.C. § 1232g(b)(1)(C), (b)(3), (b)(5); 34 C.F.R. §§ 99.31(a)(3), 99.35. Disclosure under this exception may also be made to the Comptroller General of the United States, the Attorney General, and the Secretary of Education. 20 U.S.C. § 1232g(b)(1)(C); 34 C.F.R. § 99.31(a)(3).
146.	20 U.S.C. § 1232g(b)(3), (b)(5); 34 C.F.R. § 99.35.
147.	34 C.F.R. § 99.35(a)(3).
148.	Id. § 99.35(a)(3)(v).
149.	20 U.S.C. § 1232g(b)(1)(E).
150.	Id. § 1232g(b)(1)(E)(ii); 34 C.F.R. § 99.38. The statute has a similar provision for state laws passed before that date. 20 U.S.C. § 1232g(b)(1)(E)(i).
151.	20 U.S.C. § 1232g(b)(1)(E)(ii).
152.	See DOJ, ED, Sharing Information: A Guide to the Family Educational Rights and Privacy Act and Participation in Juvenile Justice Programs 8 (1997), https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FERPAandJuvenileJustice.pdf [https://perma.cc/9YPW-MVLE].
153.	Id. at 8.
154.	Id. at 8–9; 20 U.S.C. § 1232g(b)(1)(E).
155.	20 U.S.C. § 1232g(b)(6). Regulations implementing FERPA provide definitions and examples of these terms. 34 C.F.R. pt. 99, app. A.
156.	20 U.S.C. § 1232g(b)(6)(A).
157.	Id. § 1232g(b)(6)(B).
158.	Id. § 1232g(b)(6)(C).
159.	Id. § 1232g(b)(6)(C)(ii).
160.	Id. § 1094(a)(26).
161.	Id.
162.	20 U.S.C. § 1232g(a)(1), (b)(1).
163.	Id. § 1232g(f)–(g).
164.	FERPA regulations refer to the Office of the Chief Privacy Officer. 34 C.F.R. § 99.60. The ED website indicates that the Student Privacy Policy Office is led by the Chief Privacy Officer. Student Privacy Policy Office, ED (Jan. 14, 2026), https://www2.ed.gov/about/offices/list/opepd/sppo/index.html [https://perma.cc/C3HY-X799].
165.	34 C.F.R. § 99.66(b).
166.	Id. § 99.66(c).
167.	Id. § 99.67(a); see id. § 99.60(c) (designating the Office of Administrative Law Judges as the Review Board authorized to enforce the Act).
168.	See, e.g., United States v. Miami Univ., 294 F.3d 797, 812 (6th Cir. 2002) (affirming a district court decision that granted an injunction brought by the United States against a university from releasing records in violation of FERPA).
169.	See supra "Parental Access to Information About Students' Gender Identity at School."
170.	20 U.S.C. § 1681; see Cannon v. Univ. of Chi., 441 U.S. 677, 717 (1979), abrogation recognized by Medina v. Planned Parenthood S. Atl., 606 U.S. 357 (2025).
171.	Girardier v. Webster Coll., 563 F.2d 1267, 1276 (8th Cir. 1977); Gonzaga Univ. v. Doe, 536 U.S. 273, 278 (2002) (noting that the lower court "acknowledged that 'FERPA itself does not give rise to a private cause of action'" (quoting Doe v. Gonzaga Univ., 24 P.3d 390, 400 (Wash. 2001))).
172.	Gonzaga Univ., 536 U.S. at 276.
173.	Id. at 290.
174.	Elementary and Secondary Education Act of 1965, Pub. L. No. 89-10, 79 Stat. 27. The Every Student Succeeds Act reauthorized the ESEA. See Pub. L. No. 114-95, 129 Stat. 1802 (2015) (codified as amended in scattered sections of 20 U.S.C.).
175.	20 U.S.C. § 7908(a)(1).
176.	Id. § 7908(a)(2). When a student turns eighteen, the consent required of parents transfers to the student. Id. § 7908(a)(5).
177.	10 U.S.C. § 503(c)(1).
178.	Id. § 503(c)(6). The DOD-specific statute also applies to local educational agencies that receive assistance under the ESEA, but defines local educational agencies as (1) local educational agencies within the meaning of the term under the ESEA and (2) private secondary schools. Id. § 503(c)(6). By contrast, the ESEA defines local educational agencies as primarily "public" entities. 20 U.S.C. § 7801(30)(A).
