Family Educational Rights and Privacy Act (FERPA)

What FERPA actually does for you

The Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) was passed in 1974. In plain English: it controls what schools can publish about your kid without your written permission.

The piece that matters for first responders is the directory-information rule. Schools are allowed to publish a list of "directory" details, the kid's name, address, phone, photo, sport, club, dates of attendance, unless a parent opts out in writing. Once you opt out, the school can't release that information to anyone outside the school without coming back to you for consent.

Your kid's school is a target vector. Attackers who can't find your home through broker sites will pivot to the school. They'll pull yearbooks. They'll scrape sports rosters and graduation lists. They'll call the front office posing as a relative. The FERPA opt-out shuts the easiest of those down.

Who's covered

FERPA applies to any school that gets federal funding. That's almost every public school, most private schools, and every public university and community college in the country. A small number of private schools that take zero federal funding fall outside, rare.

Coverage extends to:

• K-12 public schools and districts
• Public colleges and universities
• Private schools that accept federal funding (most do, even if indirectly)
• Charter schools

The right belongs to the parent until the student turns 18 or starts college. After that, the right transfers to the student. If you're protecting a college-age kid, you'll need them to file the opt-out themselves.

How to actually invoke it

Step by step. This takes about twenty minutes per school.

1. Find the directory-info opt-out form. Most districts publish it on the registrar's page or in the back-to-school packet. Search "[district name] FERPA directory information opt-out." If you can't find it online, walk into the front office and ask for it by name.
2. Fill it out for every kid. Each child needs their own form. List every category you want withheld: name, address, phone, photo, email, dates of attendance, awards, sports rosters, the works. Don't leave categories unchecked unless you have a reason.
3. Sign and date. Wet signature is preferred at most districts. Some accept e-signature.
4. File it before the school year starts. Schools publish directory data fastest in September, with the back-to-school photo and roster push. File in August.
5. Keep a copy. Photo of the signed form, the date it was received, the name of the staff member who took it. If a directory disclosure happens later, that's your evidence.
6. Renew every August. Most districts treat the opt-out as expiring at the end of each school year. If you don't refile, the kid is back in the directory next September.
7. Repeat at every school in the district your kids attend. Elementary, middle, high. Sports clubs and after-school programs run by the district usually inherit the opt-out, but check.

If your kid plays a school sport or is in a regional academic competition, separately ask the coach or program director to flag the kid's name in any roster they publish online. The FERPA opt-out covers the school. It doesn't always reach a regional athletic conference's external website.

Enforcement reality

FERPA is enforced by the Family Policy Compliance Office at the U.S. Department of Education. The penalty on paper is dramatic: a school in violation can lose federal funding. In practice, the office almost never pulls funding. Enforcement is administrative.

You file a complaint. The office contacts the school. The school takes the data down. That's the typical arc.

There is no private right of action. The Supreme Court closed the door on private FERPA suits in Gonzaga University v. Doe, 536 U.S. 273 (2002), holding that FERPA's nondisclosure provisions create no personal rights enforceable under 42 U.S.C. § 1983. Your only recourse for a FERPA violation is a complaint to the Department of Education's Family Policy Compliance Office. You cannot sue a school directly.

Where it falls short

FERPA is a useful tool. It is not a complete tool. The gaps:

• Yearbooks and rosters already published. A FERPA opt-out filed in August doesn't recall last year's yearbook. Old photos and rosters that already went into circulation are gone.
• External vendors. Some schools share roster data with photo vendors, fundraising platforms, and class-ring companies. If the share happened before your opt-out, the data is already off-network.
• Data brokers that scraped pre-opt-out. Brokers that pulled your kid's name and your home address from a public school directory five years ago still have the record. FERPA doesn't claw it back. That's a broker opt-out problem, not a FERPA one.
• Graduation programs and award announcements. Some districts treat these as "performances" that fall outside directory rules. Check your district's specific carve-outs.
• Social media posts by other parents. FERPA binds the school. It does not bind the soccer-mom Facebook group.

The right move is layered. File the FERPA opt-out at every school. Run the broker sweep on yourself and your spouse so the home address attached to the kid in old records gets pulled. See /family-targeting for the full attacker playbook on family vectors.

What we do

We don't file FERPA opt-outs for you. That's a one-page form per school, and it has to come from the parent of record. We do clear the broker side, the home address that, paired with school directory data, becomes a knock at the door. Run a free scan to see what brokers are publishing about you today.