FERPA Violation Examples: What Counts and How Schools Prevent It

Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99) states that parents and eligible students have the rights to…

• …inspect education records,
• …request corrections,
• …control the disclosure of personally identifiable information in those records.

FERPA violation happens when a breach of any of them happens. However, what we have in reality is that almost all fall into the third category: improper disclosure.

Two definitions decide whether something is a violation.

• Education records are student records. Usually, the school maintains all of them. Just keep in mind that some things are excluded. Those are things like private notes made by teachers, law enforcement unit records, employment records and, as the Supreme Court confirmed in Owasso v. Falvo (2002), peer-graded work before the teacher records the marks.
• Directory information is the one that is generally not harmful if disclosed, as decided by the school. Usually, this info includes stuff such as a student's name, email, photograph, major, dates of attendance and honors. Schools can release it without consent after giving notice and an opportunity to opt out. Social Security numbers and student ID numbers can never be directory information.

The test: if the data is personally identifiable, comes from an education record, isn't directory information and no exception in 34 CFR § 99.31 applies, releasing it without written consent is a violation.

The examples below come up in K-12 districts and universities alike. Each one is a disclosure that FERPA requires consent for, with no exception to cover it.

1. Posting grades with identifiable information. A list of names and scores on a classroom door, or grades posted by student ID number, discloses education records to anyone who walks past.
2. Emailing records to the wrong recipient. A transcript sent to the wrong parent, or a group email with every student's grade visible to the whole class, is one of the most frequent FERPA violation examples for teachers. Intent doesn't matter.
3. Discussing a student's record with another parent. A disciplinary record can be called 'disclosed' if someone tells a parent that another child was suspended or why it happened. The same applies to hallway conversations and staff social media posts.
4. Releasing records to a non-custodial parent without checking. Both parents normally have FERPA rights unless a court order says otherwise. Refusing a parent who does have rights is a violation too.
5. Giving records to the parents of an adult student. When a young person turns 18 or goes to college, the rights belong to them. If their alma mater discusses grades with a parent, with no signed release and no dependent-student exception on file, it has violated FERPA. This is the classic higher-education case.
6. Providing answers to a public records request without redacting anything. Public records and FOIA requests often target school docs. If someone releases them with student names, ID numbers, or grades, all can be seen, we can call it a 100% disclosure violation, even though the request was lawful. The fix is redaction, not refusal.
7. Leaving files unsecured. A stack of IEPs on a reception desk or a shared drive with open permissions is a failure to protect records, and any resulting access is a disclosure.
8. Sharing data with vendors or researchers without an agreement. Edtech tools and research partners can receive records only under specific exceptions, with written agreements covering use and redisclosure. Uploading rosters with grades to an unapproved app is a violation.
9. Using a student's work or photo publicly without consent. Publishing anything like that on a school website/newsletter, unless the items are designated directory information and the family hasn't opted out.

Most of these share one feature: a document or message that contained more personal data than the recipient was entitled to see. That's a redaction problem, and it's the part of FERPA compliance that process and tooling can fix.

Some things schools worry about are allowed. Disclosing records to school officials with a legitimate educational interest, sending records to a school the student is transferring to, responding to a lawful subpoena (usually with notice to the family), and releasing information in a health or safety emergency are all permitted under § 99.31. A teacher's personal observations aren't education records either. Over-withholding can block legitimate requests, so the exceptions matter as much as the rule.

People often ask about FERPA violation fines. There aren't any in the statute. Enforcement works like this:

• The Student Privacy Policy Office (SPPO) at the U.S. Department of Education handles all complaints. If it finds a violation, it sets a reasonable period for voluntary compliance.
• If the school fails to comply, the Secretary of Education can withhold further federal payments. Plus, it can issue a cease-and-desist order or even terminate the school's eligibility for federal funding.
• A third party found responsible for a violation can be barred from receiving personally identifiable information from that school's records for at least five years.
• Under FERPA, students and their parents cannot sue schools for damages. The Supreme Court confirmed in Gonzaga University v. Doe (2002) that the law creates no private right of action.

As for the real consequences, they can be something like disciplinary action or termination for the employee involved, state privacy law claims, reputational damage, and the cost of a federal investigation. Our article on what happens if redaction fails covers how a single disclosure error can escalate.

If you need to report a FERPA violation, file a written complaint with SPPO by email at FERPA.Complaints@ed.gov or by mail. It must be filed within 180 days of the violation, or of when the person knew or should have known about it, and it must contain specific factual allegations. Most schools also have a FERPA officer or registrar who handles concerns first, which is usually the faster route to a fix.

Most violations are just the 'oops'. To avoid those oops, know what's protected, check before you release anything, and remove what the person behind the screen shouldn't see.

• Tell everyone who deals with records what to do. FERPA violations for teachers and front-office staff usually come from not knowing which data is protected. Annual training built on concrete examples works better than a policy document.
• Define directory information and honor opt-outs. Publish the annual notice, keep the opt-out list current, and check it before releasing any roster, photo or program.
• Verify authority before release. Confirm who the requester is, whether rights have transferred, and whether a release form is on file.
• Redact before you share. It doesn't matter what you deal with, be it a records request, transfer, or public records response. Redact everything. Take away all the names, student ID numbers, Social Security numbers, dates of birth, grades, and any other identifiers the recipient isn't entitled to. Black boxes drawn in a PDF editor often leave the underlying text searchable, which is how many disclosure errors happen; our guide on how to redact a PDF explains what permanent redaction looks like. For records departments handling volume, FERPA redaction software can detect student identifiers automatically across scanned and digital files and keep an audit trail of what was removed.
• Strip hidden data. PDFs carry metadata and comments that can expose student information after visible text is removed. See our article on how to remove metadata from a PDF before sending any education record outside the school.
• Control sharing channels. Use role-based permissions on student systems and shared drives, and avoid email for records where possible. Our guide to sharing sensitive documents securely covers the practical options.
• Log your releases. Record what was disclosed, to whom, and under which exception. If a complaint comes in, the log shows SPPO that your process works.

Whatever FERPA violation example you take a look at, in most cases, it's about someone releasing a record, or part of one, that the recipient had no right to see. The penalties usually have nothing to do with personal things. They're 100% institutional. However, the damage to students and to trust is real. Training, clear directory-information policies, and permanent redaction before any record leaves the building prevent most of them.