The Family Educational Rights and Privacy Act (FERPA) and Its Exceptions

The Family Educational Rights and Privacy Act (FERPA) and Its Exceptions

The Family Educational Rights and Privacy Act (FERPA) and Its Exceptions

January 15, 2026 (IF13155)

The Family Educational Rights and Privacy Act (FERPA) requires, among other things, that schools and educational agencies receiving certain types of federal funds from the Department of Education (ED) obtain written consent from parents (or students if they're 18 or older) before releasing students' education records to "any individual, agency, or organization." FERPA defines education records as "those records, files, documents, and other materials which– (1) contain information directly related to a student; and (2) are maintained by an educational agency or institution or by a person acting for such agency or institution." Not all records are protected by FERPA. Certain documents are not considered to be education records, and, in some instances, education records can be released without obtaining consent pursuant to statutory exceptions. This In Focus provides an overview of the categories of information that are not considered education records under FERPA and the statutory exceptions that permit release of education records without prior consent.

Information Not Subject to FERPA

FERPA and ED regulations provide that certain information is not part of a student's education record and is thus not subject to FERPA's protections. The following are not education records:

records "in the sole possession of the maker" that are used as a memory aid and are only accessible or revealed to the maker or a substitute;

records maintained by a law enforcement unit of the school or educational agency that were created "for the purpose of law enforcement";

records made in the normal course of business by a nonstudent school employee that relate exclusively to such person in that person's capacity as an employee and are not used for any other purpose;

medical (including psychiatric) records relating to a student who is 18 or older or attends an institution of higher education (IHE) that are made, maintained, and used only for providing treatment to the student and disclosed only to individuals providing the treatment;

records created or received after a student is no longer in attendance that are not directly related to that student's attendance; and

grades on peer-graded papers (before they are collected and recorded).

An additional category, directory information, is treated differently under FERPA. Directory information expressly includes a student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height (for athletes), dates of attendance, degrees and awards received, and school of last attendance. ED's regulations state that a student's identification number is not considered to be directory information unless it cannot be used on its own to access a student's education records. Directory information can be made public, but FERPA requires that schools provide public notice of the types of information included and "a reasonable period of time" for parents to opt out.

Exceptions to FERPA

Even if information falls within the definition of an education record, there are instances where a school may share a student's education record without first obtaining parental consent. Once records are released under one of these exceptions, limitations on redisclosure may apply.

School Officials. Education records may be given to school officials without parental consent in two situations. The first situation arises when the educational institution or agency determines that the official has "legitimate educational interests" in accessing a student's education record. Parents must be notified annually about the "criteria for determining a school official and what constitutes a legitimate educational interest." ED regulations state that a school official need not be an employee of the school: "a contractor, consultant, volunteer, or other party" can be a school official if certain conditions are met.

The second situation arises when education records are sought by "officials of other schools or school systems in which the student seeks or intends to enroll." When records are transferred for enrollment purposes, parents must "be notified of the transfer, receive a copy of the record if desired, and have an opportunity for a hearing to challenge the content of the record[.]"

Financial Aid. Education records may be released "in connection with a student's application for, or receipt of, financial aid[.]" ED regulations specify that this exception applies if the education records are "necessary" to determine eligibility, aid amount or conditions, or to "enforce the terms and conditions of the aid."

Oversight and Evaluation. FERPA allows education records to be disclosed to government agencies or officials for oversight and evaluation purposes in certain contexts. Specifically, FERPA permits education records to be transferred to "authorized representatives" of the Comptroller General of the United States, Secretary of Education, or state and local educational agencies in order to audit or evaluate federally funded education programs, or to enforce requirements tied to the receipt of federal funds. Education records may also be released to the Secretary of Agriculture or authorized representatives of the Food and Nutrition Service in connection with assessment of programs under the National School Lunch Act or Child Nutrition Act. In each of these instances, there are limitations on the use and storage of personally identifiable information (PII).

