Directory information
Directory information is the category of student information a school may disclose without consent, provided it has given public notice of what it designates, told parents they may opt out, and allowed a reasonable period to do so (34 CFR § 99.37).
| Item | Typically designated | Risk note |
|---|---|---|
| Name | Yes | Combined with a school and grade it is identifying in a small community |
| Photograph | Yes | The item that generates the most complaints; opt-outs are frequently missed at the newsletter stage |
| Grade level and enrolment status | Yes | Low risk alone, identifying in combination |
| Dates of attendance | Yes | Means the period enrolled, not daily attendance |
| Participation in activities and sports | Yes | Routine, and the basis of most programme printing |
| Weight and height of athletic team members | Yes | Narrow by design; only for team members |
| Honours and awards | Yes | Low risk |
| Address and telephone listing | Varies | Triggers the military recruiter and higher-education access question |
| Email address | Varies | Designating it makes the student contactable by anyone who asks |
| Social security number | Never | Cannot be directory information under any designation |
| Student ID usable alone to access records | Never | An identifier that unlocks records cannot be public |
What the notice has to do
The designation only works if the notice does. A district must publish, annually, the specific categories it treats as directory information, the fact that it may disclose them without consent, and how and by when a parent may refuse. A notice that says "the district may release directory information as permitted by FERPA" without listing what it means has not given anyone a real choice.
Two further points districts get wrong. First, the opt-out is a refusal of disclosure to the public. It does not stop the district from using the information internally, and it does not stop disclosures made under a different exception. Second, a district may limit disclosure to specific parties or for specific purposes, but if it does so it must do that consistently rather than case by case.
Federal law separately requires districts receiving certain funds to give military recruiters and institutions of higher education the same access to student names, addresses and telephone listings that they give other parties, with a parent opt-out. Districts commonly run that as a separate opt-out on the same form, and commonly then hold two flags that must both be honoured.
Where the opt-out flag actually gets lost
The legal analysis is the easy part. The operational failure is that the opt-out is collected once, in one system, and then has to be honoured in every downstream place a student's name might surface.
- The SIS holds the flag, and generally honours it.
- The yearbook and athletics programme are produced by staff working from an export taken before the opt-out window closed.
- The newsletter is written by a school secretary who has never seen the flag, from photographs taken on a phone.
- The website and social accounts are updated by whoever has the password.
- The communications platform may or may not receive the field at all, depending on what the roster feed carries.
If your roster feed does not carry the directory-information flag, no downstream system can honour it, and no amount of policy fixes that. It is worth asking, once, which of these five surfaces can actually see the field today.
The complaint that arrives every October. A parent opts their child out in September. In October the child appears in a photograph in the school newsletter, because the newsletter is produced outside the SIS by someone who was never given the list. This is not a FERPA analysis problem. It is a data-plumbing problem that presents as a FERPA complaint.
What it means for a communications platform
A school-home communications platform generally does not operate on directory information at all. It operates under the school official exception, because it holds far more than the directory categories: guardian relationships, contact points, language preference, message history.
That distinction matters in an RFP. A vendor that answers a privacy question by pointing at directory information has misread its own position, because nothing about the directory-information rule authorises holding a guardian's mobile number and a delivery log.
Where the flag does matter to the platform is publication features — anything that puts a student's name or photograph in front of an audience wider than that student's own family. Kastr does not ship photo or file attachments today, which removes the most common way an opt-out gets breached, and removes a feature many districts want. That is a gap, stated as one.
This entry describes what the rule says. Whether and how it applies to your district is a question for your own counsel, not for a vendor.
Questions people actually ask
Can a school publish a student's photograph without consent?
Only if photographs are designated directory information in the district's annual notice, the parent has had a reasonable opportunity to opt out, and no opt-out is on file for that student. Districts with a separate media-release form are usually operating a stricter policy than FERPA requires, which is permitted.
What is the deadline for a directory information opt-out?
FERPA requires a reasonable period after the annual notice rather than a fixed federal date, so districts set their own window, commonly a few weeks into the school year. The window and the method must both be stated in the notice. Late requests are usually honoured as policy rather than as an obligation.
Does a directory information opt-out block emergency messages?
No. The opt-out concerns public disclosure of designated categories. It does not affect the district's ability to contact a family, and it is a different mechanism from an SMS opt-out or a channel preference. Conflating the two is how districts end up unable to reach a family in an emergency.
Are student email addresses directory information?
Only if the district designates them, and many deliberately do not, because designating an address makes a student contactable by any member of the public who asks. An identifier that can be used alone to gain access to education records cannot be designated at all.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.