Family Educational Rights and Privacy Act (FERPA)

What FERPA actually does for you

The Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) passed in 1974. In plain English: it controls what a school can publish about your kid without your written permission.

The part that matters for first responders is the directory-information rule. Schools can publish a list of "directory" details (a kid's name, address, phone, photo, sport, club, and dates of attendance) unless a parent opts out in writing. Once you opt out, the school can't release that information to anyone outside the school without coming back to you for consent.

A school is a second way in. If your home address is hard to find through broker sites, a school directory can supply it instead. Directory listings, yearbooks, and published sports rosters tie a child's name to a parent and an address. The FERPA opt-out closes the directory-listing part of that.

Who's covered

FERPA applies to any school that receives federal funding. That covers almost every public school, most private schools, and every public university and community college in the country. A small number of private schools that take zero federal funding fall outside it.

Coverage includes:

• K-12 public schools and districts
• Public colleges and universities
• Private schools that accept federal funding, which most do, even if indirectly
• Charter schools

The right belongs to the parent until the student turns 18 or starts college. After that, it transfers to the student. If you're protecting a college-age kid, they have to file the opt-out themselves.

How to file the opt-out

1. Find the directory-information opt-out form. Most districts publish it on the registrar's page or in the back-to-school packet. Search "[district name] FERPA directory information opt-out." If you can't find it online, ask for it by name at the front office.
2. Fill it out for every kid. Each child needs their own form. List every category you want withheld: name, address, phone, photo, email, dates of attendance, awards, and sports rosters. Don't leave categories unchecked unless you have a reason.
3. Sign and date it. Most districts prefer a wet signature. Some accept e-signature.
4. File it before the school year starts. Schools publish directory data fastest in the back-to-school push, so file in August.
5. Keep a copy. Photograph the signed form, note the date it was received, and record the name of the staff member who took it. If a directory disclosure happens later, that's your evidence.
6. Refile before each school year. Most districts treat the opt-out as expiring at the end of the year. If you don't refile, the kid is back in the directory the next fall.
7. Repeat at every school your kids attend. Elementary, middle, and high. District-run sports and after-school programs usually inherit the opt-out, but confirm it.

If your kid plays a school sport or competes in a regional academic event, separately ask the coach or program director to withhold the kid's name from any roster they publish online. The FERPA opt-out covers the school. It doesn't always reach a regional athletic conference's external website.

Enforcement reality

FERPA is enforced by the Student Privacy Policy Office at the U.S. Department of Education, the office that took over the work of the former Family Policy Compliance Office. The penalty on paper is severe: a school in violation can lose federal funding. In practice, the office almost never pulls funding. Enforcement is administrative.

You file a complaint, the office contacts the school, and the school takes the data down. That's the typical arc.

There is no private right of action. The Supreme Court closed the door on private FERPA suits in Gonzaga University v. Doe, 536 U.S. 273 (2002), holding that FERPA's nondisclosure provisions create no personal rights enforceable under 42 U.S.C. § 1983. Your only recourse for a violation is a complaint to the Department of Education. You cannot sue a school directly.

Where it falls short

FERPA is a useful tool, but it doesn't cover everything. The gaps:

• Yearbooks and rosters already published: an opt-out filed in August doesn't recall last year's yearbook. Anything already in circulation stays out there, and FERPA can't pull it back.
• External vendors: some schools share roster data with photo vendors, fundraising platforms, and class-ring companies. If the share happened before your opt-out, the vendor already has the data.
• Data brokers that scraped pre-opt-out: a broker that pulled your kid's name and your home address from a public school directory years ago still has the record. FERPA doesn't claw it back. That's a broker opt-out problem, not a FERPA one.
• Graduation programs and award announcements: some districts treat these as "performances" that fall outside the directory rules. Check your district's specific carve-outs.
• Social media posts by other parents: FERPA binds the school. It doesn't reach what other parents post online.

The right move is layered. File the FERPA opt-out at every school. Run the broker sweep on yourself and your spouse so the home address attached to the kid in old records gets pulled too. See /family-targeting for how attackers work family vectors.

What we do

We don't file FERPA opt-outs for you. It's a one-page form per school, and it has to come from the parent of record. What we do handle is the broker side: the home address that, paired with a school directory listing, points to where your family lives. Run a free scan to see what brokers are publishing about you today.