FERPA

No changes recorded yet — we are watching, and nothing has been published.

1. 2012-01-03 December 2011 FERPA amendments took effect
2. 2009-01-08 December 2008 FERPA amendments took effect

1. 2017-01-19
   34 CFR part 99 (as amended January 2017) AmendmentCurrent text

   Renamed the office given FERPA enforcement functions from the Family Policy Compliance Office to the Office of the Chief Privacy Officer. source

2. 2011-12-02
   FERPA final rule (December 2011) Amendment

   Amended part 99 to allow more effective use of student data, such as for evaluating education programs, while protecting privacy; effective 3 January 2012. source

3. 2009-01-06
   Correction of the December 2008 rule Errata

   Corrected the final regulation published on 9 December 2008 (73 FR 74806). source

4. 2008-12-09
   FERPA final rule (December 2008) Amendment

   Implemented USA PATRIOT Act and Campus Sex Crimes Prevention Act exceptions and two Supreme Court decisions, and clarified disclosures to contractors, parents and in emergencies; effective 8 January 2009. source

5. 2004-04-21
   FERPA final rule (April 2004) Amendment

   Set general guidelines for accepting signed and dated written consent in electronic form; effective 21 May 2004. source

Applies to schools, districts, colleges and education agencies that receive Department of Education funds; vendors are reached through the institution's disclosure rules.

Who

An educational agency or institution to which funds have been made available under any program administered by the Secretary of Education, including through students' Pell Grants or loans. source

Parents and students

Parents may inspect and seek to amend education records; when a student becomes an eligible student, those rights transfer to the student. source

Consent

Disclosure of personally identifiable information from education records generally needs prior written consent, unless an exception in 34 CFR 99.31 applies. source

Vendors as school officials

A contractor or other outside party may be treated as a school official if it performs an institutional function, is under the institution's direct control over the records and follows the redisclosure limits. source

Access controls

Institutions must use reasonable methods so that school officials reach only records in which they have a legitimate educational interest. source

Proposed changes

The 2026 Unified Agenda lists a proposed rule to clarify the definition of education record, disclosures to third parties including commercial vendors, and enforcement procedures. source

Compliance is checked through complaints and investigations by the Department of Education.

Complaints

The Department's office investigates, processes and reviews complaints and violations, and provides technical assistance on compliance. source

Annual notice

Each agency or institution must notify parents or eligible students of their rights under FERPA each year. source

Filing a complaint

Parents and eligible students may file a FERPA complaint through the Department's File a Complaint page. source

The Secretary can withhold payments, seek a cease-and-desist order or end funding eligibility, and third parties can be barred from records for at least five years.

Funding

If a recipient does not comply within the set period, the Secretary may withhold further payments under any applicable program or terminate eligibility to receive funding. source

Cease and desist

The Secretary may issue a complaint to compel compliance through a cease-and-desist order. source

Third-party bar

A third party found to have improperly redisclosed records may be denied access to personally identifiable information from education records for at least five years. source

1. Law text 34 CFR part 99 – Family Educational Rights and Privacy
2. Guidance FERPA regulations and amendment notices (Student Privacy Policy Office)
3. Guidance Unified Agenda entry RIN 1875-AA15 (FERPA rulemaking)
4. Law text FERPA final rule (2 December 2011)
5. Law text FERPA final rule (9 December 2008)

1. COPPA Rule

   COPPA governs online services collecting data from children under 13; FERPA governs education records held by funded schools and the vendors acting as their school officials.

2. HIPAA

   HIPAA covers health information held by covered entities; FERPA covers education records held by schools and agencies that receive Department of Education funds.

3. FIPPs

   The Fair Information Practice Principles are general privacy principles; FERPA sets binding access, consent and disclosure rules for education records.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to FERPA (RSS)