179.	10 U.S.C. § 983(b)(2). Covered funds include funds made available by the Department of Defense; "any department or agency for which regular appropriations are made in a Departments of Labor, Health and Human Services, and Education, and Related Agencies Appropriations Act"; the Department of Homeland Security; the National Nuclear Security Administration; the Department of Transportation; and the Central Intelligence Agency. 10 U.S.C. § 983(d)(1).
180.	10 U.S.C. § 983(b)(2)(A)–(B).
181.	20 U.S.C. § 1681.
182.	Id. § 1681. While ED's Student Privacy Office enforces FERPA, Title IX's requirements for educational programs receiving federal financial assistance from ED are enforced by the Office for Civil Rights. See About OCR, ED (Apr. 11, 2025), https://www2.ed.gov/about/offices/list/ocr/aboutocr.html [https://perma.cc/2QJ7-8DJS].
183.	Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance, 85 Fed. Reg. 30026 (May 19, 2020) (codified at 34 C.F.R. pt. 106). These provisions are similar to those included in regulations implementing the Clery Act. 34 C.F.R. § 668.46(k). The Clery Act provisions apply to institutions of higher education who participate in Title IV of the Higher Education Act's student financial assistance programs. CRS In Focus IF12597, The Clery Act, as Amended by the Stop Campus Hazing Act, by Jared P. Cole and Adam K. Edgerton (2025). The procedural requirements for disciplinary actions cover cases of alleged dating violence, domestic violence, sexual assault, and stalking. 34 C.F.R. § 668.46(k). The Clery Act regulations also provide that compliance with those requirements does not violate FERPA. Id. § 668.46(l).
184.	34 C.F.R. § 106.45(b)(5)(vi) (2020).
185.	Id. § 106.45(b)(5)(iv).
186.	Id. § 106.45(b)(5)(vii).
187.	Id. § 106.45(b)(7).
188.	Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance, 89 Fed. Reg. 33474 (Apr. 29, 2024).
189.	Tennessee v. Cardona, 762 F. Supp. 3d 615, 627 (E.D. Ky. 2025), as amended (Jan. 10, 2025).
190.	DCL from Craig Trainor, Acting Assistant Sec'y for C.R., ED (Feb. 4, 2025), https://www.ed.gov/media/document/title-ix-enforcement-directive-dcl-109477.pdf [https://perma.cc/Y6VB-WZA4].
191.	Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance, 85 Fed. Reg. 30026, 30424, 30426 (May 19, 2020) ("The Department disagrees that § 106.45(b)(5)(v) [of Title IX-implementing regulations] inherently or directly conflicts with FERPA. A recipient should interpret Title IX and FERPA in a manner to avoid any conflicts.").
192.	Id. at 30426 ("To the extent that there may be unusual circumstances, where a true conflict between Title IX and FERPA may exist (such as a student's formal complaint against an employee), the Department includes a provision in § 106.6(e) to expressly state that the obligation to comply with these final regulations under Title IX is not obviated or alleviated by the FERPA statute or regulations.").
193.	20 U.S.C. § 1221(d).
194.	34 C.F.R. § 106.6(e).
195.	Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance, 85 Fed. Reg. at 30421.
196.	See Doe v. Purdue Univ., 928 F.3d 652, 656 (7th Cir. 2019); Doe v. Miami Univ., 882 F.3d 579, 603 (6th Cir. 2018).
197.	Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance, 85 Fed. Reg. at 30422.
198.	While due process requirements generally apply to public entities, such as a state school, ED has applied its reasoning to recipient private schools as well. Id. at 30421–22.
199.	Id. at 30433; see 20 U.S.C. § 1232g(a)(1).
200.	20 U.S.C. § 1232g(a)(4)(A).
201.	Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance, 85 Fed. Reg. at 30433.
202.	See supra "FERPA Enforcement."
203.	Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance, 85 Fed. Reg. at 30428.
204.	Rios v. Read, 73 F.R.D. 589, 597 (E.D.N.Y. 1977) (quoting 120 Cong. Rec. 39862 (1974) (joint remarks of Sen. Buckley and Sen. Pell)).
