FERPA Priorities in the New Administration
May 7, 2025
Amelia Vance and Morgan Sexton
CC BY-NC 4.0
TLDR:
Within the first month of the new Secretary of Education being confirmed, the U.S. Department of Education (USED) announced FERPA enforcement priorities. This reflects an unprecedented focus by a new presidential administration on student privacy. The priorities flagged by USED include:
- Parental Right to Inspect and Review Education Records;
- Safety of Students;
- Annual Notification of Rights; and
- Military Recruiters.
USED also asked State Education Agencies (SEAs) to submit documentation on their and their LEAs FERPA compliance. USED’s focus on FERPA compliance and enforcement at the SEA level seems unusual; stakeholders should watch carefully for additional USED FERPA and PPRA announcements.
What Happened?
Student privacy continues to be a major priority for the Trump administration. Almost immediately after USED announced FERPA investigations into the California and Maine State Education Agencies (see our blog here), they announced that the department was directing “Schools to Comply with Parental Rights Laws”–specifically, the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)–releasing two letters sent from Secretary McMahon and the Student Privacy Policy Office (SPPO) to State and Local Educational Agencies (SEAs and LEAs).
Secretary McMahon's letter frames FERPA enforcement as a moral imperative rather than a technical compliance issue: "By natural right and moral authority, parents are the primary protectors of their children." The letter flagged that “many states and school districts have enacted policies that presume children need protection from their parents” and that those policies often “evade or misapply FERPA” in ways that turn “the concept of privacy on its head.” She announced “a revitalized effort” by USED to “make FERPA and PPRA the source of proactive, effective checks on schools that try to keep parents in the dark” and ensure that “schools apply FERPA correctly to uphold, not thwart, parents’ rights.” As with the investigations into California and Maine, the primary focus of the letter was on parental rights in reference to the ability to access information related to their children's gender identity.
The Secretary’s letter also noted that USED will “prioritize clearing the backlog of FERPA complaints so that parents can be confident that the Department is positioned to act on complaints in a timely manner.”
The attached SPPO letter detailed “priority concerns” that SPPO “is taking proactive measures to address” at the direction of Secretary McMahon. The priority concerns listed in the SPPO letter were:
- SEA or LEA “policies and practices that conflict with the inspect and review provisions afforded parents under FERPA;”
- Schools withholding information from “parents concerned about the safety of their children…under the auspices of FERPA;”
- LEAs “not properly notifying parents and eligible students of their rights under FERPA;” and
- A reminder that schools must “provide student information to military recruiters, when requested, unless the parent has opted out of providing such information.”
While compliance with PPRA was not explicitly listed as one of the priority concerns, Secretary McMahon’s letter emphasized the enforcement of PPRA (in addition to FERPA) several times in her letter, perhaps reflecting renewed attention to this little-known law.
Learn more about PPRA in our recent blog and this FAQ on how schools can apply PPRA.
Finally, the letter requested that, “[a]s part of SPPO’s fulfillment of the Secretary’s priority to take proactive action to enforce FERPA,” SEAs provide SPPO with an “assurance of compliance,” including:
“documentation such as ‘reports, information on policies and procedures, annual notifications, training materials or other information necessary’ to provide assurance that the SEA and their respective LEAs are complying with the provisions of FERPA and PPRA, specifically with regard to the priority concerns previously discussed.”
SPPO requested that SEAs submit this information by no later than April 30th.
This blog provides an overview of the concerns discussed in the letter, delving into FERPA’s requirements and complexities related to the administration’s priorities.
Some Historical Context: SPPO’s Annual Notices
Before we dive into the priority areas, we couldn’t help but include some historical background to highlight how these letters differ from what we’ve seen in previous administrations (including the first Trump administration). If you want to jump right into the meat of the priority concerns, you can skip down to the next section.
SPPO’s letter was released in the context of USED’s legally required annual notice of SEA and LEA obligations under FERPA and PPRA. Generally in the past, the Department has just released a letter providing an overview of FERPA amendments that have not yet been incorporated into federal regulations, which were last updated in 2011. Cover letters to the annual notice are fairly rare; we were only able to find three previous letters from 2016, 2020, and 2022 (though standalone Dear Colleague letters are more regularly released by SPPO). Each previous cover letter was focused on raising awareness about new resources, such as guidance on remote learning during the pandemic in 2020.
No letter–whether a Dear Colleague letter or a cover letter to the annual notice–that we were able to find spelled out a new administration’s priorities in regards to FERPA. Instead, each of the previous cover letters (and many of the Dear Colleague letters) were released mid-way through or near the end of each presidential administration. The fact that two FERPA investigations and the administration’s FERPA priorities were announced within the first 100 days of the second Trump administration–and the first month after the new Secretary of Education was confirmed–is unusual and, as far as we know, unprecedented.
