Bearpoint Foundation provides comprehensive research so a lawyer can litigate. We do not provide legal services and nothing on this page is legal advice. FERPA case law and SPPO procedures change. Verify current regulations at studentprivacy.ed.gov before relying on any procedural detail.
What FERPA Actually Protects
The Family Educational Rights and Privacy Act, codified at 20 U.S.C. § 1232g and implemented through 34 C.F.R. Part 99, governs the privacy of student education records held by any educational agency receiving federal funds under a program administered by the U.S. Department of Education. That captures nearly every public K-12 district, charter school, and post-secondary institution.
FERPA grants four core rights: to inspect and review education records; to seek amendment of records believed inaccurate, misleading, or in violation of privacy rights; to consent to disclosure of personally identifiable information, subject to enumerated exceptions; and to file a complaint with the Department of Education. Rights belong to the parent while the student is a minor. Under 34 C.F.R. § 99.5, rights transfer to the student upon reaching eighteen or enrolling in a post-secondary institution. A parent of an adult student who remains a federal tax dependent retains certain access rights under 20 U.S.C. § 1232g(b)(1)(H).
What Counts as an "Education Record"
The definitions at 20 U.S.C. § 1232g(a)(4)(A) and 34 C.F.R. § 99.3 are deliberately broad. An education record is any record directly related to a student and maintained by the educational agency or a party acting for it. Format is irrelevant: paper, electronic, audio, video, and handwritten records all qualify.
Records that count include report cards and transcripts; Individualized Education Programs and Section 504 plans; disciplinary files; attendance records and the underlying coding; emails between staff that reference the student; video footage where the student is identifiable; and counselor notes shared with another staff member.
Several categories are excluded. Directory information, as defined at 34 C.F.R. § 99.3 and § 99.37, may be disclosed without consent unless a parent has opted out, though the district must give annual notice of the categories so designated. Sole-possession notes kept by an individual staff member and never shared are excluded. Records maintained by a law enforcement unit for law enforcement purposes are excluded under 20 U.S.C. § 1232g(a)(4)(B)(ii), but convert back into education records the moment they are shared with non-law-enforcement personnel. Employment records are excluded except where the employee is also a student.
The Three Most Common Violations
The vast majority of FERPA complaints fall into three categories. Recognizing which a fact pattern belongs to determines the structure of the complaint and the relief requested.
The first is unauthorized disclosure to third parties. Under 20 U.S.C. § 1232g(b)(1) and 34 C.F.R. § 99.30, personally identifiable information may not be disclosed without prior written consent, subject to enumerated exceptions including school officials with legitimate educational interest, audit and evaluation purposes, health and safety emergencies, and judicial order. Disclosure to a substitute, coach, or community partner without documented legitimate interest is a textbook violation. Disclosure of disability status to staff who do not need it to provide services is both a FERPA violation and a Section 504 violation under 34 C.F.R. § 104.36.
The second is refusing parental access. Under 34 C.F.R. § 99.10, the agency must provide access within a reasonable period, and in no case more than forty-five days. Stalling, demanding narrow in-person windows, or producing fragments of the file violates the regulation.
The third is refusing to amend factually inaccurate records or to provide a hearing. Under 34 C.F.R. §§ 99.20 through 99.22, a parent may request amendment of a record believed to be inaccurate, misleading, or in violation of privacy rights. On refusal, the district must inform the parent of the right to a hearing.
The SPPO Complaint Process
FERPA enforcement is centralized at the Student Privacy Policy Office, a component of the U.S. Department of Education. SPPO accepts complaints in writing. The online intake form is at studentprivacy.ed.gov/file-a-complaint. Complaints may also be sent to FERPA.Complaints@ed.gov or by U.S. mail. Telephone calls do not constitute a filing.
The filing window under 34 C.F.R. § 99.64(c) is one hundred eighty days from the date of the alleged violation or the date the parent knew or reasonably should have known of it, whichever is later. The "knew or should have known" trigger matters because many violations are concealed at the time they occur and only surface when records are later produced. Document the discovery date as carefully as the date of the underlying event. Anonymous complaints are accepted but weaker: SPPO cannot recontact the filer or send findings.
