Skip to Content

Privacy & Data

A Parent’s Guide to Student Privacy

About This Guide

How Do I know If My Child’s Information Is Protected? A Parent’s Guide to Student Privacy seeks to empower parents and help you ask your child’s school questions to advocate for your child’s privacy. The guide is meant to raise awareness around student privacy and data issues you might run into in your child’s school. With this guide, you can:

  • Learn about your legal rights;
  • Learn about important privacy issues;
  • Review helpful questions to ask your child’s school;
  • Read sample scenarios that might arise in schools; and
  • Get links to additional resources.

(Note: This guide uses the term “parent” throughout and is intended to use a broad definition of parent, including foster parents, legal guardians, adult students, and other responsible adults. Also, the legal rights under federal law generally apply only to students attending public schools.)

Common Privacy and Data Questions for Parents

How Do I Access, Review, and Correct Information About My Child?

Learn About Your Legal Rights

As a parent, you have a legal right to access your child’s entire education record within 45 days of requesting to see it, according to federal law. Education records generally include information such as a student’s grades, tests, discipline reports, Individualized Education Programs (IEPs), attendance records, and teacher and/or counselor notes.

Federal student privacy law also gives you the right to ask for any incorrect information to be fixed in your child’s education record. Because the school is the final decision-maker about whether or not to correct the record, your request might not always be honored. However, even if the school decides not to change or correct the record, it must add a note saying that the content of the record was disputed and include that note whenever your child’s record is shared.

Helpful Tips for Following Up With Your School

  • Was the request acknowledged and fulfilled within 45 days?
  • Does the information provided by the school include all of the requested and expected data points?
  • Did the school add a note saying that the content of the education record was disputed? How did it add the note? (For instance, is it a separate page that people seeing the record for the first time might miss? Or did the school add a note directly to the part of the record that was disputed, so it is easy to find?)
  • Do you know what the note says?
  • When can you access the record to make sure the note has been made and attached to the record?

Sample Scenario

You request access to all records the school has about your child, and when you look at the transcript, you believe that the science grade is wrong. You ask the school to fix the grade, but the school denies your request. You follow up with the school to state that you disagree with the decision, and a meeting is scheduled with the school to discuss your request. During the hearing, you show evidence that one of the test grades was wrong, at which point the school grants your request and fixes the science grade in your child’s transcript.

Should I Give Consent to Share Data About My Child With a Third Party?

Learn About Your Legal Rights

Federal law generally requires that parents have to give consent before the school can share student data with third parties, although there are some exceptions (e.g., the sharing of data with a state education agency or a contractor acting on the school’s behalf usually does not require parental consent). You may need to decide whether to give consent to a school to share data so that your child can join an optional program (such as an afterschool program) or receive supplemental services (such as special tutoring).

Helpful Questions to Ask Your School

  • Why does the third party need student information, and what is it planning to do with the information?
  • How is the third party going to protect student information?
  • What will the third party do with the information once a student is not in the program anymore or has stopped getting services?

Sample Scenario

You get a flyer about a new afterschool program that seems like a good fit for your child. As part of the consent form to join the program, you have to let the school share your child’s grades and attendance data with the afterschool program provider.

Can I Be Forced to Give Up My Legal Rights to Access an Educational Service?

Learn About Your Legal Rights

Although schools can require students to use certain systems, apps, and technologies, schools cannot agree to terms that violate federal student privacy law, such as permitting third parties to share personally identifiable information for any purpose without parental consent.

Helpful Questions to Ask Your School

  • How does the school make sure that the company is protecting student information? What kind of agreement does the school have with company?
  • How is the school going to make sure that vendors do not compromise parents’ legal rights?
  • How will the school make sure that student data has been deleted from the company’s records?

Sample Scenario

You notice that your child submits homework using an online tool that the teacher requires the students to use. When you read the company’s privacy policy and terms of service, you notice that the online tool can share identifiable information about your child for any purpose and without getting your permission, which is a violation of federal law.

How Long is Data About My Child Kept by the School?