USED’s Priority Concerns
Concern 1: SEA or LEA “policies and practices that conflict with the inspect and review provisions afforded parents under FERPA”
As noted above, SPPO’s letter emphasized that Secretary McMahon directed their office to “take proactive measures” to address several priority concerns.
Unsurprisingly, given the content of Secretary McMahon’s letter, the first concern emphasized was parents’ right to access education records under FERPA.
Want to learn more about parental rights under FERPA? Check out USED’s parent guide to FERPA, and dive deeper into how these rights work in these blogs on the right to inspect and review and the right to amend.
The letter expresses concern that some LEAs may have implemented policies and practices that conflict with FERPA's inspection and review provisions, possibly “at the direction, or minimally with the tacit approval, of their SEAs.” In particular, SPPO noted that where schools maintain certain student documents or whether those documents are part of an “official” record does not change that they are protected by FERPA and that parents have a right to access them.
As a reminder: FERPA applies to personally identifiable information (PII) in education records. Education records are records: 1) directly related to a student; and 2) maintained by an educational agency or institution, or by a party acting for the agency or institution. (34 CFR 99.3(a)). This includes a wide variety of formats, regardless of whether information is physically kept in the school filing cabinet or virtually stored in the cloud.
The letter notes that FERPA does not require schools to proactively inform parents of any information related to a student’s education record. However, when a parent requests access to their child’s education record, they must be granted that access.
The letter emphasized that FERPA does not differentiate between types of student records. FERPA protects not only the “‘official student record’ or ‘cumulative file;’” but all documents that fall under the definition. If a record relates to a student and is held by the school (or the school’s third party service provider on the school’s behalf), it is an education record under FERPA and must be disclosed to parents upon request. FERPA does not permit schools to refuse access to a portion of a student’s education record.
However, FERPA does contain a narrow exception for “records that are kept in the sole possession of the maker,” so long as those records are “used only as a personal memory aid” and not accessible to anyone else, except a “temporary substitute for the maker of the record.” This exception typically includes a teacher’s personal notes; for example, that a particular student likes to learn about dinosaurs. But as soon as those notes are shared with other school personnel or uploaded to a system that other people have access to–such as a student information system or Google workspace that's owned by the school–they would likely become education records.
Concern 2: Schools withholding information from “parents concerned about the safety of their children…under the auspices of FERPA”
The priority concern that SPPO devoted the most space to was focused on the “Safety of Students.” SPPO noted that they had received multiple inquiries from parents expressing concerns about their child’s safety because schools were allegedly withholding critical information by incorrectly citing FERPA protections.
SPPO specifically flagged that educational institutions should not use FERPA as justification to conceal information from parents about other students who have made death threats against their children. The letter included the following scenario in which Student A wrote a note threatening to kill Student B:
“Student A writes a note or school assignment describing an intent, or even a detailed plan, to kill Student B (or multiple other students). To the extent that the education record in question directly relates to both students and the information cannot be segregated and redacted without destroying its meaning, the parents of both students have the right to inspect and review that information. While the disciplinary sanction imposed on Student A may not be shared with the parents of Student B, unless the sanction directly relates to both students, FERPA does not preclude school officials from communicating to Student B’s parents, for example, that responsive action is being taken with respect to a threat assessment or potential disciplinary action. Nor does FERPA prevent a school from taking actions designed to protect Student B, such as a classroom reassignment to avoid interaction with Student A. Certain measures a school might impose to protect student safety that directly affect both students may be disclosed to the parents of both students; for example, an order that specifies that Student A must stay 500 feet away from Student B, is a record that relates to both students.” (PDF Page 4)
FERPA’s Health and Safety Exception?
SPPO’s example feels like it might be referencing FERPA’s health or safety emergency exception, but that exception isn’t specifically mentioned. This exception allows schools to disclose PII in an emergency to help protect the health or safety of the student or other individuals (see 34 CFR 99.31(a)(10); 34 CFR 99.36). When disclosing student PII under this exception, schools must:
- Consider the totality of the threat based on information available to the school at the time;
- Only share PII if there is an articulable and significant threat to the student or others; and
- Only share PII with individuals whose knowledge of the situation is necessary to protect the health or safety of the student or others.
Any reasonable person would assume that the discovery of a detailed plan to kill another student would constitute “an articulable and significant threat” where it would be beneficial to notify the threatened student and their parents to enable them to protect themselves.
