United States (federal) · statute
FERPA: what it requires, and the records to keep
FERPA bars schools from disclosing personally identifiable information from education records without parent or eligible-student consent unless an exception applies. Most school AI tools that touch student records depend on the 'school official' exception, which carries strict control and use limits for vendors.
01 / What it requires
What FERPA requires
Educational agencies and institutions that receive U.S. Department of Education funds, and outside parties that receive education records from them.
- 01Get written consent before disclosing personally identifiable information from education records, unless a listed exception applies.
- 02Treat an AI vendor as a 'school official' only if it performs an institutional function, under direct school control over use and maintenance of records.
- 03Limit vendors' use and redisclosure of records to the authorized purpose (34 CFR 99.33).
- 04Use reasonable methods so school officials, including vendors, access only records with a legitimate educational interest.
- 05Publish an annual notice of rights stating the criteria for who counts as a school official and legitimate educational interest.
02 / AI work
Where it touches AI work
AI tutors, grading tools and analytics platforms that receive student records usually rely on the school-official exception, so the school must keep direct control over how the vendor uses the data. A vendor reusing records for its own purposes, such as training general models, falls outside the authorized purpose unless consent or another exception covers it.
03 / Dates
The dates that matter
FERPA enacted
Gonzaga v. Doe: no private right to sue under FERPA
PTAC guidance on online educational services published
ED-DOJ agreement: DOJ helps review student privacy complaints
04 / Enforcement
Who enforces it
U.S. Department of Education Student Privacy Policy Office; the ultimate remedy is withholding federal funds after voluntary compliance fails. No private right of action (Gonzaga Univ. v. Doe, 2002).
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Vendor contracts with school-official, use-limit and deletion terms
- 02Annual FERPA notice defining school officials
- 03Record of disclosures kept under 34 CFR 99.32
- 04Access-control settings and data deletion confirmations from vendors
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Does FERPA let us put student records into an AI tutor?+
Only if a FERPA exception applies, usually the school-official exception. Under 34 CFR 99.31, a vendor counts as a school official only if it performs a service the school would otherwise use its own staff for, is under the school's direct control over how records are used and kept, and follows the use and redisclosure limits in 99.33. The school must also limit access to records with a legitimate educational interest. A vendor that uses the records to train its own models or for purposes outside its contract is likely outside that exception. Read the full answer
SOURCES
Go back to the source
Legal Information Institute (Cornell)
Legal Information Institute (Cornell)
U.S. Department of Education, Privacy Technical Assistance Center
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: FERPA vs HIPAA · FERPA vs Title VI · FERPA for education AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4