Privacy Impacts of the Federal Parent Bill of Rights

March 16, 2023

PIPC supports the technical work of AASA's Student and Child Privacy Center. AASA has established policy priorities specific to student and child data and privacy. This analysis is informational, and any AASA advocacy positions or nuance are available on the AASA website. 

In just over a week, the Parents Bill of Rights Act(PBOR) - a bill intended to give parents more control over their child’s education - was reintroduced, marked up, and passed out of the House Education and Workforce Committee. It will be voted on by the full House next week, and is expected to pass. News coverage (including press releases from Congressional members) has largely focused on several parental rights and related school requirements identified in the  Education and Workforce Committee's PBOR Fact Sheet and the potential negative impacts that PBOR may have on LGBTQ students. Many people would be surprised to learn that the Parent Bill of Rights primarily amends the two major federal student privacy laws - the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA).

This isn’t to say that amendments to FERPA and PPRA aren’t necessary; they absolutely are. However, as currently written, this bill is likely to hurt students’ educational opportunities, be ineffective at addressing the student mental health crisis, and massively upend the basic functionality of schools. This includes:

  • Giving parents the right to object to their child using any education technology;
  • Allowing parents to opt-out of their child’s data being collected, used, and shared for legitimate educational purposes;
  • Requiring parents to opt-in to surveys or assessments regarding 8 protected categories of information, and to any medical exams (unless there’s an emergency), with no provisions made for students who may need help and can’t get a signed permission slip; and
  • Requiring schools to report the gender identity of trans kids to their parents with no exceptions - even if they know the child will be abused as a result of that disclosure.

Here’s some background information on student privacy law and how PBOR may change the status quo:

Curious how PBOR fits into existing law? Check out our redline (last updated 3/16/2023) here. 

FERPA 101

FERPA, passed in 1974, provides two major rights to parents and students:

  • Access, by guaranteeing parents (and eligible students) access to their child’s educational records; and
  • Privacy, by restricting unauthorized disclosure of educational records without consent or very specific safeguards.

The Department of Education (USED) has created a plethora of helpful resources to help schools apply FERPA in the digital age. However, that information is scattered and can be hard for schools to find (though USED has put much of it on their privacy website and can be contacted–and will quickly respond–if someone has questions). But finding the information is just the first step - once a school finds the relevant sections of statute, regulation, guidance, and other sources of law, it must be able to interpret the relevant sections. Applying FERPA is even harder; the multitude of situations where privacy arises in the day-to-day operations of schools often don’t have clear FERPA answers, especially when newer technology is involved.

FERPA Amendments

The first PBOR clause amending FERPA requires schools to notify parents about what technology is used “in the classroom for purposes of educating the student” and let parents object to it being used for their child. Under FERPA, schools are permitted to consent on behalf of parents–assuming specific privacy safeguards are in place–to enable nearly every aspect of tech-supported education, from keeping attendance records to grading exams. PBOR could potentially reverse the decades-long practice of schools consenting to educational technology use on behalf of parents, forcing schools to contact every parent, every time the school wants to use edtech– an issue that education stakeholders have flagged before.

It is not clear what the right to object means. Can the parent opt their child out? Will schools be required to have a formal process to handle objections? Any student whose parents have objected would likely be unable to use edtech. Teachers may have to choose between creating and implementing multiple lesson plans for the same classroom or not using edtech at all. This change would leave teachers not only ill-equipped to teach in a modern environment, but also coping with post-pandemic challenges like learning loss with resources of the 1980’s.

It is important to protect the ability of schools to use technology as core curriculum–the digital equivalent of a textbook–without permitting opt-outs. This is not to say that additional parental rights shouldn’t be created in FERPA, including the ability to opt-out in certain circumstances. Requiring that students use extraneous technology that doesn’t add proven educational value (such as heart monitors to measure a student’s “effort” in gym class) can pose a risk to their privacy and to the trust between families and schools. Rather than letting parents object to all educational technology being used with their children, a better change to FERPA may be ensuring that educational technology is not subject to parental consent requirements when it is used as core curriculum or for underlying school administration while permitting parents to opt out of technology that is an add-on (for example, the digital equivalent of field trips or supplementary study guides).

