FERPA

Overview

FERPA protects the privacy of student education records at institutions receiving federal funding. Written consent is required before disclosing personally identifiable information from education records. The sole enforcement remedy, withdrawal of all federal education funding, is so severe it has never been imposed.

What This Means for Your Website

• Written consent from parents or eligible students is required before disclosing education records
• Directory information may be disclosed but only with prior opt-out notice
• Rights transfer from parents to students at age 18 or upon postsecondary enrollment
• No private right of action exists: individuals cannot sue under FERPA
• Cookie-based tracking that collects education record information requires consent

Key Requirements

The FPCO (Family Policy Compliance Office) enforces FERPA through the DOE. There are no monetary fines. The sole enforcement mechanism is withdrawal of all federal education funding. This nuclear-option penalty has never been imposed, but the threat ensures institutional compliance. Educational institutions must provide annual notification of rights.

How ConsentStack Handles This

ConsentStack supports education websites by managing consent for data collection that may involve education records, ensuring that personally identifiable information is not disclosed without proper authorization.