205.	Id. at 597–98 (quoting 121 Cong. Rec. 13990 (1975) (remarks of Sen. Buckley)).
206.	Id. at 598–99 (quoting 121 Cong. Rec. 13990 (1975)).
207.	H.R. Rep. No. 93-1211, at 187 (1974) (Conf. Rep.).
208.	Id.
209.	See, e.g., Lauraine Langreo, Schools Face an Uphill Battle in Protecting Student Data in the Age of AI, Educ.Week (Mar. 25, 2025), https://www.edweek.org/technology/schools-face-an-uphill-battle-in-protecting-student-data-in-the-age-of-ai/2025/03 [https://perma.cc/SL5G-CRKK]; Kathleen McGrory & Natalie Weber, Feds Investigating Pasco Schools Giving Student Data to Sheriff, Tampa Bay Times (Apr. 19, 2021) https://www.tampabay.com/investigations/2021/04/19/feds-investigating-pasco-schools-giving-student-data-to-sheriff/ [https://perma.cc/3A9R-ZSDP] (observing that ED "has opened an investigation into whether the Pasco school district broke federal law by sharing private student information with the Pasco Sheriff's office").
210.	See supra "Parental Access to Information About Students' Gender Identity at School."
211.	Mirabelli v. Bonta, 146 S. Ct. 797, 802 (2026) (per curiam).
212.	See ED DCL, supra note 53.
213.	See, e.g., Ward, supra note 88 ("Schools are relying heavily on technology—from videoconferencing programs to digital-teaching tools and temperature-taking apps—to educate children safely in the age of Covid. But this rapid deployment of new technology means schools are collecting a lot more personal data on students. And that is raising some troubling questions about who has access to the data, how it is being used and whether it is being kept safe.").
214.	Sch. Superintendents Ass'n, FAQs on Immigration and Enforcement Policy in 2025 (2025), https://www.aasa.org/docs/default-source/resources/fact-sheet/faqs-on-immigration-enforcement-policy-in-2025.pdf [https://perma.cc/95LY-4NYF].
215.	Compare 8 U.S.C. § 1225(d)(4) (authorizing issuance of administrative subpoenas pursuant to immigration enforcement) with 20 U.S.C. § 1232g(b)(2)(A) (allowing, but not requiring, disclosure of student records in response to a lawfully issued subpoena).
216.	Rooker-Simlick Letter, supra note 132.
217.	D.C. Off. of the Att'y Gen., Answers to Frequently Asked Questions About Immigration Enforcement in Schools (2025), https://oag.dc.gov/sites/default/files/2025-01/2025.01.24%20School%20Immigration%20Guidance%20-%20English.pdf [https://perma.cc/KK84-76QF]; Ill. State Bd. of Educ., Non-Regulatory Guidance on the Safe Schools for All Act and Immigration Enforcement Actions (2025), https://www.isbe.net/Documents/Immigration-Enforcement-Guidance.pdf [https://perma.cc/LY4H-HNDG]; Information Regarding Recent Immigration-related Actions, N.Y. State Educ. Dep't, https://www.nysed.gov/bilingual-ed/information-regarding-recent-immigration-related-actions [https://perma.cc/UG26-7JAH] (last visited May 29, 2026); Rob Bonta, Promoting a Safe and Secure Learning Environment for All: Guidance and Model Policies to Assist California's TK-12 Schools in Responding to Requests for Access and Information for Immigration Enforcement Purposes (2025), https://oag.ca.gov/system/files/media/school-guidance-model-k12.pdf [https://perma.cc/Q6TA-ZLYG]; Mass. Exec. Off. of Educ., Recommendations For Entities Providing Education and Child Care Services Related to Interacting with Federal Immigration Officers (2026), https://www.mass.gov/doc/recommendations-for-entities-providing-education-and-child-care-services-related-to-interacting-with-federal-immigration-officers/download [https://perma.cc/W3D4-HS39].
218.	8 U.S.C. § 1225(d)(4).
219.	United States v. Delaware Dep't of Lab., No. MC 25-322-CFC, 2026 WL 984215, at *3 (D. Del. Apr. 13, 2026).
220.	20 U.S.C. § 1232g(b)(2)(A).
221.	Parental Rights Relief Act, H.R. 6860, 119th Cong. (2025).
222.	Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992).
223.	Spokeo Inc. v. Robins, 578 U.S. 330, 341 (2016).
224.	TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021) (quoting Spokeo, 528 U.S. at 341).
225.	Id. at 424.
226.	Id. at 424–25.