What Is FERPA? Student Records Rights for Parents & Students

FERPA, the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g), is the federal law that lets parents see their child's school records, ask the school to correct them, and control most disclosures of them. When a student turns 18 or enters college, those rights pass to the student.

Scope: This page covers the federal Family Educational Rights and Privacy Act and its regulations (34 C.F.R. Part 99), with notes on the special-education records rules of the Individuals with Disabilities Education Act (IDEA), the Protection of Pupil Rights Amendment (PPRA), the HIPAA overlap, and selected state laws. State student-records rules vary; the FERPA Request Letter Generator shows each state's rule with its source.

What is FERPA?

FERPA is a federal privacy law for student education records. Congress added it in 1974 (Pub. L. 93-380, § 513, Aug. 21, 1974), and the Department of Education's rules implementing it are at 34 C.F.R. Part 99.

The Department's Student Privacy Policy Office sums it up as a law that gives parents "the right to have access to their children's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records."

In practice FERPA answers three questions about the records a school keeps: who may see them, how errors get challenged, and when the school needs permission before sharing them.

Which schools does FERPA cover?

FERPA applies to any educational agency or institution "to which funds have been made available under any program administered by the Secretary" of Education (34 C.F.R. § 99.1(a)). The statute itself reaches "any public or private agency or institution which is the recipient of funds under any applicable program" (20 U.S.C. § 1232g(a)(3)).

In practice that covers:

• Public school districts and public K-12 schools
• Nearly every college and university, public or private, because federal student aid such as Pell Grants counts as funds made available to the school (34 C.F.R. § 99.1(c)(2))
• State education agencies

Most private elementary and secondary schools are outside FERPA. The Student Privacy Policy Office states that "private schools at the elementary and secondary levels generally do not receive funds from the Department and are, therefore, not subject to FERPA" (SPPO FAQ). A school is also not covered merely because its students receive non-monetary benefits from a Department program (34 C.F.R. § 99.1(b)).

State law can fill part of that gap. California, for example, gives parents an "absolute right to access to any and all pupil records related to their children that are maintained by school districts or private schools" (Cal. Educ. Code § 49069.7).

What counts as an education record?

An education record is a record that is directly related to a student and maintained by the school or by a party acting for it (34 C.F.R. § 99.3). "Record" is defined broadly: any information recorded in any way, including handwriting, print, computer media, and video or audio tape.

That reaches far more than a transcript. Grades, attendance, discipline files, special education evaluations, school nurse records in K-12, and school emails or files about a student can all be education records if the school maintains them.

The regulation excludes several categories:

Source for each row: 34 C.F.R. § 99.3, definition of "education records," paragraph (b). The treatment-records exclusion applies only to students who are 18 or in postsecondary school, so K-12 health and counseling records the school maintains are generally education records.

Who holds FERPA rights?

FERPA rights start with the parent, which the regulation defines to include "a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or a guardian" (34 C.F.R. § 99.3).

When the student becomes an "eligible student," meaning the student "has reached 18 years of age or is attending an institution of postsecondary education," the rights and the power to consent transfer to the student (34 C.F.R. §§ 99.3, 99.5(a)(1)). A 16-year-old taking college classes holds the rights for the college's records.

Divorced and separated parents

A school must give full FERPA rights to either parent unless it has been provided with evidence of "a court order, State statute, or legally binding document relating to such matters as divorce, separation, or custody that specifically revokes these rights" (34 C.F.R. § 99.4).

A parent without primary custody therefore generally has the same right to inspect records as the custodial parent. The school can refuse only if it has a document that specifically takes those rights away; a custody order that is silent on school records does not.

The three FERPA rights

1. The right to inspect and review records

A parent or eligible student must be given the opportunity to inspect and review the student's education records (34 C.F.R. § 99.10(a)). The school must comply "within a reasonable period of time, but not more than 45 days after it has received the request" (§ 99.10(b)); the statute uses the same 45-day cap (20 U.S.C. § 1232g(a)(1)(A)).