Learn About Important Privacy Issues

Deleting information that is not needed anymore helps make sure that information is not used inappropriately or out of context, which could cause harm to a student. You can access your child’s entire education record and request that some information be deleted. However, if the school honors the request, valuable information might be permanently deleted, and you will not be able to access it later. Also, no federal law requires schools to honor your deletion request.

Helpful Questions to Ask Your School

  • How long does the school keep data, particularly for students who transfer or graduate?
  • How does this amount of time vary for different types of data (e.g., transcript information, homework grades, counseling notes)?
  • What policies does the school have in place to make sure that any third parties who have student records also are deleting the information?

Sample Scenario

Your family is moving to a new city, and your child needs to change schools. When you withdraw your child from her current school, the school gives you her education record but does not indicate if/how long it will keep your child’s information in its system.

What Should I Do If My Child’s School Has a Data Breach?

Learn About Important Privacy Issues

A data breach of personally identifiable student information may violate federal law; however, the U.S. Department of Education might not investigate the breach unless a complaint is filed. Even if the complaint is investigated, the school will have an opportunity to fix its practices so that it meets federal requirements before experiencing consequences such as losing federal funding. To this point, no school has lost federal funding as a result of a data breach.

Helpful Questions to Ask Your School

  • What data was disclosed?
  • If the data was breached by a third party, did the school have an agreement with the vendor, and if so, what penalties did it include for a data breach?
  • What resources (e.g., free credit monitoring) are available to families whose data was breached?
  • What steps will the school take to make sure a data breach does not happen again?

Sample Scenario

You get a letter from the school notifying you that a vendor the school uses for academic testing had a data breach. The letter lists what data elements were breached and the steps that it is taking to prevent a data breach in the future.

Should I Give Consent for My Child to Participate in a Survey That Might Have Sensitive Questions?

Learn About Your Legal Rights

Federal law requires schools to get parental consent prior to asking children to take a survey that might ask sensitive questions about topics such as religion, sexual behavior, or political affiliations.

Helpful Questions to Ask Your School

  • How will the survey results be used?
  • Will the results of the survey be anonymous?
  • Who at the school or district will have access to the survey results?
  • How long will the school or district keep the results?
  • Will the survey results be shared with anyone else, such as a third-party researcher? In that case, what measures does the school have in place to make sure the third-party researchers have acceptable security practices?

Sample Scenario

Your child tells you that the school is starting a new program to address students’ mental health needs. As a result, the school is asking for parental permission to run a survey about students’ mental health. This survey could provide valuable information for the school’s efforts to support students’ mental health needs. At the same time, the survey will ask sensitive questions and collect personal data about individual students, which could cause harm to your child if the data is breached or misused.

Should I Decide Not to Let My Child’s School Share “Directory Information” About My Child?

Learn About your Legal Rights

Federal law gives you the right to decide whether to let the school share directory information (e.g., name, date of birth, address) about your child. This choice should be provided to you every year, along with a definition of “directory information” and a deadline by which you have to make the decision. Definitions of “directory information” vary across school districts, but it is data that would not generally be considered harmful or an invasion of privacy if it were shared.

Helpful Questions to Ask Your School

  • Does the school district have a policy that makes sure that directory information will be shared only for limited purposes and/or with limited third parties?
  • Does the directory information form define “directory information” and provide a deadline for returning the form, which is required by federal law?

Sample Scenario

You enroll your child in school at the beginning of the school year and get a form that is due by September 15 asking whether you want to stop the school from sharing “directory information.” The form defines “directory information” as name, address, phone number, email address, photograph, date and place of birth, grade level, weight and height of members of athletic teams, and honors or awards received.

Additional Resources

Parents’ Legal Rights

The U.S. Department of Education has released these resources to inform parents of their rights in relation to student records. The federal laws that apply and are referenced in this guide are the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA).

Parental Rights Under FERPA

Parental Rights Under PPRA

Actions Resulting from Parents Exercising Their Rights

Other Resources

Although the intended audience for these resources are schools and the companies that work with them, they will help parents understand the measures that schools could be taking to better protect student privacy and respect parents’ legal rights

More on Student Privacy