Juvenile Justice. State and local officials may access education records concerning "the juvenile justice system and [its] ability to effectively serve ... [a] student" if disclosure is "specifically allowed" by state law. Additional limitations apply if the relevant state law was adopted after the date FERPA went into effect (November 19, 1974).

Studies and Surveys. FERPA contains an exception for "organizations conducting studies for, or on behalf of, educational agencies" regarding (1) predictive tests, (2) student aid programs, and (3) "improving instruction." Education records can be accessed by an organization for these purposes so long as the study does not permit personal identification of students and their parents other than by a representative of the organization that has legitimate interests in the information, and PII is destroyed "when no longer needed." ED regulations provide further requirements for the redisclosure of PII.

FERPA does not except surveys from its general requirements. Instead, FERPA orders the Secretary of Education to adopt (or identify) regulations protecting "the rights of privacy of students and their families in connection with any surveys or data-gathering activities[.]" Another law, the Protection of Pupil Rights Amendment (PPRA), requires parental consent for student participation in "a survey, analysis, or evaluation" that reveals certain information about the student or their family. The PPRA and its regulations contain their own exceptions.

Health and Safety. "[A]ppropriate persons" can access education records without prior consent "in connection with an emergency" if "necessary to protect the health or safety of the student or other persons." ED regulations specify that this exception may allow disclosure of records when the "totality of the circumstances" indicates that there is an "articulable and significant" threat to health or safety.

Disciplinary Records. FERPA specifies that it does not preclude disclosure to teachers and school officials of disciplinary records concerning conduct of a student that "posed a significant risk to the safety or well-being" of themselves, other students, or the school community, where such teachers or officials have "legitimate educational interests" in the student's behavior. When a student is the alleged perpetrator of a crime of violence or a "nonforcible sex offense," an IHE may share the results of disciplinary proceedings related to the offense with the alleged victim. The IHE may share this information more broadly if the student is found to have violated the IHE's rules or policies.

Subpoenas. FERPA's exceptions and related requirements for disclosure in response to subpoenas vary based on the nature of the subpoena. Education records can be disclosed to "the entity or persons designated in a Federal grand jury subpoena" or in "any other subpoena issued for a law enforcement purpose[.]" For grand jury subpoenas, a court must, for good cause shown, order the entity that is served not to disclose (1) that the subpoena exists or (2) any of the records turned over in response. Courts issuing subpoenas for law enforcement purposes may order restrictions on disclosure but are not required to do so. For court orders or subpoenas of education records for purposes other than a grand jury or law enforcement, FERPA provides that the school or educational agency must notify students and their parents "of such orders or subpoenas in advance of compliance." This provision does not apply to certain child welfare cases (discussed below under "Child Welfare").

Law Enforcement. Exceptions to FERPA related to government officials and subpoenas are sometimes limited to "a law enforcement purpose[.]" For example, FERPA allows authorized representatives of the Attorney General to obtain education records without parental consent for law enforcement purposes, subject to the same conditions as other government officials. As discussed above, FERPA also permits courts to restrict schools and educational agencies from disclosing information about subpoenas issued for law enforcement purposes. FERPA does not define "law enforcement." Some courts have assumed that the phrase implies situations where education records are used to detect and punish violations of the law.

Child Welfare. The Uninterrupted Scholars Act amended FERPA to allow caseworkers in state, local, and tribal child welfare agencies (CWAs) to access a student's education records when the CWA is legally responsible "for the care and protection of the student[.]" Only caseworkers who can access a student's case plan may access their education records. Caseworkers may disclose records to "an individual or entity engaged in addressing the student's education needs" only if authorized by the CWA and consistent with state or tribal laws. The Act also added an exception allowing courts to access education records in child abuse and neglect cases involving a student's parent.

Crimes and Sex Offenses. In some instances, FERPA allows schools to release education records in relation to sex offender registration, drug and alcohol violations, and the investigation and prosecution of terrorism.

De-Identified Records. Consent is not required before disclosing de-identified education records. These records may not contain PII, and a school or educational agency must make a "reasonable determination" that a student's identity is not identifiable "taking into account other reasonably available information."