Last Checked: October 5, 2026Next Check: September 1, 2028
- studentprivacy.ed.govcited ×1516 reviewed
- reginfo.govcited ×1
- law.cornell.educited ×36
- everycrsreport.comcited ×1
Last updated 2 weeks ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.
Paying a college bill does not give a parent the student’s privacy rights. At college, the Family Educational Rights and Privacy Act (FERPA) puts those rights in the student’s hands, regardless of age.
A college can still share records with parents who claim the student as a tax dependent. A student can inspect records, challenge errors and choose voluntary disclosures, but cannot block every release the law permits.
Who controls college records
FERPA applies to schools receiving funding under an Education Department program, including private colleges that receive federal student aid. The department’s Student Privacy Policy Office administers the law.
Rights transfer from parents to a student at age 18 or upon attending a college at any age, making that person an eligible student.
Eligible students have rights to inspect their education records, seek corrections, consent to disclosures subject to exceptions, and file a federal complaint. A school’s annual FERPA notice must explain access and correction procedures and its criteria for deciding which school officials have a legitimate educational interest, the standard that lets them receive records without the student’s consent. Generally, a school official has a legitimate educational interest when reviewing the record is necessary to fulfill a professional responsibility. Start with that notice when deciding which campus office should receive a request.
For students under 18 enrolled in both high school and college, parents retain rights at the high school while the student holds rights at the college.
Which records FERPA protects
Education records directly relate to a student and are maintained by the school or someone acting on its behalf. Examples include grades, transcripts, course schedules, college financial information and discipline files, whether recorded electronically or in other media.
A professor’s notes fall outside this definition only when kept solely by their maker as a personal memory aid and not shared except with a temporary substitute. Ordinary records about a college employee that relate only to the job and are not available for any other use are excluded. But records of a job a student holds because of being a student are education records. Records created after a person leaves college are excluded when they do not relate directly to attendance there. Leaving college does not, by itself, turn an old transcript into an unprotected record.
Counseling and campus medical records
An eligible student’s health records can fall in a separate category, treatment records, which FERPA excludes from the definition of education records. These are records made by health professionals for the student, used only for treatment and disclosed only to treatment providers. Although FERPA does not require direct student access to treatment records, a physician or other appropriate professional chosen by the student may review them. A treatment record disclosed for any other purpose becomes an education record, subject to FERPA’s access and disclosure rules.
Student health records held by a FERPA-covered college, including treatment records, are excluded from the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. For a campus counseling record, ask the college whether it is a treatment record or an education record and how that affects access.
Seeing records and correcting errors
A school must provide access within a reasonable time, no more than 45 days after receiving the request. Make the request specific enough to identify the records, and keep evidence of when the school received it. When circumstances prevent effective inspection, the school must provide copies or make other arrangements, and it cannot destroy records while an access request is outstanding. Schools may charge for copies unless the fee effectively prevents access, but they cannot charge to search for or retrieve records.
A student does not have a right to see a parent’s financial records. The same goes for confidential recommendations for admission, employment or honors covered by a voluntary written waiver signed by the student. The school cannot require such a waiver as a condition of admission or receiving a service or benefit.
A student can request amendment of information believed inaccurate, misleading or in violation of privacy rights, and the school must decide within a reasonable period. FERPA’s correction right covers factual errors in a record, not substantive decisions such as a grade based on the student’s performance or a disciplinary decision, the Education Department says. So FERPA can be used to seek correction of a grade that was recorded wrongly, but not to contest the grade a professor decided to give. In the request, identify the inaccurate entry and the correction sought.
A denial must include notice of the right to a records-correction hearing. The hearing must occur within a reasonable time, with advance notice of its date, time and place. The student must have a fair opportunity to present evidence before a decision-maker without a direct interest and may use assistance or representation chosen at the student’s expense. The written decision must rest solely on hearing evidence and explain its reasons.
If the school declines to amend the record after the hearing, the student may add a statement of disagreement that stays with the contested part and accompanies its disclosure.
Choosing what parents can see
Consent must be signed and dated and specify the records, the purpose of disclosure and the parties or class of parties receiving them. Electronic consent is valid when it identifies and authenticates the student and indicates approval of the information it contains. Read the scope of a release before signing, especially whether it reaches only a requested record or a wider category. Agreeing to share a transcript does not mean agreeing to share every other kind of record.