Copies are where many people are surprised. FERPA requires the school to provide a copy, or make other arrangements, only when circumstances "effectively prevent" the parent or eligible student from inspecting the records, such as living too far away to review them in person (§ 99.10(d)). Otherwise, letting you review the records at the school satisfies FERPA, although some state laws give a firmer right to copies.

Other rules that shape a records request:

• Fees. A school may charge for copies unless the fee effectively prevents access, but it "may not charge a fee to search for or to retrieve" records (34 C.F.R. § 99.11).
• Explanations. The school must respond to reasonable requests for explanations and interpretations of the records (§ 99.10(c)).
• No destruction. A school "shall not destroy any education records if there is an outstanding request to inspect and review" them (§ 99.10(e)).
• Other students. Where a record covers more than one student, you may see only the information about your student (34 C.F.R. § 99.12(a)).
• Who has seen the records. Schools must keep a record of requests for and disclosures of a student's information, and the parent or eligible student may inspect it (34 C.F.R. § 99.32).

2. The right to request a correction, and a hearing

A parent or eligible student who believes a record is "inaccurate, misleading, or in violation of the student's rights of privacy" may ask the school to amend it (34 C.F.R. § 99.20(a)). The school must decide within a reasonable time; FERPA sets no fixed number of days. If it refuses, it must say so and tell you of your right to a hearing.

The hearing may be run by any individual, including a school official, "who does not have a direct interest in the outcome," and you may bring anyone you choose, including an attorney at your own expense (34 C.F.R. § 99.22). The written decision must be based solely on the evidence presented at the hearing and include a summary of the evidence and the reasons.

If the hearing finds the record accurate, you may place a statement in the record commenting on the contested information or explaining why you disagree. The school must keep that statement with the contested part for as long as it keeps the record, and disclose it whenever it discloses that part (34 C.F.R. § 99.21).

Watch out: The amendment process is not a grade appeal. Department guidance states that "the right to seek amendment of education records cannot be used to challenge a grade or evaluation unless it has been inaccurately recorded" (Department of Education letter, Aug. 13, 2004). A grade copied wrong into the system can be corrected under FERPA; a disagreement with the grade itself goes through the school's own appeal process.

3. The right to consent before disclosure

Outside the exceptions described below, a school needs "a signed and dated written consent" before it discloses personally identifiable information from a student's education records (34 C.F.R. § 99.30(a)).

This signed consent is what people usually mean by a FERPA release form. To be valid it must specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties who may receive them (§ 99.30(b)). An electronic signature can count if it identifies and authenticates the person and shows that person's approval (§ 99.30(d)). On request, the school must give you a copy of the records it disclosed under the consent (§ 99.30(c)).

How to request, correct or release records

The school's annual FERPA notice is the place to start. Every covered school must notify parents and eligible students in attendance of their rights each year, including the procedure for inspecting records and for requesting an amendment (34 C.F.R. § 99.7). It is usually in the student handbook or on the school or district website.

The regulation does not require the request to be in writing, but a written request creates a dated record of when the 45-day period began and gives you something to point to later. A useful request names the student, identifies the records (for example, all records in any format, including email and video), says whether you want to inspect them or need copies and why, and asks for the school's record of disclosures.

For a correction, the letter should identify the specific entry, explain why it is inaccurate, misleading or a privacy violation, and ask for the change. If the school refuses, a separate written request for a hearing under § 99.21 keeps the process moving. Keep copies of everything you send and receive.

When schools can share records without consent

FERPA lists specific situations in which a school "may disclose" information without consent (34 C.F.R. § 99.31(a)). These exceptions permit disclosure; apart from disclosure to the student or to the parent of a student who is not yet an eligible student, they do not require it (§ 99.31(d)).

