What Schools That Fail to Comply with FERPA Regulations Could Face

Think about a locked filing cabinet in the school office: not everyone gets a key, and there's a reason for that. The Family Educational Rights and Privacy Act, or FERPA, works the same way for student records.

It's the federal law that controls who can see a student's grades, attendance, and other school files, and who can't. Schools that get this wrong don't just risk paperwork headaches.

This post walks through what's at stake, whose rights are protected, and how to keep your own classroom records safe.

What Happens When Schools Don't Follow FERPA

Before you can understand what's on the line when a school drops the ball, it helps to know exactly what FERPA protects, who it covers, and how it got here.

Does FERPA apply to state agencies?

Yes: the Family Educational Rights and Privacy Act (FERPA) applies to any state agency, local education agency (LEA), or school that receives funding from the U.S. Department of Education.

At its core, FERPA protects student education records, and it does that job in two directions at once. It grants parents and eligible students the right to access those records, while restricting who else can see them.

That two-fold purpose, access balanced against protection, is what every compliance question eventually comes back to.

How FERPA got its start

FERPA is often called the Buckley Amendment, named for the senator who sponsored it, and it exists because of real records abuse: schools sharing student files without consent, or refusing to let families see their own children's records.

President Ford signed FERPA into law in 1974, and the law's Joint Statement in the Congressional Record still guides how courts read its intent today.

How FERPA has evolved over time

FERPA hasn't stood still. According to EPIC, it's been amended eleven times since 1974, including:

• The Clery Act (1990/1992), addressing campus crime reporting.
• The PATRIOT Act (2001), adding a national-security exception for federal investigators.
• New Department of Education regulations in 2008 and 2011, clarifying how records can be disclosed.
• The Uninterrupted Scholars Act (2013), making it easier for caseworkers to access records for students in foster care.

Each change reflects the same original goal: keeping student records safe without shutting out the people who genuinely need them.

What Counts as an Education Record

Before you can protect student records, you need to know what actually counts as one. FERPA's definition is broader than most teachers expect, and it draws some sharp lines around what's in and what's out.

Which records qualify as education records

For a document to count as an education record, it has to be directly related to a student, maintained by the school or someone acting on its behalf, and kept in a central location by a designated record custodian.

That covers more than test scores: education records include psychological evaluations and disciplinary notes, too.

Think of a homeroom teacher marking daily attendance: that log becomes a FERPA record the moment it's filed, not just when it lands in a permanent file.

Records FERPA doesn't cover

Not every piece of paper in a school qualifies. FERPA carves out several exceptions:

• Law enforcement unit records created and kept by a school's own police or security unit
• Sole possession notes a teacher jots down for personal use and never shares
• Employee records for staff who aren't also enrolled students
• Peer-graded papers, before the teacher collects and records the grade
• Teacher personal notes kept separately from a student's official file
• Security video footage, in most cases

What counts as directory information

Schools can also designate certain details as directory information: names, addresses, and photos that can be released without consent. Parents keep the right to opt out of that disclosure, and schools have to honor it once they do.

Combined, though, directory details can still add up to identify a specific student, so schools need to stay careful about what they hand out and to whom.

One exception worth knowing: federal law requires schools to release directory information to military recruiters unless a parent has opted out.

Parent and Student Rights Under FERPA

FERPA isn't just a rulebook for schools: it's a set of protections for the people the records are actually about. Four rights sit at the core:

• the right to inspect records
• request corrections
• control who sees personal information
• and file a complaint when something goes wrong

Here's what each one looks like in practice.

Right to inspect and review records

Any parent or eligible student can ask to see the education records a school keeps on them, and the school can't drag its feet.

According to Subpoenas and the new registrar, Part 4, FERPA requires a school to comply with a request to inspect records "within a reasonable period of time, but not more than 45 days after it has received the request."

Schools can't charge a fee just to let someone view a file, though a reasonable copying fee is allowed if they want copies to take home.

That right doesn't stay with the parent forever. As explained in Know when parents have rights to access dually enrolled student's education records, FERPA rights transfer from parents to the student once the student turns 18.

From that point on, it's the student, not the parent, holding the keys to their own file.

What rights do students have under FERPA?

Beyond viewing a record, students and parents can push back on what's in it.

1. If a record looks inaccurate or misleading, they can request a correction.
2. If the school disagrees, they're entitled to a hearing to challenge the content.
3. Still no resolution? They can insert a written explanation into the file so their side stays on record permanently.

Schools carry the other half of the deal: an annual notification of rights, spelling out all of this in plain language.

Many schools meet that requirement with a sample annual rights notice mailed home or tucked into the student handbook, covering inspection, correction, and disclosure rights in one place.

Keeping Classroom Records FERPA Compliant

Most FERPA slips happen in small daily moments: a roster left open, a grade list on the door, a quick reply to a records request. This card covers the three routines where those slips happen, so you can run each one safely without slowing down.