A college may disclose records without student consent to either parent when either parent claims the student as a dependent under federal tax rules on the most recent income tax return. That dependency exception permits disclosure but does not require the college to provide it. Ask the college how it applies the exception rather than assuming dependency guarantees access or that refusing consent guarantees secrecy.
A college may also notify parents of an alcohol or controlled-substance violation when it has determined a disciplinary violation and the student is under 21 at disclosure, unless state law prohibits it.
Institutional access has limits
FERPA Checker
Answer up to six questions to see whether FERPA lets a school share a student’s record without consent, which exception applies, and who holds the right to consent. It covers the common rules, and each result names the exceptions that could change it.
How to answer this
The Education Department says FERPA covers public schools, school districts, and colleges and universities that get its money; private and religious elementary and secondary schools generally don’t get that money and aren’t covered. Education Dept.
FERPA applies to schools, colleges and education agencies that get money from any U.S. Education Department program, including money that arrives through students’ Pell Grants or federal student loans. 34 CFR 99.1(a)
A school isn’t covered just because its students get services, rather than money, from an Education Department program. 34 CFR 99.1(b)
How this checker works:
- The Education Department says FERPA covers public schools, school districts, and colleges and universities that get its money; private and religious elementary and secondary schools generally don’t get that money and aren’t covered. Education Dept.
- A school needs signed and dated written consent from the parent or the eligible student before it shares personally identifiable information from a student’s education records, unless an exception in the regulation applies. 34 CFR 99.30(a)
- A student becomes an “eligible student” on turning 18 or on attending a college or other school beyond high school, at any age. 34 CFR 99.3
- At that point the rights, including the right to consent, pass from the parents to the student. 34 CFR 99.5(a)(1)
- A school may share directory information only after giving public notice of which items it treats as directory information, the right to refuse, and the deadline to refuse in writing. 34 CFR 99.37(a)
- A school or school district may share records with its own teachers and other officials whom it has determined have a legitimate educational interest in them. 34 CFR 99.31(a)(1)(i)(A)
- A school may send records to officials of another school, school system or college where the student seeks or plans to enroll, or is already enrolled, for purposes related to the enrollment or transfer. The sending school must try to notify the parent or eligible student unless they started the request or the school’s annual notice says it forwards records, and on request it must give them a copy and a chance for a hearing. 34 CFR 99.31(a)(2)34 CFR 99.34(a)
- A school may share records to comply with a court order or a lawfully issued subpoena. First it must make a reasonable effort to warn the parent or eligible student so they can seek protective action, unless the order or subpoena is one of a few law enforcement or terrorism cases where a court or issuing agency ordered it kept secret. When a parent is a party to a court case about child abuse, neglect or dependency and the order comes from that case, the school doesn’t have to notify the parent first. 34 CFR 99.31(a)(9)(i)34 CFR 99.31(a)(9)(ii)U.S. Code
- In an emergency, a school may share information with appropriate parties, including the parents of an eligible student, if knowing it is necessary to protect the health or safety of the student or other people. The school must see an articulable and significant threat, and the Education Department won’t second-guess its decision if it had a rational basis at the time. The school must write down the threat and who received the information. 34 CFR 99.36(a)34 CFR 99.36(c)34 CFR 99.32(a)(5)
- If the student is a dependent of a parent under federal tax law (Section 152 of the Internal Revenue Code), a school may share records with the parents without the student’s consent, even after the student turns 18 or starts college; either parent may receive them. 34 CFR 99.31(a)(8)
School officials, including teachers, may receive records without consent when they have a legitimate educational interest, with reasonable methods limiting access to the relevant records. Working for the college is not itself a reason to browse any student’s file.
A contractor can qualify for this exception when it performs a service the school would otherwise assign to employees, stays under the school’s direct control in how it uses and maintains records, and meets the criteria in the school’s annual notice. It may use the records only for authorized purposes, and FERPA limits further disclosure. For a question about an outside platform, ask what school function it performs and how the school controls the records it receives.