Disclosing How Students Posing a Safety Threat are Punished
“Directly related” Information
The most informative aspect of SPPO’s example is what they say can be disclosed to Student B about Student A’s punishment: only measures the school takes “to protect student safety that directly affect[s] both students” such as an order requiring Student A to stay away from Student B. That, of course, is unlikely to be satisfying for a parent who wants to know more specifics about what else the school is doing to address the threat and how Student A will be punished. However, under FERPA’s current language, school administrators can’t provide those additional details (an area of frustration that has been shared with us by multiple districts who want to disclose additional information to the school community when, absent FERPA’s restrictions, it would otherwise be appropriate to do so to assuage concerns).
But there’s a higher ed exception
The ability to understand what types of disclosure of disciplinary information are permitted under FERPA is further muddled by an amendment to FERPA that only applies to higher education. FERPA has two exceptions allowing higher education institutions–but not K-12 schools–to make additional disclosures about student discipline:
- A postsecondary institution may disclose the final results of a disciplinary proceeding for a violent crime or non-forcible sex offense to the victim of the alleged crime or offense, regardless of whether the institution concluded a violation was committed. No additional information can be disclosed under this exception. (34 CFR 99.31(a)(13) and 34 CFR 99.39)
- If a postsecondary institution’s post-1998 disciplinary proceeding has determined that a student who has allegedly perpetrated a violent crime or non-forcible sex offense has committed a violation of the institution’s rules or policies in regards to that allegation, the institution may disclose the name of the student who committed the violation, the violation committed, and any sanctions against the student. No additional information can be disclosed under this exception. (34 CFR 99.31(a)(14), 34 CFR 99.39, and Appendix A to Part 99, Title 34)
Since these exceptions only apply to institutions of higher education, K-12 schools are not allowed under FERPA to reveal disciplinary information in this way.
Incident disclosures in the absence of an emergency
There may be other circumstances that may not rise to the level of an emergency where schools similarly want to disclose student PII. Consider a 2008 example from the Department of Education:
“For example, parents of both John and Michael would have a right to inspect and review the following information in a witness statement maintained by their school district because it is directly related to both students: ‘‘John grabbed Michael’s backpack and hit him over the head with it.’’ Further, in this example, before allowing Michael’s parents to inspect and review the statement, the district must also redact any information about John (or any other student) that is not directly related to Michael, such as: ‘‘John also punched Steven in the stomach and took his gloves.’’ Since Michael’s parents likely know from their son about other students involved in the altercation, under paragraph (g) the district could not release any part of this sentence to Michael’s parents. We note also that the sanction imposed on a student for misconduct is not generally considered directly related to another student, even the student who was injured or victimized by the disciplined student’s conduct, except if a perpetrator has been ordered to stay away from a victim.”
Let’s break this example down one disclosure at a time, focusing on what information the school can share with Michael’s parents.
‘‘John grabbed Michael’s backpack and hit him over the head with it.”
-
- Can the school make this statement to Michael’s parents?: Yes
- Reasoning: The statement directly relates to Michael.
‘‘John also punched Steven in the stomach and took his gloves.’’
-
- Can the school make this statement to Michael’s parents?: No
- Reasoning: This statement, even if redacted to cut out Steven’s name, cannot be shared with Michael’s parents since Michael could tell his parents who John punched.
Can the school tell Michael’s parents if/how John is being disciplined? It depends. Consider the following statements:
“John has been suspended from school for five days as a result of these actions.”
-
- Can the school make this statement to Michael’s parents?: No
- Reasoning: Disciplinary actions are not generally considered directly related to another student–not even the victimized student–unless the perpetrator has been ordered to stay away from the victim.
“John has been ordered to stay 100 feet away from Michael while on school property.”
-
- Can the school make this statement to Michael’s parents?: Yes
- Reasoning: This disciplinary action directly relates to Michael.
FERPA also often restricts schools’ ability to set the record straight
Consider the following example: After a student, Lisa, missed school for three consecutive days, a rumor began spreading that Lisa was suspended for bringing a weapon to school. In our scenario, let’s assume that this did not actually happen, and Lisa was absent for completely unrelated reasons. If a group of concerned parents approach school administrators asking how Lisa is being punished, this would be considered a targeted request under FERPA. FERPA does not permit school administrators to respond to this request–not even to reassure those parents that Lisa did not bring a weapon to school in the first place.
“De-Identified” disclosures when a student’s identity is likely known
We unfortunately have to add yet another layer of complexity to when FERPA permits disclosure: schools must also consider whether the person requesting information may know the identity of the student the information is about. As USED explained in the 2008 Proposed Rule:
“personally identifiable information includes information that is requested by a person who an agency or institution reasonably believes has direct, personal knowledge of the identity of the student to whom the education record directly relates. … In the simplest case, if an individual asks for the disciplinary report for a named student, the institution may not release a redacted copy of the report because the requester knows the identity of the student who is the subject of the report.”