A few of these carry conditions worth knowing:

Ed-tech vendors and other contractors count as school officials only if they perform a function the school would otherwise use employees for, are "under the direct control" of the school regarding the records, and follow the redisclosure limits (§ 99.31(a)(1)(i)(B)). A party that receives records may use them "only for the purposes for which the disclosure was made" and may not pass them on without consent (34 C.F.R. § 99.33(a)).

Subpoenas. Before complying, the school generally must make "a reasonable effort to notify the parent or eligible student" so that person can seek protective action, with exceptions for certain law enforcement subpoenas and orders that direct non-disclosure (§ 99.31(a)(9)(ii)).

Transfers. When sending records to a new school, the school must make a reasonable attempt to notify the parent or eligible student unless the parent or student started the transfer or its annual notice says it forwards records on request. On request it must provide a copy of what it sent and an opportunity for a hearing (34 C.F.R. § 99.34).

Emergencies. If the school "determines that there is an articulable and significant threat to the health or safety of a student or other individuals," it may disclose information to anyone whose knowledge is necessary to protect them. If there was a rational basis for that determination when it was made, the Department "will not substitute its judgment" for the school's (34 C.F.R. § 99.36(c)). The school must record the threat and who received the information (§ 99.32(a)(5)).

Directory information and how to opt out

Directory information is information in an education record "that would not generally be considered harmful or an invasion of privacy if disclosed" (34 C.F.R. § 99.3). The regulation lists examples, including the student's name, address, telephone listing, email address, photograph, date and place of birth, major field of study, grade level, enrollment status, dates of attendance, participation in officially recognized activities and sports, weight and height of athletes, degrees, honors and awards, and the most recent school attended.

Each school chooses which of these it designates. Directory information never includes a Social Security number, and a student ID number can be included only in narrow conditions (§ 99.3).

Before disclosing directory information, the school must give public notice of the categories it has designated, the right to refuse, and the period within which a parent or eligible student must notify the school "in writing" (34 C.F.R. § 99.37(a)). The regulation sets no number of days; the school's notice does. An opt-out made while the student attends must be honored after the student leaves unless the student rescinds it (§ 99.37(b)).

An opt-out has limits. It cannot stop the school from disclosing or requiring a student to disclose the student's name, identifier or school email address in a class the student is enrolled in, or from requiring a student to wear or display a student ID badge (§ 99.37(c)). A school also may not disclose or confirm directory information without written consent when someone uses the student's Social Security number or other non-directory information to identify the student (§ 99.37(e)).

FERPA for college students and their parents

Once a student attends college, FERPA rights belong to the student at any age. Parents do not have an automatic right to see grades, disciplinary records or financial aid files.

A college may still share information with parents without the student's consent in three main situations (34 C.F.R. § 99.31):

• the student is the parents' dependent as defined in section 152 of the Internal Revenue Code (§ 99.31(a)(8));
• a health or safety emergency, where § 99.36(a) expressly names "parents of an eligible student" as possible recipients (§ 99.31(a)(10)); or
• the student is under 21 and the college has determined that the student committed a disciplinary violation involving alcohol or a controlled substance (§ 99.31(a)(15)).

These permit disclosure; they do not require it, and many colleges share less than they could. The common route for parents is a release signed by the student. Two limits apply only at colleges: a student need not be shown the parents' financial records, or confidential letters of recommendation the student waived the right to see (34 C.F.R. § 99.12(b)).

Special education records (IDEA)

For a child receiving special education, the Individuals with Disabilities Education Act adds a stricter timing rule. The agency must comply with a request to inspect records "without unnecessary delay and before any meeting regarding an IEP, or any hearing" or resolution session, "and in no case more than 45 days after the request has been made" (34 C.F.R. § 300.613(a)).

IDEA also gives parents the right to have a representative inspect and review the records, and to get copies where failing to provide them would effectively prevent inspection (§ 300.613(b)). Amendment requests follow the same pattern as FERPA, and the hearing must use FERPA's procedures in 34 C.F.R. § 99.22 (34 C.F.R. §§ 300.618-300.621).

