EdLaw
Family Educational Rights and Privacy Act (FERPA)
US federal law (the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. §1232g) protecting the privacy of students' education records, implemented by regulations at 34 CFR Part 99. It applies to educational agencies and institutions that receive funds from the US Department of Education (§99.1) — effectively all US public K-12 schools and districts. Administered and enforced by the Department of Education as a funding condition.
Applicability to EdTech
FERPA binds the school, not the vendor — but vendors receive education records under the school-official exception (§99.31(a)(1)): an outside party may be treated as a school official only if it performs an institutional service the school would otherwise use employees for, is under the direct control of the school with respect to use and maintenance of the records, and uses them only as directed. The school must use "reasonable methods" to limit access. Redisclosure is restricted by §99.33. This is the mechanism US districts invoke when contracting EdTech, and the source of the "authorized educational purposes and under the district's direct control" language in district RFIs.
Part 99 contains no express security section; the Department of Education interprets FERPA's prohibition on unauthorised release as requiring reasonable protective methods, and publishes vendor-contract guidance through its Privacy Technical Assistance Center (see studentprivacy.ed.gov).
Contents
| Document | Covers |
|---|---|
| SCOPE-AND-DEFINITIONS.md | 34 CFR §§99.1–99.3 — applicability and definitions (education records, PII, disclosure) |
| DISCLOSURES.md | 34 CFR §§99.30–99.33, 99.35 — consent, the §99.31 exceptions (school official), recordkeeping, redisclosure, audit/evaluation |
Scope note: the statute (20 U.S.C. §1232g) is linked rather than reproduced; the regulations carry the operational detail and are reproduced verbatim from the eCFR.
Related
- COPPA — companion federal regime for under-13 data collected online by operators
- CIPA — companion federal regime for content filtering on school networks
Sources
- eCFR — 34 CFR Part 99 (FERPA regulations), current text
- 20 U.S.C. §1232g (FERPA statute)
- US Department of Education — Protecting Student Privacy (studentprivacy.ed.gov)
Meta
Built and re-verified mechanically — see tools/ecfr: build_us_regs.py regenerates the fact documents from the current eCFR text; build_us_regs.py verify confirms every source paragraph appears verbatim. Do not hand-edit regulation text.