But it’s not all bad news; PBOR includes some positive (though duplicative) protections:

  • “No educational agency or authorized representative of such agency may sell student information for commercial or financial gain” (already legally restricted by FERPA), with the exception of “products sold to students by or on behalf of the educational agency or institution, such as yearbooks, prom tickets, and school pictures;”
  • Schools must engage meaningfully with parents when they develop a privacy policy or procedure (a new provision that has long been considered best practice); and
  • Requiring schools to provide parents, upon request, with information about who their child’s data is being shared with (this is already required under FERPA in most cases, but expanding this is, again, a best practice).

However, these beneficial aspects are outweighed by the potential (and likely) negative consequences for schools. FERPA needs to be updated to better protect students' privacy; sadly, PBOR is not the answer.

PPRA: What’s That Law Again?

The Protection of Pupil Rights Amendment (PPRA) aims to protect students’ privacy by allowing parents to limit the personal information schools can collect from students. Many people know PPRA as the law that governs parental notification and opt in or opt out requirements when surveys are administered to students. These requirements differ based upon whether local education agencies require students to participate in the survey and whether student answers may reveal sensitive information. For more information on PPRA requirements, we recommend checking out this blog.

But there are other aspects of PPRA that most people don’t know about, including a blanket right for parents to inspect instructional materials upon request. PPRA requires that parents must also be notified and given an opportunity to opt-out when:

  • Personal information from students is collected, used, or shared for marketing or selling that information;
  • The school plans to administer a non-emergency, invasive physical examination or screening.

PPRA's 8 Protected Categories

  • Political affiliations of the student or the parent
  • Mental or psychological problems of the student or the student’s family
  • Sex behaviors or attitudes
  • Illegal, anti-social, self-incriminating, or demeaning behavior
  • Critical appraisals of other individuals with whom respondents have close family relationships
  • Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers
  • Religious practices, affiliations, or beliefs of the student or the student’s parent
  • Income (except as required to determine eligibility for participating in a program where they’d receive financial assistance)
PPRA Amendments

PBOR amends PPRA in multiple ways, including an easily overlooked provision that gives parents the ability to opt out of the collection, use, and sharing of personal information collected from their child for “legitimate educational purpose[s] to improve the education of students” - a change that may unintentionally prevent teachers from accessing student data needed to improve the quality of instruction. Allowing parents to opt-out of schools using student information for legitimate educational purposes may have serious impacts on student success, potentially leaving students “to navigate in the dark” when making pivotal decisions where educational data could shed light on paths forward.

Another major change is that PBOR would require schools to obtain specific, written consent from parents every time before requiring students to take a survey regarding 8 protected categories of information. PPRA currently requires schools to annually notify parents of relevant policies and approximate dates that sensitive surveys will be administered. But, PBOR would require schools to get written consent “provided specifically for such survey" - meaning schools may have to contact parents to ask permission individually each and every time before requiring students to take surveys related to the 8 protected categories. This would significantly increase the amount of parental correspondence and potentially amplify the many barriers to affirmative parental consent, such as language barriers. Schools use surveys for various purposes such as understanding and addressing students emotional health, gauging career interests, and assessing school quality. If schools are unable to receive broad parental opt-in to these surveys, schools may no longer be able to collect responses from a representative sample of students and lose the benefits of conducting surveys for these purposes.

As noted above, PPRA requires schools to notify parents before they conduct an “invasive physical examination or screening” and give parents the opportunity to opt-out. PBOR would change this to requiring schools to notify and receive parental opt-in before administering non-emergency “medical examinations or screenings” - defined as including any “mental health or substance use disorder screening.” It is a good idea to make some changes to this part of PPRA - for example, changing "physical" to "medical" and giving parents the ability to opt-out would enhance privacy and trust between parents and schools. However, there is a big difference between an opt-out (which would be ideal) and an opt-in (what PBOR would require). Students whose parents are not engaged or are otherwise unavailable to provide opt-in consent wouldn’t be able to get the medical care they need, including mental health services.

Additionally, requiring opt-in for screenings could harm the very students who need help the most by making it more difficult for schools to identify when students need support. It is good for parents to know when schools administer non-emergency medical examinations or screenings to their children - and it could be an overstep if parents aren’t informed. However, requiring parental opt-in is inconsistent with the current widespread concerns about youth mental health and the likelihood that this may prevent students from receiving mental health services at school.