If an IEP meeting is coming up, the practical point is that the school should give you access to the records before that meeting, even if 45 days have not passed.

What is a FERPA violation, and what can you do?

A FERPA violation is a failure by a covered school to follow the law or its regulations: for example, not giving access within 45 days, refusing a hearing on a correction request, or disclosing education records without consent when no exception applies. Whether a specific disclosure was a violation depends on the facts and the exceptions above.

The enforcement route is a complaint to the Department of Education's Student Privacy Policy Office (SPPO):

• Who may file. A parent or eligible student. Once rights transfer to the student, "parents generally may not file a complaint" (SPPO, File a Complaint).
• Deadline. A timely complaint is filed "within 180 days of the date of the alleged violation or of the date that the complainant knew or reasonably should have known of the alleged violation" (34 C.F.R. § 99.64(c)). The office may extend this for good cause.
• Content. The complaint must contain "specific allegations of fact giving reasonable cause to believe that a violation" occurred (§ 99.64(a)).
• How. SPPO provides a fillable complaint form that can be emailed to FERPA.Complaints@ed.gov or mailed to the Student Privacy Policy Office, 400 Maryland Ave SW, Washington, DC 20202-8520 (SPPO).
• Contact the school first? Encouraged but "not required" for a FERPA complaint (the PPRA process differs).

The Department's leverage is federal funding, but it seeks voluntary compliance first. Its 2018 enforcement notice says that "only in those instances where an educational agency or institution is unwilling or unable to come into voluntary compliance with the law and it is otherwise appropriate will the Department withhold federal funds" (Department of Education, Dec. 20, 2018).

FERPA does not give you a private lawsuit for a privacy breach. In Gonzaga University v. Doe (2002), the Supreme Court held that FERPA's nondisclosure provisions "create no rights enforceable under §1983." State laws, including state student-records statutes and privacy torts, are separate and may provide their own remedies.

FERPA vs. HIPAA: school health records

Most school health records are governed by FERPA, not HIPAA. HIPAA's definition of protected health information excludes information in education records covered by FERPA and the treatment records described in 20 U.S.C. § 1232g(a)(4)(B)(iv) (45 C.F.R. § 160.103).

The Student Privacy Policy Office puts it directly: "Student health records that constitute education records or treatment records under FERPA are not protected under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule" (SPPO, Know Your Rights).

So a K-12 school nurse's records are typically education records you can request under FERPA. Records held by an outside doctor, hospital or clinic are a different matter: those fall under HIPAA, and releasing them to a school generally takes a HIPAA authorization (a limited exception covers proof of immunization that state law requires a school to have, with a parent's documented agreement), which our HIPAA authorization form generator can prepare.

PPRA: surveys, marketing and physical exams

The Protection of Pupil Rights Amendment (20 U.S.C. § 1232h) is a separate law often confused with FERPA. It says no student shall be required, as part of an applicable Department of Education program, to submit to a survey, analysis or evaluation that reveals information in eight protected areas without prior consent, and for a minor the parent's prior written consent:

• political affiliations or beliefs of the student or parent;
• mental or psychological problems of the student or family;
• sex behavior or attitudes;
• illegal, anti-social, self-incriminating or demeaning behavior;
• critical appraisals of close family members;
• legally recognized privileged relationships, such as with lawyers, physicians and ministers;
• religious practices, affiliations or beliefs; and
• income, other than as required to determine program eligibility.

The No Child Left Behind Act of 2001 (Pub. L. 107-110) amended PPRA to add subsection (c), which requires local school districts receiving funds under an applicable program to adopt policies, in consultation with parents, on matters such as parents' right to inspect third-party surveys before they are given. Districts must notify parents at least annually and offer an opt-out from activities involving the collection of student information for marketing or sale, surveys covering the protected areas, and certain nonemergency invasive physical examinations (20 U.S.C. § 1232h(c)). The Department notes that its PPRA regulations predate these amendments and some provisions are superseded (SPPO, PPRA).

