Under Pressure: Navigating Threats to Gender Expansive Student Privacy

Over the last several years, gender expansive students (i.e., students whose gender identity or gender expression differs from traditional gender norms, including transgender, nonbinary, or genderfluid students) and their rights in school have been at the center of intense public debate. Although much of the public’s attention has focused on bathroom policies and school sports, the controversy has sparked changes in how states, localities, and individual schools protect the privacy of gender expansive students in a range of contexts. The stakes are now higher than ever: the U.S. Department of Education (ED) has recently accused California of violating the country’s primary student privacy law, the Family Educational Rights and Privacy Act (FERPA), because of state policies designed to protect gender expansive students from being outed. If California does not comply with ED’s demands, it risks losing federal funding and becoming the first education agency since FERPA was enacted in 1974 to be penalized in this way. 

This blog examines the legal landscape surrounding these policies, including ED’s complaint against California; presents nationally representative polling data on how schools are currently handling these issues and how students and parents view various approaches; and identifies key considerations for education agencies navigating this terrain. 

Legal Considerations Amid Increased Enforcement Threats

State legislatures have taken action in recent years to address the privacy of gender expansive students. At least thirteen states (Indiana, Iowa, Ohio, South Carolina, Tennessee, West Virginia, Arkansas, Idaho, Montana, Nevada, North Carolina, Utah, and Virginia) have proposed or enacted laws that would require public schools to proactively notify a student’s parents if they want to use a different name or pronouns — and in some cases to notify the broader school community of a gender expansive student’s identity. Around twenty states (Washington, Oregon, Nevada, New Mexico, Colorado, Minnesota, Iowa, Illinois, Arkansas, North Carolina, Maryland, New Jersey, Connecticut, Rhode Island, Massachusetts, Maine, New Hampshire, Vermont, and New York) and the District of Columbia have focused on introducing and enacting laws to protect gender expansive students from harassment and discrimination, while California passed a law specifically prohibiting forced outing. Notably in these lists, some states have proposed both types of laws, emphasizing the lack of consensus, even within the same state.

The following examples illustrate the radically different approaches to this issue: 

• Mandating proactive disclosure: Indiana passed the Education Matters bill, which requires schools to notify at least one parent in writing if a student asks to use a different name, pronoun, title or “word to identify the student.” Schools are required to give this notice within five business days of the request.
• Prohibiting proactive disclosure: California passed the SAFETY Act, which prohibits school districts and county offices of education from enacting or enforcing any policy, rule, or administrative regulation that requires an employee or a contractor to disclose any information related to a pupil’s sexual orientation, gender identity, or gender expression to any other person without the pupil’s consent unless otherwise required by law. 

This tension was amplified at the federal level when the new Administration took office last year, particularly as it relates to the Department of Education’s enforcement of FERPA. FERPA protects student privacy by prohibiting schools from disclosing student information, (which includes a student’s name, pronouns, and gender,) except under specific enumerated circumstances. It also gives parents the right to access their child’s education records upon request. Critically, however, FERPA does not impose an affirmative obligation on schools to proactively disclose information to parents. 

In a Dear Colleague Letter sent on March 28, 2025, ED signaled its renewed interest in using FERPA to target policies that prohibit proactive parental notification of a student’s gender identity without the student’s consent. An attached memo from ED’s Student Privacy Policy Office acknowledged that FERPA does not affirmatively require schools to inform parents of any student information, only to provide access when a parent requests it. Despite this concession, ED emphasized that violations could result in the loss of federal funding. 

ED now seems to be trying to make good on this threat. On January 28, 2026, ED published a press release announcing its finding that the California Department of Education “egregiously abused its authority by pressuring school officials to withhold information about students’ so-called ‘gender transitions’ from their parents.” The focus of the alleged violation is California’s SAFETY Act, referenced above, aimed at preventing the “outing” (i.e. sharing a student’s gender identity or sexual orientation without their consent or approval) of gender expansive students. However, the Act expressly allows schools to share information with parents when required by other laws, such as FERPA. This carve-out indicates that California policymakers anticipated potential FERPA preemption issues and intentionally clarified that schools must still provide parents access to their children’s records. That clarification, in turn, raises serious questions about the validity of ED’s claim that the California Department of Education is pressuring schools to withhold information from parents as a result of the SAFETY Act.

In the fifty years that FERPA has governed student privacy, this finding would mark the first time that ED has attempted to withhold federal funding for an alleged violation. The threat alone places significant pressure on other state and local education agencies, potentially deterring them from enacting or enforcing policies that protect gender expansive students from being outed, even if these policies do not violate any existing laws. 

