FERPA Copilot
Understand FERPA obligations for education records under 20 U.S.C. §1232g and 34 CFR Part 99
What the FERPA Copilot Can Do
Interpret FERPA scope under 20 U.S.C. §1232g and 34 CFR Part 99 for your institution or edtech product
Distinguish education records, directory information, and personally identifiable information
Apply the school official exception and the contractual conditions in 34 CFR §99.31
Draft consent forms, annual notification language, and disclosure logging procedures
Structure vendor and edtech data agreements to meet direct-control and use-limitation requirements
Map FERPA obligations alongside state student-privacy laws and COPPA where relevant
About FERPA Copilot
The Family Educational Rights and Privacy Act (FERPA) is a US federal law codified at 20 U.S.C. §1232g, with implementing regulations at 34 CFR Part 99, administered by the US Department of Education's Student Privacy Policy Office. It applies to educational agencies and institutions that receive funds under applicable Department of Education programs, and it governs the privacy of students' education records. FERPA gives parents — and eligible students once they reach 18 or attend a postsecondary institution — the right to inspect and review education records, to seek amendment of inaccurate records, and to have some control over the disclosure of personally identifiable information from those records. Disclosure generally requires written consent, subject to defined exceptions such as the school official exception, directory information, and the studies and audit exceptions in 34 CFR §99.31. Vendors and edtech providers acting as a school official under contract must meet the direct-control and use-limitation conditions in the regulation. FERPA is enforced administratively and does not create a private right of action (Gonzaga University v. Doe, 536 U.S. 273 (2002)). ISMS Copilot is a guidance and documentation tool, not legal advice: it helps you interpret these obligations, draft data-handling and disclosure policies, and structure vendor agreements. It does not provide legal representation or compliance certification.
Frequently Asked Questions
What is FERPA?
FERPA is the Family Educational Rights and Privacy Act, codified at 20 U.S.C. §1232g with regulations at 34 CFR Part 99, administered by the US Department of Education. It protects the privacy of student education records at institutions receiving applicable Department of Education funds and gives parents and eligible students rights over those records.
How does the FERPA Copilot help?
It helps you interpret FERPA's scope, distinguish education records and directory information, apply the school official and other exceptions in 34 CFR §99.31, and draft consent forms, annual notifications, and vendor agreements. It is a documentation and guidance aid and is not legal advice.
Does FERPA allow students to sue for a violation?
No. The US Supreme Court held in Gonzaga University v. Doe, 536 U.S. 273 (2002), that FERPA does not create a private right of action. Enforcement is administrative, through the Department of Education's Student Privacy Policy Office, which can ultimately withhold federal funding for non-compliance.
Ready to do compliance work faster?
Built for speed, accuracy, and audit-ready output.