Lock down daily attendance

Before class starts each day, your attendance setup should pass these checks:

• Rosters are stored securely. Paper goes in a locked drawer; digital stays behind your login.
• Directory info is limited. Share names only where needed; never post rosters with student IDs.
• Sign-in sheets are password-protected. Use a protected file or platform, never an open spreadsheet link.

⚠️ Watch out: the shared classroom computer is where rosters leak. If a student could tap the screen and see grades or attendance, you're exposed. Lock it when you step away.

Before you share, find your row

Sharing decisions branch, so match your situation and read across:

That last row matters most in practice. A free quiz app you found on Friday afternoon still collects student data, and you carry the risk if it hasn't been vetted.

When a records request lands

Requests follow a fixed sequence. Work it in order:

1. Redact other students' identifying information.
   • Black out names, ID numbers, and anything traceable before anything leaves your hands.
2. Log every disclosure you make.
   • One line each: who received it, what, when, and why.
3. Respond within 45 days.
   • FERPA sets the clock, so date-stamp the request the day it arrives.

Here's what a working log looks like, so you can copy the format:

Disclosure log entry: Oct 12: copy of attendance record for J.M., released to parent by mail, per written request received Oct 3.

At a glance:

Compliance isn't one big policy; it's these small habits run consistently. See how EMStudio's secure attendance tracking keeps student records compliant and audit-ready.

When Schools Can Share Records Without Consent

FERPA isn't an all-or-nothing lock on student records. It carves out specific situations where schools can disclose information without a parent's signature, and knowing them keeps you from over-restricting access one day and under-protecting it the next.

When officials and vendors can access records

Staff with a legitimate educational interest (a real, job-related need to know) can view records without separate consent.

That same interest extends to contractors and vendors acting as "school officials," think a grading platform or attendance app processing student data on the school's behalf.

The tricky part is data sharing with outside companies: once information leaves the building, accountability can thin out fast if a contract doesn't spell out clear limits. Before adopting new edtech, vet the vendor: confirm they'll:

• use the data only for the agreed purpose
• store it securely
• delete it once the contract ends

Court, police, and emergency exceptions

Records can go out under a subpoena or court order, and in a genuine health or safety emergency, schools can disclose what's needed to protect students or staff.

That emergency exception got real-world use during the pandemic: the U.S. Department of Education issued FERPA guidance addressing COVID-19 to clarify when schools could share information to respond to the outbreak.

Juvenile justice disclosures follow the same logic, sharing limited records with courts handling a student's case.

Disclosing disciplinary and crime records

Schools may release the final results of disciplinary proceedings for violent crimes, and for sex offenses, both the finding and the sanction. Parents can be notified when their under-21 student is found responsible for an alcohol or drug violation.

And schools can share information about registered sex offenders on campus, since that's public record and sits outside FERPA's protections entirely.

What Schools That Fail to Comply with FERPA Could Face

For a rule with real teeth, FERPA's actual bite is smaller than most teachers expect. The consequences aren't about lawsuits landing on a school's desk. They're about federal funding and a formal complaint process, and the two work very differently.

Risk of losing federal funding

Schools that violate FERPA risk losing federal education funding, but only under a specific bar: the U.S. Department of Education (DOE) has to find a policy or practice of violations, not a single slip-up.

For example, a teacher who posts a list of failing grades on a classroom door, or emails a report card to the wrong parent, is a real violation, but it's the kind schools are expected to fix, not shut down over.

Even then, according to the Student Press Law Center, the funding penalty has never actually been imposed on anyone. Schools are typically given a notice and a chance to submit a correction plan first.

Why you can't sue a school under FERPA

Courts have unanimously held that FERPA doesn't create a private lawsuit for damages, as the Supreme Court explained in Gonzaga Univ. v. Doe. That 2002 ruling also closed the door on Section 1983 claims built on FERPA rights.

DOE enforcement is the only remedy that exists.

How to file a FERPA complaint

Parents and eligible students file with the Student Privacy Policy Office (SPPO) within 180 days of the violation, using its complaint form. An extension request is possible if there's a good reason for the delay.

That review process, not a courtroom, is where accountability actually happens, which is exactly why locking down attendance sheets and records day to day matters more than any lawsuit ever could.

FERPA and Public Records Requests

FERPA protects student privacy, but it's not a blanket excuse to seal every school record from public view. Some districts stretch it anyway, and knowing where the line actually falls helps you push back when it matters.

When schools misuse FERPA to block records

• Parking tickets are a favorite target: according to the Student Press Law Center, "police reports and parking tickets" are among the records that have long been "removed from FERPA by law." They still get wrongly cited as protected.
• Meeting minutes face the same treatment: in a report on Sweetwater County schools, district officials claimed records were "being withheld under the backing of the Family Educational Rights and Privacy Act," prompting a parent to say the district was "twisting the law."
• Athletic misconduct findings run into the same wall. A law review examining the Buckley Amendment devotes a section to "Cases Invoking FERPA as Justification for Withholding," cataloguing schools that cited FERPA to sit on misconduct records even when other disclosure rules applied.