Current Status of Policies and Opinions Regarding the Privacy of Gender Expansive Students 

To better understand what’s actually happening in schools regarding gender expansive student privacy, CDT conducted nationally representative polling of students, parents, and teachers on school policies and their potential impact.

As a general matter, parents tend to be the most concerned about student privacy, followed by students and then teachers. Higher parent concern has been consistent across all of our surveys going back to 2019, while student and teacher concern has been trending downward. 

In our latest polling research, we used the various reporting requirements proposed or enacted in state legislation to guide our inquiries to teachers about whether similar gender expansive disclosure policies were currently in place at their school.

Most teachers report their school has notification policies when they get a request from students to go by a different name or pronoun at school. Although the majority of teachers report that their school has a policy about how to handle a student request to use a different name or pronoun, their approaches vary widely. Nearly equal shares of teachers report policies that permit discretion, mandate parental notification, or prohibit disclosure without student consent.  

Perhaps understandably, students and families who would be most affected by these policies, LGBT+ students and their parents, were often more likely than their peers to indicate that such policies would have a negative impact. 

Policies about notifying the family if their child requests to use a different name or pronouns

(n = 236 students who identify as LGBTQ+, 62 parents whose child identifies as LGBTQ+ (note this is a small sample size)

Policies about notifying the community that a student in the class is using a different name or pronouns

(n = 794 students who do not identify as LGBTQ+, 956 parents whose child does not identify as LGBTQ+)

Figure 45 [from CDT’s Hand in Hand report]. Percentage (%) of respondents who say this policy would be a bad policy for their school/their child’s school to adopt.

Notably, a nontrivial number of teachers report policies that extend disclosure beyond a student’s own family to the broader school community, potentially heightening risks to the student’s safety and wellbeing and violating their privacy rights. 

Looking Ahead 

As schools navigate the legal and ethical questions regarding the privacy of gender expansive students, they will need to address three core issues:

• Compliance with their legal obligations, including privacy laws (as discussed above) and civil rights laws
• Developing their school disclosure policies to parents and students
• Enacting best practices in data governance

Civil Rights Obligations

In addition to FERPA and relevant state privacy laws, schools must comply with Title IX of the Civil Rights Act of 1964, which protects students from sex-based harassment and discrimination. The extension of this protection to sexual orientation and gender identity has long been a matter of contention, often shifting back and forth with the change of administrations. The Supreme Court has held that sexual orientation and gender identity are protected under Title VII in the employment context (Bostock v. Clayton County), but this question remains unsettled under Title IX in education.

Schools enacting disclosure policies must consider their civil rights implications. These policies by nature single out gender expansive students and can expose those students to harassment and create barriers to equal access to educational opportunities, which raises potential discrimination concerns under Title IX. 

Student and Parent Disclosures

Schools implementing disclosure policies must consider how these policies intersect with their legal obligations to protect students’ privacy. Parents have no right to information about any student other than their own child, and disclosing information about another student’s gender identity could violate federal or state student privacy protections. 

The stark divide in opinions between LGBTQ+ and non-LGBTQ+ students and their families underscores the importance of engaging community members and families when setting these disclosure policies. Additionally, while notifying a parent about their child’s gender identity is not prohibited by FERPA, it is not required absent a parental request for their child’s information. Schools should not feel pressure to enact policies requiring proactive disclosures under FERPA. If such policies are in place, they should be clearly communicated so students and families can consider them before sharing any such information with any school officials. 

Data Governance Best Practices

As always, schools should take care to implement data minimization practices with these issues in mind — collecting only the information necessary for an identified educational purpose and regularly reviewing whether existing data still needs to be retained. Clear retention and deletion schedules are critical, particularly for highly sensitive information related to a student’s gender identity, which can pose heightened risks if disclosed or misused. Schools should also limit access to this information to only the staff members with an education-related need to know, rather than making it broadly available across student information systems or shared informally among staff. In practice, strong data governance can reduce the likelihood of accidental or unauthorized disclosure, mitigate the impact of shifting legal requirements or enforcement priorities, and help ensure that students are not placed further at risk simply because sensitive information was unnecessarily collected or retained.

Conclusion

As debates over gender expansive student privacy intensify, education agencies face high-stakes decisions in a legal landscape that is fragmented, politically charged, and evolving. Against this backdrop, it’s critical that schools and education agencies ground their decisions in existing civil rights and privacy obligations, clear and transparent communication with students and families, and strong data governance practices that prioritize student safety and dignity. Ultimately, how schools handle information about a student’s gender identity is not just a compliance question, but a reflection of whose privacy is valued, whose voices are centered, and whether all students are afforded a safe and nondiscriminatory learning environment.