Understanding FERPA's Enforcement Process
January 30, 2026
Katherine Kalpos, Morgan Sexton, and Amelia Vance
CC BY-NC 4.0
On January 28, 2026, the U.S. Department of Education (USED) announced that it has found the California Department of Education (CDE) in violation of FERPA "for policies that pressure school officials to conceal information about students' 'gender identity.'" As far as PIPC is aware, this is the first time USED has issued a written notice of findings that has progressed to this stage in the FERPA enforcement process—making this an appropriate moment to explain what could come next.
Where We Are in the FERPA Enforcement Process
PIPC previously shared the below infographic demonstrating the process of a FERPA investigation. USED's announcement this week marks the completion of Step 4 in that process.
When SPPO completes an investigation and finds a violation (Step 4), FERPA's enforcement process requires SPPO to provide a written notice that includes: the investigation's findings, the basis for those findings, the steps the recipient must take to voluntarily come back into compliance, and a timeline for doing so.
USED's announcement would constitute most of that required notice. The Department has identified five specific actions CDE must take related to FERPA compliance, parental access rights, and educator training (the full list of requirements is available in USED's press release). According to reports, CDE has two weeks to respond.
What Happens Now: California Decides
CDE now faces a decision. If California takes the actions USED has requested, the matter would likely be resolved without further enforcement action—at any point in this process, the recipient may choose to voluntarily come into compliance. FERPA's enforcement mechanism requires that "compliance cannot be secured by voluntary means" before the Secretary may impose penalties (20 U.S.C. § 1232g(f)). Voluntary resolution at this stage would satisfy that requirement.
If CDE declines to take the requested actions, Secretary McMahon may move to Step 5 and initiate the post-enforcement process, which could ultimately result in the withholding of federal education funds.
USED has never previously reached Step 5 with any educational entity, so we would be in uncharted territory.
The FERPA Post-Enforcement Process
Because this situation is unprecedented, many stakeholders may be unfamiliar with what the process looks like if CDE declines to take the requested actions. What steps are necessary for SPPO to consider CDE compliant are decided by SPPO and are not subject to formal challenge. However, once the Secretary has decided to impose a penalty, FERPA's statute and regulations establish due process requirements that must be followed.
To help explain this potential path forward, PIPC has created a new infographic outlining the due process required under FERPA when the Secretary of Education takes an enforcement action (like withholding federal education funding).
If the Secretary decides to pursue enforcement, the following framework (as shown in our infographic) applies:
Step A: Secretary Notification.
Before the Secretary may withhold payments, the recipient must be notified in writing of:
- the intent to withhold payments;
- the factual and legal basis for the determination that the recipient failed to comply substantially with a legal requirement; and
- an opportunity for a hearing to be held at least 30 days after notification.
Importantly, once the recipient has been given reasonable notice and an opportunity to show why funds should not be suspended, payments may be suspended pending the hearing outcome. This means funds could potentially be withheld relatively early in the process.
Step B: ALJ Hearing and/or Mediation.
If the recipient requests a hearing, an Administrative Law Judge (ALJ) from USED's Office of Administrative Law Judges reviews the Department's determination. The ALJ has wide latitude to decide whether recipients may provide evidence and may order discovery. There is also an option for voluntary mediation of disputes.
Step C: ALJ Decision and Secretary Review.
ALJ decisions are subject to review by the Secretary, who may choose to remand the decision, modify or set aside the decision in whole or in part, or uphold the decision. If the Secretary modifies or sets aside the decision, this becomes the “final agency action” (moving us to step D) when the recipient receives notice of the Secretary’s action. If the Secretary upholds the decision, this will constitute final agency action 60 days after the recipient receives written notice from the ALJ.
Step D: Opportunity for Judicial Review.
A recipient desiring judicial review must file with the U.S. Court of Appeals within 60 days of the final agency action. The court has jurisdiction to affirm or set aside the action of the ALJ or the Secretary. Notably, the Secretary may not take action on the basis of the final agency action until judicial review is completed. However, the statute is silent as to payments previously suspended during the ALJ process.
What PIPC Is Watching
As this situation develops, several questions remain open:
- How will CDE respond to the Department's request?
- If California declines to comply, how quickly might the post-enforcement process move?
- Will the Department's approach to this unprecedented situation set precedents for future FERPA enforcement?
PIPC will continue monitoring this situation and will provide additional educational materials and updates as developments occur.
READ OUR LATEST NEWS
Feeding the Machine?: What the Updated COPPA Rule Says About Using Children’s Data to Train Algorithms
AI Changes Everything: Why Student Data Review Can’t Wait Another Semester