Using the example we began above about Lisa, the school may not reveal information even if the concerned parents do not mention Lisa’s name directly.
Disclosures of out-of-school activities
To take it a step further, analysis gets even more convoluted if the rumor about Lisa is that she was arrested by police for carrying a gun (and nothing related to the school taking a particular action). Concerned parents might ask school administrators for how the school will deal with Lisa in response to her alleged out-of-school arrest. If this information is not written down in Lisa’s education records, it is not protected by FERPA, and whether or not the school may disclose this information becomes a question of state law, district policy, and what administrators feel they are ethically obligated to do.
Stay tuned for guidance?
Parents and K-12 school administrators are confused–and understandably frustrated–about the current limitations on what information can be disclosed to parents regarding health and safety risks. We are hoping for additional guidance from USED to help schools navigate this extremely complex issue.
Concern 3: LEAs “not properly notifying parents and eligible students of their rights under FERPA”
SPPO’s letter stated that:
“Many LEAs are not properly notifying parents and eligible students of their rights under FERPA. A school is not required to notify parents individually but rather is required to provide the notice by any means that are reasonably likely to inform parents of their rights. These means could include publication in the school activities calendar, newsletter, student handbook, or displayed prominently on the school’s website.” (emphasis added, PDF Page 4)
Unlike the two prior priority areas of concern, the letter did not provide examples of how current LEA notification practices might be failing to meet this requirement. Guidance from the Department detailing specific practices that are not sufficient would be highly valuable for schools seeking to adapt their current practices.
In the meantime, it is best practice for LEAs to post annual notices prominently on their websites. To see an example of a school district with exemplary annual notification practices, take a look at Fairfax County Public Schools’ Annual Notice of Survey, Records, Curriculum, Privacy, and Related Rights and Opt-Out Forms.
Concern 4: Disclosures to Military Recruiters
The final priority concern related to providing military recruiters access to student information. SPPO noted that LEAs are generally required to give military recruiters the same access to secondary school students that they provide to post-secondary institutions or to any prospective employers. This aligns with long-standing FAQ guidance from the Department:
“What are the requirements for access by military recruiters to high school students?
Local educational agencies (LEAs) receiving assistance under the Elementary and Secondary Education Act of 1965 (ESEA) are generally required to give military recruiters the same access to secondary school students as they provide to postsecondary institutions or to prospective employers. LEAs are also generally required to provide students’ names, addresses, and telephone listings to military recruiters, when requested.”
This requirement under FERPA has been routinely spelled out in almost every annual notice provided to chief state school officers and superintendents; presumably, it is a frequent area where there are misunderstandings.
SPPO’s letter did not allege that schools are denying such access to military recruiters, but LEAs should review their current policies to ensure they are meeting this legal requirement. For example, if LEA policies state that colleges may access high school students’ directory information, the LEA must also provide that same access to military recruiters, unless the parent has opted out of permitting the school to disclose their child’s information under the directory information exception.
Learn more about the directory information exception here.
What’s Next?
SPPO’s letter ended by requesting that all SEAs submit documentation on how they are complying with these priority concerns by April 30th. As of this blog’s publication, twelve responses submitted from states have been disclosed (all, except California’s, under state public records requests). States have adopted varying approaches to the Department's documentation request, ranging from detailed compliance evidence to more streamlined assurances. PIPC plans provide more information on state responses as more become available.
Missouri’s response provided further details on what USED was seeking from SEAs, citing to an April 10th conversation between SPPO and state chief privacy officers: “a ‘baseline’ of evidence showing how [SEAs] ensure that LEAs are adhering to various aspects of [FERPA and PPRA], and that LEAs are providing access to parents; as well as how much control over these various laws is being exerted at the SEA level.” But as Missouri’s reply then points out, SEAs are generally not subject to FERPA; nearly all the obligations solely apply to LEAs.
The focus of SPPO on SEAs’ impact on LEA FERPA compliance–reflected in both the SPPO letter and the FERPA investigations of the California and Maine SEAs (and, most recently, another SEA-level investigation into Washington State announced on April 30th)–also seems highly unusual.
Education stakeholders should watch future USED developments carefully, particularly in light of this sentence in the final paragraph of Secretary McMahon’s letter: “This letter reminds educational institutions receiving federal financial assistance that they are obligated to abide by FERPA and PPRA if they expect federal funding to continue.”