The pattern across all three: cite FERPA first, sort out whether it actually fits later.

Campus police and security records

A 1992 amendment removed records "maintained by a law enforcement unit" from FERPA's definition of education records entirely. That means campus crime logs must stay public.

Schools can redact identifying details like names or ID numbers without withholding the whole record, and that's the right move, not a blanket denial.

Sexual assault findings are where misuse shows up most: FERPA still gets cited to block disclosure, even though law enforcement records were never covered by it in the first place.

How state open records laws interact with FERPA

Sunshine and freedom of information laws still apply on top of FERPA. The burden sits with the agency to prove a record is exempt, not with you to prove it isn't.

Redacted documents are releasable once identifying details are stripped out, and FERPA can't preempt a state's open records law: it sets a privacy floor, not a records ceiling.

Tips for getting records despite FERPA

• Know exempt record types. Police reports, crime logs, and law enforcement files fall outside FERPA.
• Ask for redacted records instead of accepting a flat denial.
• Obtain a FERPA waiver from the student or parent when it's an option.
• Interview students directly. A first-hand account sidesteps the records fight entirely.
• Publicize wrongful denials. Districts often reverse course once someone asks why.

New Concerns and Criticism of FERPA

FERPA has evolved since 1974, but so has the technology sitting in your classroom, and critics argue the law hasn't kept pace.

Ed-tech and student data privacy concerns

Every time a student logs into a classroom app, that platform collects data: assignments, grades, sometimes even behavior notes.

Privacy advocates have criticized FERPA's regulatory framework for allowing education-technology vendors access to student data without sufficient transparency or safeguards, since many local education agencies (LEAs), the districts and school systems operating under federal education law, sign vendor contracts that parents and even teachers rarely see in full.

Groups like the Electronic Privacy Information Center (EPIC) have pushed back specifically on the U.S. Department of Education's 2008 and 2011 updates to FERPA's rules, arguing those changes widened the "school official" exception and made it easier for outside companies to reach student records without direct consent.

That's fueled ongoing calls for stronger, clearer protections built for a cloud-based classroom, not a filing cabinet.

It's worth knowing where FERPA sits alongside other privacy laws:

• FERPA covers education records
• The Health Insurance Portability and Accountability Act (HIPAA) protects medical records
• The Children's Online Privacy Protection Act (COPPA) governs data collected from kids under 13 online
• The Protection of Pupil Rights Amendment (PPRA) covers surveys and instructional materials

They overlap at the edges, but none alone covers everything a single ed-tech tool touches.

FERPA isn't just a compliance headache. It's the line that protects a student's privacy and a family's trust in their school.

Knowing what counts as an education record, who's allowed to see it, and how to keep daily records clean keeps you on the right side of that line without slowing down your teaching.

Ready to keep your attendance and records FERPA-safe without extra hassle? Check out our Attendance & Records feature to mark attendance quickly and spot patterns across your classes over time.

References

1. Subpoenas and the new registrar, Part 4 — doi.org (2023)
2. Legislative History of Major FERPA Provisions — studentprivacy.ed.gov
3. 2011-30683 — gpo.gov
4. Uninterrupted Scholars Act (PDF) — ed.gov
5. FERPA & Coronavirus Disease 2019 (COVID-19): Frequently ... — studentprivacy.ed.gov
6. Gonzaga University et al. v. Doe, 536 U.S. 273 (2002). — tile.loc.gov
7. Civil Rights - Education: Do Violations of the Family Educational Rights and Privacy Act of 1974 (FERPA) Create an Enforceable Right under the Meaning of 42 U.S.C. 1983 — commons.und.edu (2003)
8. GONZAGA UNIV. v. DOE | Supreme Court | US Law — law.cornell.edu
9. Student Athletes and the Buckley Amendment: Right to Privacy Does Not Include the Right to Sue — scholarship.law.marquette.edu (2004)
10. The Family Educational Rights and Privacy Act (FERPA): A Legal Overview — digital.library.unt.edu (2013)
11. Big Tech Makes Big Data Out of Your Child: The FERPA Loophole EdTech Exploits to Monetize Student Data — digitalcommons.wcl.american.edu (2020)
12. Know when parents have rights to access dually enrolled student's education records — doi.org (2024)
13. ‘Not just records’: Parent says Sweetwater County school district is ‘twisting the law’ | Local News — wyomingnews.com (2025)
14. Family Educational Rights and Privacy Act (FERPA) – EPIC — epic.org
15. Clery Center's Policy History — clerycenter.org
16. FERPA: What it means and how it works — splc.org