What a FERPA Complaint Must Include
Under 34 C.F.R. § 99.63 and the SPPO intake guidance, a written complaint must contain specific facts giving reasonable cause to believe a violation has occurred. The functional minimum is the following:
- The identity of the educational agency or institution, including full legal name and address.
- The specific facts alleged, including dates, names of staff involved, and the records or disclosures at issue.
- The type of violation: disclosure, access, amendment, or annual-notice failure.
- The records or categories of records affected.
- Any documentation in the filer's possession, attached as exhibits.
- The relief sought, which may include corrective action, training, or revision of district policy.
- Contact information for the complainant.
The Amendment-and-Hearing Right (Most Underused)
The amendment process at 34 C.F.R. §§ 99.20, 99.21, and 99.22 is the most powerful and least used tool in FERPA. A parent submits a written request to amend a record believed to be inaccurate, misleading, or in violation of privacy rights. On refusal, the district must inform the parent of the right to a hearing.
The hearing is not optional from the district's side. Refusing it after refusing to amend is an independent FERPA violation. Even when the district holds the hearing and declines to amend, the parent has the right under 34 C.F.R. § 99.21(b)(2) to place a written statement of disagreement in the record. That statement must be disclosed alongside the disputed record whenever the record is disclosed. The pathway forces a documented dispute into the file even when nothing else changes.
Cross-Filing With Parallel Vectors
FERPA violations rarely live alone. A breach that exposes disability status implicates Section 504 of the Rehabilitation Act, 29 U.S.C. § 794, and the Americans with Disabilities Act, 42 U.S.C. § 12132. A disclosure pattern that tracks race or national origin implicates Title VI of the Civil Rights Act of 1964, 42 U.S.C. § 2000d. A pattern that tracks sex implicates Title IX, 20 U.S.C. § 1681.
File parallel. Open OCR on the Title VI, Section 504, or Title IX dimension. Open a state attorney general civil-rights complaint where the state has standing. File with the state educator-licensing agency. Use the school board public-comment period to enter the dispute into the board's minutes. Once parallel files exist, no single agency owns the entire dispute and quiet closures become impossible.
What SPPO Can and Cannot Do
SPPO has authority to investigate, issue findings, and require corrective action plans. In extreme cases of unremedied non-compliance, SPPO may under 20 U.S.C. § 1232g(f) direct that federal funds be withheld from the offending agency, though this remedy is rarely invoked. SPPO cannot award monetary damages.
FERPA does not create a private right of action. The Supreme Court resolved this in Gonzaga University v. Doe, 536 U.S. 273 (2002), holding that FERPA's nondisclosure provisions do not confer enforceable rights on individual students for purposes of 42 U.S.C. § 1983. A parent cannot sue a school directly for damages under FERPA. What FERPA produces is administrative leverage and a documentary record that becomes evidence in any state tort or Section 1983 action that does carry a private right. Treat FERPA as the evidence-builder, not the remedy.
Common Mistakes
- Treating the school's internal grievance process as a substitute for filing with SPPO. It is not. The internal grievance creates a paper appearance of resolution that the district will cite later.
- Missing the one hundred eighty day window. The clock can run from discovery, not from the underlying event, but failing to document the discovery date is fatal.
- Failing to make the amendment demand in writing. Oral requests do not trigger the amendment-and-hearing procedure at 34 C.F.R. § 99.20.
- Naming individual teachers or staff members as defendants in the complaint. FERPA enforcement runs against the institution. Personal-capacity claims belong in a separate Section 1983 or state tort action.
- Assuming damages are recoverable through FERPA. After Gonzaga v. Doe, they are not. Use FERPA for findings; use the parallel tort or civil-rights claim for damages.
When to Bring in Bearpoint
The Foundation provides research, evidence architecture, and pressure-vector mapping for parents and advocates building a documented record before litigation. We do not represent clients and do not substitute for counsel. We make the lawyer's work cheaper by handing over a forensic file instead of a shoebox. If you are documenting a FERPA matter or mapping parallel filing vectors, email info@bearpointfdn.org with a short summary. We respond.