FERPA for Ed-Tech Vendors: School Official Exception and Data Duties

FERPA compliance is a legal duty of US schools, districts and colleges, but ed-tech companies inherit it the moment a school shares student data with them. The Family Educational Rights and Privacy Act protects education records and generally requires consent before personally identifiable information from those records is disclosed. Schools can share data with vendors without consent only under specific exceptions, most often the "school official" exception, which comes with conditions on how the vendor uses, protects and rediscloses the data.

This guide explains what FERPA covers, who holds the rights, the exceptions that matter to vendors, what schools will put in contracts, how FERPA interacts with COPPA and state student privacy laws, and the product features that make an LMS or ed-tech platform easy for schools to approve.

What is FERPA?

FERPA is a federal law passed in 1974 (20 U.S.C. 1232g), with regulations in 34 CFR Part 99. It applies to educational agencies and institutions that receive funds under any program administered by the US Department of Education, which includes almost all public K-12 schools and districts and most colleges and universities, public and private.

Key definitions:

• Education records: records directly related to a student and maintained by the institution or by a party acting for it. This includes grades, transcripts, class lists, schedules, disciplinary records, special education records, and data in learning platforms and student information systems.
• Personally identifiable information (PII): the student's name, family members' names, address, personal identifiers such as student ID numbers, indirect identifiers such as date of birth, and other information that, alone or combined, would allow a reasonable person in the school community to identify the student.
• Eligible student: a student who has turned 18 or attends a postsecondary institution, to whom the rights transfer from parents.
• Directory information: information generally not considered harmful if disclosed, such as name, address, phone, email, photograph, dates of attendance and grade level, which the institution may designate and disclose unless the parent or eligible student opts out.

History and why FERPA was introduced

FERPA, sometimes called the Buckley Amendment after its sponsor, was passed in 1974 in response to concerns that schools kept secret records about students that families could not see, and shared them freely with outside parties. It established rights to inspect and correct records and limits on disclosure. Regulations have been updated several times, notably in 2008 and 2011, including clarifications on outsourcing to contractors and on data sharing for studies and audits.

With the shift to cloud-based learning platforms, the Department of Education published guidance on protecting student privacy when using online educational services, which is the most relevant guidance for vendors today.

Who is affected?

• Schools, districts, state education agencies and colleges receiving federal education funds, which bear legal responsibility.
• Vendors acting as school officials: LMS and student information system providers, assessment and tutoring platforms, communication apps, analytics and cloud service providers.
• Researchers and organisations receiving data under the studies or audit and evaluation exceptions.

FERPA does not apply directly to vendors, but if a vendor rediscloses or misuses data, the school can be found in violation and the Department can bar the vendor from receiving PII from that school for at least five years.

Key requirements

Rights of parents and eligible students

• Inspect and review education records within 45 days of a request.
• Request amendment of records believed to be inaccurate or misleading, with a right to a hearing.
• Consent to disclosures of PII, except where an exception applies.
• Opt out of directory information disclosure.
• File complaints with the Department of Education.

Consent and exceptions

Disclosure of PII from education records requires written consent unless an exception in 34 CFR 99.31 applies. The exceptions include disclosures to school officials with legitimate educational interests, to other schools where the student seeks to enrol, to authorised representatives for audits and evaluations, to organisations conducting studies for the institution, in health or safety emergencies, in compliance with subpoenas and court orders, and of directory information.

The school official exception

A contractor, consultant, volunteer or other outside party may be treated as a school official if it:

1. Performs an institutional service or function for which the school would otherwise use employees.
2. Is under the direct control of the school with respect to the use and maintenance of education records.
3. Uses education records only for the purposes for which the disclosure was made and does not redisclose PII without authorisation.
4. Meets the criteria in the school's annual notification of FERPA rights for who counts as a school official with a legitimate educational interest.

"Direct control" is usually established through a contract or terms of service that limit the vendor's use of data. The Department's guidance recommends that agreements address security, data collection, use, retention, deletion and disclosure, prohibit use for advertising and building profiles for non-educational purposes, and give the school rights to audit.

Record of disclosures and annual notice

Schools must keep a record of most disclosures and notify parents and eligible students annually of their FERPA rights, including the criteria for school officials.

Security

FERPA requires schools to use reasonable methods to ensure that school officials obtain access only to records in which they have legitimate educational interests. While FERPA does not prescribe technical controls, contracts and state laws commonly do.

Contracts schools will ask vendors to sign

Expect a data privacy agreement, often based on state templates or the Student Data Privacy Consortium's national data privacy agreement, covering:

• Data ownership remains with the school; the vendor acts under its direction.
• Use of data only to provide the contracted service; no sale, targeted advertising or profiling for non-educational purposes.
• No redisclosure without authorisation, including to sub-processors without notice.
• Security measures, breach notification timelines and incident cooperation.
• Return and deletion of data at the end of the contract or on request.
• Support for parent access and correction requests through the school.
• Audit and inspection rights.
• Compliance with state student privacy laws.

How vendors can comply, step by step

1. Confirm your role as a school official or other exception for each school customer.
2. Adopt a standard data privacy agreement that meets FERPA and common state requirements.
3. Restrict data use to providing the service; separate product analytics from student data and avoid advertising.
4. Implement role-based access so teachers see only their students and administrators only their school or district.
5. Support school workflows for parent access, correction and deletion requests.
6. Protect data: encryption, access controls, logging, secure development and incident response.
7. Manage sub-processors with contracts imposing equivalent restrictions.
8. Handle directory information carefully, honouring opt-outs the school provides.
9. Delete data on contract termination and document it.