State student-records and student privacy laws

FERPA sets a floor. States add to it in two different ways.

Records-access laws. Some states set shorter deadlines or firmer copy rights than FERPA. California requires school districts to grant access "no later than five business days following the date of the request" (Cal. Educ. Code § 49069.7(b)). Illinois requires access "in no case later than 10 business days" after the records custodian receives the request, which the district may extend by up to 5 business days for reasons the statute lists, and bars denying a copy for inability to pay (105 ILCS 10/5). The FERPA Request Letter Generator lists the rule we found for every state and uses the shorter clock where it applies.

Ed-tech and student data laws. Several states regulate the companies that run school apps and platforms directly, which FERPA does not:

• California (SOPIPA). The Student Online Personal Information Protection Act, Cal. Bus. & Prof. Code § 22584, bars operators of K-12 sites, services and apps from targeted advertising based on information acquired through the service, amassing a profile of a pupil except in furtherance of K-12 school purposes, and selling a pupil's information.
• New York (Education Law § 2-d). Section 2-d provides that personally identifiable information maintained by educational agencies, including data provided to third-party contractors, "shall not be sold or used for marketing purposes." It requires a parents' bill of rights for data privacy and security, creates a chief privacy officer at the State Education Department, and lets that officer bar a contractor that improperly releases student data from access for up to five years, with civil penalties.
• Colorado (Student Data Transparency and Security Act). Enacted by House Bill 16-1423 as C.R.S. 22-16-101 and following, it provides that a school service contract provider shall not sell student personally identifiable information, use or share it for targeted advertising to students, or use it to create a personal profile of a student other than for purposes the contracting school authorizes or with consent. The Colorado Department of Education summarizes these provider obligations.

Federal consumer protection law also reaches ed-tech companies. In May 2023 the Federal Trade Commission announced a proposed order against Edmodo under the Children's Online Privacy Protection Act that included provisions "prohibiting the company from using children's information for non-educational purposes such as advertising or building user profiles" and a $6 million penalty that was suspended due to inability to pay (FTC, May 22, 2023). For the federal children's privacy rule itself, see our COPPA compliance guide and children's online privacy laws by state.

The voluntary Student Privacy Pledge that many ed-tech companies once signed no longer operates: the Future of Privacy Forum retired it as of April 25, 2025 (FPF). For broader state consumer privacy rules, see our data privacy laws hub, including California and New York.

Recordings, IEP meetings and family law

FERPA does not say whether a parent may record an IEP meeting or a school conference; that turns on state recording-consent law and district policy. A recording the school keeps, such as a video or audio file directly related to a student, can itself be an education record, since FERPA's definition of a record includes video and audio tape (34 C.F.R. § 99.3).

For custody, child support and parental rights questions that often sit alongside school records disputes, see our United States child support laws hub, including California, New York, Colorado and Texas.

This article provides general legal information about FERPA and related federal and state student privacy laws as of October 2026. It is not legal advice. For advice about a specific situation, consult a lawyer licensed in your state.

Related news

• FTC finalizes order against Illuminate over student data breach

Frequently Asked Questions

What is FERPA?

FERPA is the Family Educational Rights and Privacy Act (20 U.S.C. 1232g), a federal law that gives parents the right to inspect their child's education records, ask the school to correct them, and control most disclosures of them. It applies to schools that receive funds under U.S. Department of Education programs. The rights pass to the student at 18 or on entering college.

What does FERPA stand for?

FERPA stands for the Family Educational Rights and Privacy Act. Congress added it in 1974, and the Department of Education's regulations are at 34 C.F.R. Part 99.

Who does FERPA apply to?

It applies to schools and education agencies that receive funds under a Department of Education program. That includes public K-12 schools and nearly every college, since federal student aid counts. Most private K-12 schools receive no such funds and are generally not covered, although state law may still give parents access rights.

