How to Write a FERPA Notice for a School or EdTech Platform

The Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99) requires every school, district, and postsecondary institution that receives federal education funding to notify parents and eligible students, each year, of the rights FERPA gives them over education records. Most schools have published some version of this notice for decades. What has changed is who else needs to understand it: EdTech platforms that host gradebooks, learning management data, or student rosters are now, functionally, extensions of the school’s record-keeping, and the notice has to account for that relationship or it stops matching what actually happens to student data.

Who Has to Publish This Notice, and Who Doesn’t

FERPA applies to any educational agency or institution that receives funding under a program administered by the U.S. Department of Education, which in practice covers essentially every public school district and the large majority of colleges and universities, public and private. A private K-12 school that accepts no federal funding is generally outside FERPA’s reach entirely, though many adopt equivalent policies voluntarily or because state law requires something similar.

The annual notification requirement itself sits at 34 CFR § 99.7: a covered institution must notify parents of currently enrolled students (in K-12) or eligible students directly (once a student turns 18 or enrolls in a postsecondary institution, the rights transfer from the parent to the student) of their FERPA rights each year, by whatever means the institution normally uses to reach that population, a mailed notice, a student handbook, a posted page on the school’s website, or a combination. There is no single mandated format. What matters is that the notice actually reaches the covered population annually and covers the substance the regulation requires.

EdTech vendors themselves are not directly regulated by FERPA the way a school is. A vendor does not publish its own “FERPA annual notice” the way a school does. What a vendor needs instead is a data privacy policy that acknowledges its role as a school official under FERPA and describes, accurately, how it handles the student records the school shares with it, plus contract terms with each school that satisfy the conditions FERPA sets for that role. That distinction trips up a lot of first-time EdTech privacy documentation: the annual notice is the school’s document, but the vendor’s own privacy policy has to be consistent with what the school’s notice promises.

The Four Rights Every Notice Has to Cover

A FERPA annual notice is built around four rights defined in 34 CFR Part 99, and skipping any one of them is the most common way a notice ends up incomplete.

The right to inspect and review education records (34 CFR § 99.10) lets a parent or eligible student request to see the records the institution maintains, and the institution must comply within 45 days of the request, the maximum period the regulation allows before response is due. The right to request amendment (34 CFR § 99.20) lets them challenge a record they believe is inaccurate or misleading, and if the institution declines to amend it, the student is entitled to a formal hearing on the dispute. The right to consent before disclosure (34 CFR § 99.30) is the default rule the rest of the regulation carves exceptions out of: personally identifiable information from education records cannot go to a third party without written consent unless a specific FERPA exception applies. The right to file a complaint lets a parent or student report an alleged FERPA violation directly to the U.S. Department of Education’s Student Privacy Policy Office, the current name for the office that handles these complaints (long referred to as the Family Policy Compliance Office in older FERPA guidance and still the name many notices use).

The School Official Exception, and Why It Is the One EdTech Vendors Live Under

Most disclosures a school makes to an EdTech vendor rely on a single exception: the school official exception at 34 CFR § 99.31(a)(1). It lets a school share education records with a contractor, consultant, or vendor without separate consent, provided four conditions are met. The vendor has to be performing an institutional service or function the school would otherwise use its own employees to perform. The school has to retain direct control over how the vendor uses and maintains the records. The vendor is subject to the same use and redisclosure limits that apply to a school official, meaning it cannot use the data for its own purposes (advertising, product development unrelated to the contracted service, resale) beyond what the contract permits. And the school has to have defined “legitimate educational interest” in its own annual notice or policy, specific enough that a vendor’s access is a documented application of that definition rather than a blanket exception invoked after the fact.

None of that happens automatically because a vendor signs a general commercial contract. It requires the school’s contract with the vendor to actually recite these terms, control over the data, no unauthorized use, deletion or return of records at the end of the relationship, which is why many districts now default to a signed data privacy agreement modeled on the National Data Privacy Agreement maintained by the Student Data Privacy Consortium, or a state-specific template where one exists, rather than negotiating vendor terms from scratch for each new tool. A growing number of states also layer additional student data privacy statutes on top of FERPA (California’s Student Online Personal Information Protection Act is the most cited model), which restrict targeted advertising to students and commercial use of student data regardless of what the FERPA school official exception would otherwise permit. A vendor’s own privacy policy needs to reflect both layers, not just FERPA, and our Privacy Policy vs Terms and Conditions guide covers how that policy differs from the platform’s terms of service if the two documents still need separating out.

Directory Information: What Can Be Disclosed Without Consent

Directory information is the one category of education records FERPA allows an institution to disclose without consent by default, provided the institution has designated it as directory information in its annual notice and given parents or eligible students a real opportunity to opt out. 34 CFR § 99.3 lists what can be designated: name, address, telephone listing, email address, photograph, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of athletic team members, dates of attendance, grade level, enrollment status, degrees and awards received, and the most recent school attended. A student ID number can only be designated as directory information if it cannot, by itself, be used to gain access to education records without an additional authentication factor like a PIN or password. A Social Security number can never be designated as directory information under any circumstance.

The notice has to state, specifically, which of these fields the institution has actually designated (not just cite the regulation’s full list as if every field were in play) and give a clear opt-out procedure and deadline, commonly a written request submitted to the registrar’s office within the first week or two of the academic term. An institution that skips the opt-out mechanism, or buries it without a real deadline, has not satisfied the directory information exception even if every other part of the notice is accurate, because the exception depends on parents and eligible students having had a genuine chance to decline before disclosure starts.

Putting the Notice Together

A complete annual notice, in the order most institutions use, states the four core rights, lists the disclosure exceptions that apply without consent (the school official exception chief among them for institutions using EdTech tools), specifies which fields are designated directory information along with the opt-out process, and closes with a named contact, usually the registrar’s office, for exercising any of these rights. Institutions that also use online records portals typically add a short section pointing students to that portal directly, since it is often the fastest way for them to actually exercise the inspection right without a formal written request.

If you are drafting this notice for the first time, or updating one that has not kept pace with a new EdTech vendor relationship, our FERPA Notice generator builds the full annual notification, rights, exceptions, directory information designation, and registrar contact, from a short set of questions about your institution rather than starting from a template that assumes every school’s vendor relationships and directory information choices look the same. If the institution is also negotiating data terms with a specific vendor rather than publishing the public-facing notice, Do You Need a Data Processing Agreement covers the contract-level document that sits alongside FERPA compliance for that relationship.