De-identified data and analytics

Vendors often want to use student data to improve products or produce research. FERPA allows disclosure of de-identified information, but the bar is high: the school must reasonably determine that a student's identity is not personally identifiable, taking into account other reasonably available information. In small schools or classes, combinations of grade, demographics and scores can identify individuals even without names. Practical safeguards include aggregation thresholds (not reporting groups below a minimum size), removing or generalising indirect identifiers, separating any re-identification key from the analytics environment, and having the right to use de-identified data stated explicitly in the agreement with the school. Product telemetry that does not derive from education records, such as page load times, is easier to justify, but should still avoid student identifiers.

Documentation you will need

• Data privacy agreements with each school or district.
• Privacy policy written for schools and families.
• Data inventory and data flow diagrams.
• Security policies and evidence such as a SOC 2 report or ISO/IEC 27001 certificate.
• Sub-processor list and agreements.
• Records of data deletion at contract end.
• Incident response plan and breach notification templates.

Enforcement

The Department of Education's Student Privacy Policy Office investigates complaints and can require corrective action. The ultimate statutory sanction is withdrawal of federal funds from the institution, which has not been used in practice; enforcement focuses on voluntary compliance. If a third party improperly rediscloses PII, the institution may not allow that party access to PII for at least five years. The Supreme Court held in Gonzaga University v. Doe (2002) that FERPA does not create a private right to sue, but state student privacy laws may provide additional enforcement, and the FTC can act against vendors for unfair or deceptive practices.

Timeline and cost considerations

FERPA has applied for decades, and schools increasingly check vendors before procurement. Costs for vendors include legal review of agreements, engineering for access control, deletion and parent request support, security programmes and assurance reports, and administrative work to manage many district agreements.

Benefits and consequences

Vendors that make FERPA compliance easy, with clear agreements, strong access control and transparent data practices, move faster through district procurement. Failures can lead to contract termination, exclusion from districts, state enforcement and reputational harm, especially after breaches of student data.

Common mistakes and challenges for IT companies

• Using student data to improve unrelated products or for marketing without authorisation.
• Broad access where any teacher can see all students.
• Sub-processors not disclosed to schools.
• No deletion process at the end of contracts.
• Treating de-identified data carelessly, so it can be re-identified within small school communities.
• Ignoring state laws that add stricter requirements than FERPA.

Best practices, tools and technologies

• Integrate with school identity systems through SSO and rostering standards such as OneRoster.
• Scope permissions by district, school, class and role.
• Provide district administrators with export and deletion tools.
• Log access to student records and make logs available to schools.
• Publish a clear, school-friendly privacy policy and sub-processor list.
• Obtain SOC 2 or ISO/IEC 27001 to answer security questions efficiently.

We build learning platforms with role-based access, rostering integrations and district data controls, based on our education sector experience.

FERPA vs COPPA

	FERPA	COPPA
Protects	Education records of students at funded institutions	Personal information collected online from children under 13
Applies to	Schools, districts and colleges (vendors through contracts)	Operators of online services directed to children or with actual knowledge
Enforced by	US Department of Education	Federal Trade Commission and state attorneys general
Consent	Parents or eligible students, with exceptions	Verifiable parental consent; schools may authorise for educational purposes in limited cases

Ed-tech products used by children under 13 in schools often need to address both.

How FERPA relates to other laws

Law	Relationship
COPPA	Applies to online services collecting from children under 13; overlaps in ed-tech.
State laws	Many states have student data privacy laws restricting vendors directly.
CCPA/CPRA	May apply to vendors' non-FERPA data about California residents.
SOC 2	Common evidence of vendor security controls for districts.

Real-world implementation examples

Many US states and districts use standard student data privacy agreements through the Student Data Privacy Consortium, and vendors sign them across multiple districts. Breaches at ed-tech vendors have led districts to review contracts, demand deletion of historical data and require stronger security evidence.

An illustrative case for an LMS vendor entering the US K-12 market: it adopts the national data privacy agreement template, limits data use to providing the service, removes third-party marketing pixels from student-facing pages, adds teacher and class scoping to permissions, builds a district data export and deletion tool, and publishes its sub-processor list. District procurement reviews that previously took months are shortened.

Next steps

1. Confirm your role under the school official exception.
2. Adopt a standard data privacy agreement and privacy policy.
3. Tighten access control, logging and deletion in the product.
4. Review sub-processors and analytics tools.
5. Check state student privacy laws where you operate.

Frequently asked questions

Does FERPA apply to ed-tech companies?

Not directly. It applies to schools, but vendors receiving student data under the school official exception must meet its conditions through contracts.

What is the school official exception?

An exception allowing schools to share education records without consent with parties performing institutional functions under the school's direct control, who use data only for authorised purposes and do not redisclose it.

What counts as an education record?

Records directly related to a student and maintained by the institution or a party acting for it, including data stored in learning platforms and student information systems.

Can vendors use student data for product improvement?

Only within what the agreement with the school allows and for the educational purpose of the service. Use for advertising or unrelated products is generally not permitted.

Who enforces FERPA?

The US Department of Education's Student Privacy Policy Office.

Can parents sue under FERPA?

No. The Supreme Court held that FERPA does not create a private right of action, though state laws may.

What is directory information?

Information a school designates as generally not harmful to disclose, such as name and grade level, which can be shared unless parents or eligible students opt out.

How is FERPA different from COPPA?

FERPA protects education records held by funded institutions; COPPA protects personal information collected online from children under 13 by operators.

Does FERPA apply to colleges?

Yes, to colleges and universities receiving federal education funds. Rights belong to the students themselves.

Does FERPA apply to non-US vendors?

FERPA binds the US school, so a vendor anywhere that receives education records under the school official exception must meet the same contractual conditions on use, redisclosure, security and deletion.

Do we need to delete student data?

Contracts typically require return or deletion at the end of the service or on request, and good practice is to document deletion.