FERPA
Family Educational Rights and Privacy Act (20 U.S.C. 1232g; 34 CFR Part 99)
FERPA is the Family Educational Rights and Privacy Act of 1974, the federal law that protects the privacy of student education records. It gives parents, and eligible students (those who are 18 or attend a postsecondary institution), the right to inspect and amend education records and to consent to most disclosures of personally identifiable information from them. For identity teams, the implementing regulations at 34 CFR Part 99 contain two direct obligations: institutions must use reasonable methods to identify and authenticate anyone they disclose records to, and must use reasonable methods so that school officials reach only the records in which they have a legitimate educational interest.
Who it applies to
Educational agencies and institutions that receive funds under a program administered by the U.S. Secretary of Education. Contractors, consultants and other outside parties can be treated as school officials when they perform an outsourced institutional function, are under the institution's direct control for the records, and are bound by FERPA's redisclosure limits.
Identity requirements
- Use reasonable methods to identify and authenticate the identity of parents, students, school officials and any other parties to whom personally identifiable information from education records is disclosed (34 CFR 99.31(c))
- Use reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests; an institution without physical or technological access controls must show that its administrative access policy is effective (34 CFR 99.31(a)(1)(ii))
- Publish, in the annual notification of rights, the criteria for who counts as a school official and what counts as a legitimate educational interest (34 CFR 99.7)
- Accept electronic consent to disclosure only if it identifies and authenticates a particular person as the source and indicates that person's approval (34 CFR 99.30(d))
- Maintain a record of each request for access to, and each disclosure of, personally identifiable information from a student's education records (34 CFR 99.32)
- Let parents or eligible students inspect and review education records within 45 days of a request (34 CFR 99.10)
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | Section 99.31(c) requires reasonable methods to identify and authenticate parents, students and officials before disclosure, which covers student and parent portals, records request workflows and staff sign-in. |
| Identity governance (IGA) | Access to education records must follow legitimate educational interest, so role design, provisioning and access review for school officials and outsourced providers need to map to that test. |
| Customer identity & consent (CIAM) | Electronic consent to disclose records counts only if it authenticates the person giving it and captures their approval, which ties consent capture to verified identity. |
| Audit, logging & accountability | Institutions must record each request for access and each disclosure, so access logs for records systems double as FERPA evidence. |
Penalties
FERPA has no fine schedule. If an institution does not comply within the time the Department sets after an investigation, the Secretary may withhold further payments under any applicable program, issue a complaint to compel compliance through a cease and desist order, or terminate eligibility for funding (34 CFR 99.67). Parents and eligible students file complaints with the Department within 180 days of the alleged violation.
Status and dates last verified against primary sources on 2026-11-05.
FERPA: frequently asked questions
- Does FERPA require multi-factor authentication?
- FERPA does not name MFA. Section 99.31(c) requires 'reasonable methods to identify and authenticate' anyone receiving personally identifiable information from education records, and section 99.31(a)(1)(ii) requires reasonable methods to limit school officials to records they have a legitimate educational interest in. The regulation leaves the choice of method to the institution.
- Can a cloud or software vendor access student records under FERPA?
- Yes, if the institution treats it as a school official. Under 34 CFR 99.31(a)(1)(i)(B) an outside party qualifies when it performs a service the institution would otherwise use employees for, is under the institution's direct control for the use and maintenance of the records, and is subject to FERPA's limits on use and redisclosure.
- Who enforces FERPA?
- The U.S. Department of Education. Its Student Privacy Policy Office runs studentprivacy.ed.gov, and the regulations at 34 CFR 99.60 to 99.67 set out how complaints are investigated and how the Secretary can enforce compliance, up to withholding or terminating program funding.