Records may go to another school where the student seeks or intends to enroll, or is already enrolled, for purposes related to enrollment or transfer. The sending school must reasonably try to notify the student unless the student initiated the disclosure or the school’s annual notice announces that practice. The student may request a copy of the disclosed record and a records-correction hearing.
A college may also disclose records in connection with financial aid a student has applied for or received, when the information is necessary for purposes such as determining eligibility, amounts or conditions, or enforcing the aid’s terms.
Organizations conducting studies for a school may receive records to develop, validate or administer predictive tests, administer student aid or improve instruction. Only study representatives with legitimate interests may identify students, and a written agreement must define the study and permitted data use and require destruction when the information is no longer needed.
Accrediting organizations may receive records to carry out their accrediting functions. Authorized government representatives may receive records for audits or evaluations of federally or state-supported education programs, or enforcement of related federal legal requirements, subject to use, confidentiality and destruction protections.
As a general rule, a party that receives records may use them only for the purpose of the disclosure and may not pass them on without the student’s consent, subject to specified exceptions. Schools generally must retain a record of requests for and disclosures of personally identifiable information, which students may inspect, although exceptions include school-official and directory-information disclosures. Ask for that record to trace where information went, but its exceptions mean it will not show every access.
Directory information and campus safety
Directory information is information generally not considered harmful or an invasion of privacy if disclosed, and can include names, contact details, majors and dates of attendance. Before disclosing it, a school must give public notice of the categories it designates and a period for students to refuse any or all of those categories in writing. Check the school’s actual categories and opt-out deadline before assuming a particular contact detail will remain private.
A directory-information opt-out must continue after the student leaves unless rescinded, but it cannot block disclosure of the student’s name, identifier or institutional email address in a class in which the student is enrolled.
In a health or safety emergency, a school that finds an articulable and significant threat to a student or others may disclose records to any person who needs the information to protect them. The test is a concrete threat the school can describe, not merely information that is sensitive or worrying. The school must record the threat supporting an emergency disclosure and the parties who received the information.
Police records and disciplinary results
Records a campus law-enforcement unit creates and maintains for law-enforcement purposes are excluded, but education records do not lose FERPA protection simply because the unit receives copies.
A college may disclose final disciplinary results to the victim of an alleged crime of violence or nonforcible sex offense regardless of whether it found a violation. A nonforcible sex offense in this rule means statutory rape or incest. Disclosure to the public under the disciplinary-results exception requires a finding that the alleged perpetrator violated institutional rules, and identifying other students requires their consent. Final results for this purpose cover the student’s name, the violation and any sanction imposed.
Court orders and subpoenas can authorize disclosure. The college generally must first make a reasonable effort to notify the student, except for certain orders, such as a law enforcement subpoena that the court or issuing agency has ordered kept secret.
Responding to a privacy problem
The Student Privacy Policy Office accepts written complaints stating the specific facts supporting an alleged FERPA violation. Save the request, response and relevant notice, and identify the record and disclosure or access decision at issue. Contacting the college first is encouraged, but it is not required before filing a federal complaint. If the college relies on an exception, ask it to identify the exception and explain how the disclosure fits.
A complaint generally must be filed within 180 days of the violation or when the complainant knew or reasonably should have known about it, with extensions available for good cause. Talking with the college can help clarify its decision, but do not let that use up the filing period. The office provides a complaint form and accepts completed complaints by email at FERPA.Complaints@ed.gov.
When federal officials find noncompliance, their written findings can specify corrective steps and a reasonable period for voluntary compliance. If compliance does not follow, federal enforcement can include withholding payments, cease-and-desist proceedings or terminating eligibility for funding. FERPA does not create a private right to sue schools for violating it, according to the Congressional Research Service. A federal complaint can therefore push a college to comply, but it does not give the student a FERPA claim for money damages.
The Education Department’s 2026 regulatory agenda lists a planned FERPA proposal, numbered 1875-AA15, addressing definitions, disclosure provisions and complaint enforcement. As of October 3, 2026, the agenda listed the proposal at the proposed-rule stage, which does not mean a proposed or final rule has been published. Rely on the current rights and exceptions when making a request, and check a later rule’s status before treating a planned change as settled.