What are my rights under FERPA?

A parent or eligible student may inspect and review the student's education records within 45 days of a request, ask the school to amend records that are inaccurate, misleading or in violation of privacy rights (with a hearing if the school refuses), and consent in writing before most disclosures. Schools must describe these rights in an annual notice.

How long does a school have to respond to a FERPA request?

A reasonable period of time, and no more than 45 days after it receives the request (34 C.F.R. 99.10(b)). Some states set a shorter deadline, such as five business days for California school districts and 10 business days in Illinois (extendable by up to 5 business days). For special education records, IDEA also requires access before any IEP meeting or due process hearing.

Does a school have to give me copies of records under FERPA?

Only when circumstances effectively prevent you from inspecting the records, such as living too far away (34 C.F.R. 99.10(d)). Otherwise the school can let you review them in person. It may charge for copies but not for searching for or retrieving records, and some state laws give a firmer right to copies.

What is a FERPA violation?

It is a covered school's failure to follow FERPA, such as not providing access within 45 days, refusing a hearing on a correction request, or disclosing education records without written consent when no exception applies. Complaints go to the Department of Education's Student Privacy Policy Office, generally within 180 days.

Can I sue a school for violating FERPA?

Not under FERPA itself. In Gonzaga University v. Doe (2002) the Supreme Court held that FERPA's nondisclosure provisions create no rights enforceable in a private lawsuit under 42 U.S.C. 1983. The remedy is a complaint to the Student Privacy Policy Office. State laws may provide separate claims.

What is a FERPA release form?

It is the signed and dated written consent a school needs before disclosing education records outside FERPA's exceptions. It must specify the records, state the purpose, and identify who may receive them (34 C.F.R. 99.30). College students often sign one so a parent can see grades or financial information.

Can parents see college grades under FERPA?

Not automatically. Once a student attends college the rights belong to the student. A college may share records with parents if the student is their tax dependent, in a health or safety emergency, or about an alcohol or drug violation by a student under 21, but it does not have to. Otherwise parents need the student's written consent.

What is directory information under FERPA?

It is information that would not generally be considered harmful if disclosed, such as a student's name, address, phone, email, photo, dates of attendance, grade level, activities and awards. A school may release the categories it designates about current students without consent only after public notice and a chance to opt out in writing; an opt-out made while the student attended must still be honored after the student leaves. It never includes a Social Security number.

How do I opt out of directory information?

Notify the school in writing within the period stated in its directory information notice. The opt-out then blocks release of the designated categories, but it cannot stop the school from using the student's name, identifier or school email inside a class, or from requiring a student ID badge.

Do divorced parents both have FERPA rights?

Yes, generally. A school must give full rights to either parent unless it has a court order, state statute or legally binding document that specifically revokes them (34 C.F.R. 99.4). A custody order that does not address school records does not remove a parent's FERPA rights.

Can FERPA be used to change a grade?

Generally no. The amendment process covers records that are inaccurate, misleading or violate privacy rights. Department guidance says it cannot be used to challenge a grade or evaluation unless it was recorded inaccurately. Use the school's grade appeal process to dispute the grade itself.

Are school nurse records covered by FERPA or HIPAA?

Health records a covered school maintains as education records, including K-12 school nurse records, are covered by FERPA and are excluded from the HIPAA Privacy Rule. Records held by an outside doctor or hospital fall under HIPAA.

Does FERPA apply to private schools?

Most private K-12 schools receive no Department of Education funds and are generally not subject to FERPA. Private colleges that take part in federal student aid programs are covered. Some state laws, such as California's, give parents access to records at private schools too.

Can a parent record an IEP meeting under FERPA?

FERPA does not address whether a parent may record an IEP meeting; state recording-consent law and district policy govern that. A recording the school keeps that is directly related to the student can itself be an education record subject to FERPA.