Student Privacy in Family-School Communication: Questions to Ask Before Sharing

A common moment that raises privacy questions

A parent volunteer coordinator asks a teacher for a list of students who missed the last field trip so she can follow up. The teacher pauses. Student privacy is protected by a federal law that limits who can see or share a student’s education records, and everyday moments like this one are where that law actually gets tested. Most people involved are not privacy experts. They are trying to help a student while also protecting that student’s information.

This guide translates that law into a practical list of questions. It does not replace legal advice, nor does it tell any specific school what to do. It helps families, school staff, and community partners ask better questions before information about a student changes hands.

What law protects student privacy in family-school communication?

The Family Educational Rights and Privacy Act, known as FERPA, is a federal law that protects the privacy of student education records. It applies to schools that receive funding from the U.S. Department of Education, which generally includes most public schools and some private and postsecondary schools that also receive this funding. FERPA gives parents rights to inspect their child’s education records, request corrections, and control who else can see them. Once a student turns 18 or enrolls in a postsecondary school, those rights generally transfer from the parent to the student, who is then called an “eligible student.”

FERPA defines “education records” broadly: records that are directly related to a student and kept by the school or someone acting for the school. It carves out some categories, such as a teacher’s private notes kept only for personal use. One term worth knowing is “directory information” — certain details, such as a student’s name or dates of attendance, that a school can share without written consent, but only after giving public notice and letting families opt out. A student’s Social Security number is never directory information.

What should families ask before any information is requested?

Most privacy questions can be resolved before a conversation turns into a problem, if the people involved ask a few things up front.

• What specific information is being asked for? “How is my child doing” is different from “send me his attendance record.” Vague requests are harder to evaluate.
• Who is asking, and in what role? A homeroom teacher, a school counselor, a coach, and a community volunteer may have different levels of access under the school’s policy.
• Has the school already published a notice about directory information? Families can ask the school office for this notice and can opt out of having certain details shared.
• Is the student old enough that rights have transferred to them? If a student is 18 or enrolled in college, the student, not the parent, generally holds the FERPA rights.

What should be confirmed while information is being shared?

If a request moves forward, these questions help confirm the sharing is appropriate rather than assumed.

• Does this fall under an exception, or does it need written consent? Schools can share certain information without consent in specific situations, such as with school officials who have a legitimate educational interest, or in a genuine health or safety emergency. Outside those situations, FERPA generally requires signed, dated written consent that names the records, the purpose, and who will receive them.
• Is the person receiving the information actually authorized, or just present? Being in the room during a conversation is not the same as being an authorized recipient of a student’s record.
• Is this the minimum needed to solve the problem? A volunteer coordinator following up on a field trip usually does not need a child’s full attendance history to do that task.
• If this is an emergency disclosure, is there a real and significant threat to health or safety? This exception is meant for genuine emergencies, not routine coordination.

What matters after information has already been shared?

Privacy questions don’t end once information changes hands.

• Can the receiving party re-share this with someone else? Under FERPA, most parties that receive student information may not disclose it again without separate consent.
• Is there a record of what was shared and why? Schools are generally required to keep a record of requests and disclosures for a student’s file, which parents and eligible students can ask to review.
• Does the family know how to request a copy or ask a question about what was shared? Parents and eligible students have the right to inspect education records and to ask the school to explain them.

What are the most common misunderstandings about student privacy?

• “It’s for the child’s own good” is not, by itself, a legal basis for sharing. Good intentions matter, but they don’t replace consent or a recognized exception.
• Directory information is not unlimited. A school can only share what it has publicly designated as directory information, and a family that opted out must be honored.
• A student’s Social Security number and most ID numbers are never directory information and require the same protection as any other education record.
• Turning 18 changes who holds the rights. A parent who has always received a student’s records may not automatically continue to receive them once the student becomes eligible, unless a specific exception applies.
• A verbal request is not the same as signed, dated consent when consent is actually required.

What is the decision path for a specific request?

When someone is unsure whether a piece of information can be shared, walking through these questions in order can clarify the next step:

1. Is this information already designated as directory information, and has the family not opted out? If yes, sharing it may not require separate consent, subject to the school’s notice.
2. If not, does a recognized exception apply (such as a school official with a legitimate educational interest, a genuine health or safety emergency, or another FERPA exception)? If so, the school’s own policy should specify the basis before sharing.
3. If no exception clearly applies, has the parent or eligible student given signed, dated written consent that names the records, the purpose, and the recipient? If yes, sharing can generally proceed as described in that consent.
4. If none of the above apply, the appropriate next step is to pause and ask the school’s designated privacy contact or main office rather than share the information informally.

Frequently asked questions about student privacy

Does FERPA apply to every school?

FERPA applies to schools that receive funding from the U.S. Department of Education. This generally covers most public schools and some private and postsecondary schools that also receive this funding. Families can ask a specific school directly whether it is subject to FERPA.

Can a parent see everything in their child’s education record?

Parents and eligible students generally have the right to inspect and review a student’s education records, with a few narrow exceptions, such as certain confidential letters of recommendation. Schools must respond to a request within a reasonable time, not more than 45 days.

What actually changes when a student turns 18?

When a student turns 18, or enrolls in a postsecondary school at any age, they become an “eligible student,” and the FERPA rights that belonged to their parent generally transfer to them.

Can a school share information without asking first?

Yes, in specific situations. Directory information can be shared without consent after public notice and an opt-out period. Certain other disclosures, such as to school officials with a legitimate educational interest or during a genuine health or safety emergency, also do not require prior consent.

What can a family do if they think a school violated FERPA?

A parent or eligible student can file a written complaint with the U.S. Department of Education’s Student Privacy Policy Office within 180 days of the incident, or within 180 days of when they reasonably should have known about it.

Where to go from here

Families coordinating with a school on a broader issue, such as an emergency plan or a support request, can use this publication’s coordination guide to map out roles, responsible people, and hand-off points, since many coordination breakdowns are really privacy questions in disguise. When the underlying concern involves a student’s sleep, attention, food access, or another wellbeing topic, the wellbeing and routines guide covers how to raise those topics without turning every caring adult into a record-keeper. For this publication’s overall scope and safety limits, see Start Here.

Sources and limits of this guide

This article is based on the U.S. Department of Education’s published FERPA regulations at 34 CFR Part 99 and its guidance for eligible students, both maintained by the Department’s Student Privacy Policy Office. Specific school district policies can add detail or local procedure on top of this federal floor, so families should also check their own school or district’s annual FERPA notice. This is educational information, not legal advice, and it does not address every FERPA exception or every state’s additional student-privacy laws. Anyone with a specific dispute about their own or their child’s records should contact their school’s designated privacy official or, if needed, file a complaint through the Department of Education’s Student Privacy Policy Office.

By Healthy Learning Environments Guide Editorial Team. Last updated September 2026.