Perhaps even worse, PBOR would undermine evidence-based policymaking by not limiting this opt-in to surveys that collect personally identifiable information. This means that even de-identified or anonymized surveys may require parental opt-in, including the Youth Risk Behavior Survey–which does not collect any identifying information–that is used to monitor “health behaviors that contribute markedly to the leading causes of death, disability, and social problems among youth in the United States.” This restriction is particularly noteworthy in the context of last month’s Senate Judiciary Committee Hearing on child privacy, where multiple committee members cited the most recent Youth Risk Behavior Survey, which found “[p]oor mental health and suicidal thoughts and behaviors are increasing for nearly all groups of youth.” Schools are already required to notify parents and get their opt-in for any survey that involves the PPRA protected categories. This change would make it even harder for policymakers and local education agencies to identify and respond to emerging trends in negative student health behaviors–particularly since having an opt-in would likely result in schools collecting survey responses from an unrepresentative sample of students which would lead to inaccurate conclusions about the student population as a whole.

ESEA Amendments: Required Disclosures to Parents Do Not Have Exceptions for Students Experiencing Abuse at Home

In addition to amending FERPA and PPRA, PBOR also amends the Elementary and Secondary Education Act (ESEA) in a way that impacts student privacy rights. PBOR requires schools to disclose a variety of a child’s information to their parents, regardless of the dynamics of that relationship (for example if the parent is abusive and the child has a restraining order against them. Schools do not have a choice whether or not to disclose this information to parents, even if school administrators know a parent is highly likely to harm their child based on this information. As a result, students may be put in very dangerous situations. For example, schools may be required to notify parents and get parental opt-in before providing mental health counseling to students even if the counselor suspects the student may be subjected to abuse for seeking out those services. 

PBOR may have particularly harmful impacts on transgender youth who may experience abuse at home in response to their gender identity. In the 16-hour PBOR markup last week, the committee passed two amendments requiring parental notification and consent when schools affirm a child’s gender identity. Critics have explained how requirements like these can harm children and Representative Jayapal argued that  the requirement may endanger LGBTQ youth who may experience abuse at home if they are outed by school administrators: 

Please understand that outing a child to an unsupportive parent is cruel and reckless, and in some cases, it is deadly. One in 10 transgender kids who are out to their family experienced physical abuse from relatives because of who they are. And this amendment would force schools to endanger children. Trans youth with unaccepting families are often forced out of their homes and into the street. LGBTQ youth are more than twice as likely as their peers to be homeless with the primary factor behind this shocking statistic being family rejection, and in turn homelessness drastically exacerbates depression and anxiety and leads to increased rates of suicide.

To better protect children from potential abuse at home, PBOR should be carefully crafted in a way that accounts for and protects all children - not just the majority of children who have supportive parents. This idea was raised in the markup, with Representative Scott noting that “having a federal law that requires in all cases that the parents be informed may or may not be in the best interest of each and every child” and Representative Takano adding “Some parents are supportive and some parents may react in different ways. But we have to make laws that are wise and that account for all the possible circumstances.” To protect children who may experience abuse at home, PBOR should include an exception to required parental disclosures and notifications that accounts for situations where the school reasonably suspects that parents may subject their child to harm if they are informed of specific information.

PBOR’s amendments to FERPA and PPRA could majorly disrupt how schools operate by: limiting the use of edtech in schools, restricting access to student data for legitimate educational purposes, limiting the utility of survey data related to the 8 protected categories of information, and requiring parental opt-in for mental health services. Additionally, PBOR could force schools to put students in dangerous situations by not giving schools the discretion to withhold information from parents when students may experience abuse at home.

That being said, PBOR reiterates a lot of rights that parents already have under existing law and things that many schools already do. Rather than focusing on writing accepted best practices into law where they become unfunded mandates for schools, policymakers should have an open dialogue with education stakeholders to directly address student privacy laws’ flaws while not unintentionally harm the students these laws aim to protect. Student privacy laws need to be updated in a way that carefully balances child privacy and wellbeing concerns against parental rights. Unfortunately, PBOR falls short on protecting student privacy and wellbeing.

Recommended reading:
Relevant previously introduced bills: