FERPA
FERPA — the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, with regulations at 34 CFR Part 99 — gives parents rights over their children's education records and limits when a school may disclose personally identifiable information from those records without written consent.
| Artefact | Education record? | Why |
|---|---|---|
| Mass robocall to every family, no student named | No | Not directly related to a student and not maintained about one |
| Attendance letter naming a student | Yes | Directly related to a student and maintained by the district |
| Teacher text to one parent about a grade | Usually | Content decides it; a grade discussion is directly related to a student |
| Message log showing who was sent what | Yes | Maintained, student-linked, and discoverable on a records request |
| Guardian phone number and language preference | Yes | PII about a student's family held in the district's records |
| Sole-possession note a teacher keeps for themself | No | Excluded while it stays sole-possession and is shown to no one |
| Bus roster | Yes | Student-linked list maintained by the district |
| Photo in a school newsletter | Depends | Often handled as directory information with notice and opt-out |
| Translation cache holding message text | Depends | Only if the cached string identifies a student |
What FERPA actually gives parents
Four rights, and they are narrower and more procedural than the popular summary suggests:
- Inspect and review their child's education records, with the school responding within a defined period.
- Seek amendment of records the parent believes are inaccurate or misleading, with a hearing if the school declines.
- Consent to disclosure of personally identifiable information from those records, subject to a list of exceptions.
- Complain to the Student Privacy Policy Office at the US Department of Education.
Rights transfer to the student at 18 or on enrolment in a postsecondary institution, at which point the student becomes an "eligible student". Schools must issue an annual notification of these rights, and that notification is also where a district defines its criteria for who counts as a school official and what constitutes a legitimate educational interest.
Two things FERPA is not. It is not a general data-security statute — it says almost nothing about encryption, access control or breach notification. And it carries no private right of action; a parent cannot sue a district or a vendor under FERPA. Enforcement runs through the Department, whose ultimate sanction is withdrawal of federal funding, which has never been applied to a school district. The practical consequence is that FERPA compliance is enforced locally, through district policy and vendor contracts, or it is not enforced at all.
How a vendor sits inside it
FERPA binds the educational agency, not the software company. A vendor is reached indirectly, through the school official exception: a contractor may receive PII from education records without parental consent if it performs an institutional service the district would otherwise use its own employees for, is under the district's direct control with respect to the use and maintenance of those records, and is bound by the same redisclosure limits that apply to the district (34 CFR §§ 99.31 and 99.33).
"Direct control" is the phrase that does the work, and it is a contractual state, not a technical one. It means the vendor may use the data for the purpose the district specified and for nothing else. A vendor that uses district data to build a family-facing product it sells separately is not under direct control, whatever its marketing says.
Part 99 also requires the district to keep a record of disclosures (§ 99.32) for most non-consent disclosures, available to the parent on request. Districts routinely discover at audit that they can produce this for transcripts and cannot produce it for anything a vendor did.
Where Kastr sits. Every read of district data happens under Postgres row-level security enforced through a non-owner, DML-only database role, so a query with no organisation context returns zero rows rather than everything; a cross-tenant leakage suite runs in CI against real Postgres, including a check that table ownership cannot silently bypass the policies. Administrative actions are written to an append-only audit log whose entries are SHA-256 hash-chained, so an edit or deletion breaks the chain. Contract clause 9.4 forbids us marketing or selling to district families, ever, and forbids family-facing subscription revenue — the direct-control question answered in writing rather than in a values statement.
The misconceptions worth correcting
"FERPA means we cannot share student names with a vendor." It does not. The school official exception exists precisely so districts can use contractors. What FERPA requires is that the arrangement meets the conditions and that the district can show it does.
"The vendor is FERPA compliant." A vendor cannot be FERPA compliant in the way a district can, because the obligations do not attach to it. What a vendor can be is contractually bound in a way that lets the district remain compliant. Treat "FERPA compliant" on a marketing page as a claim requiring a contract behind it — usually a data privacy agreement.
"FERPA covers everything about a student." It covers records maintained by the agency. It does not reach a teacher's memory, a sole-possession note, or in most readings a message a parent forwards to a journalist. Nor does it displace state law, which in several states is now considerably stricter than FERPA and carries penalties FERPA does not.
"Deleting the record satisfies a parent request." FERPA gives a right to seek amendment of inaccurate records, not a general right to erasure. Districts also have state records-retention schedules that may forbid deletion. These two obligations conflict more often than either statute admits.
Questions people actually ask
Is a text message to a parent a FERPA education record?
It depends on content, not channel. A message directly related to an identified student and maintained by the district — an attendance notice, a grade discussion — is generally an education record. A district-wide closure alert naming no one generally is not. The delivery log linking students to messages usually is.
Does FERPA apply to a communications vendor?
Not directly. FERPA binds the educational agency. A vendor receives data under the school official exception, which requires that it performs a service the district would otherwise perform, is under the district's direct control as to use of the records, and is bound by the same redisclosure limits.
Can a district share student names with a vendor without consent?
Generally yes, under the school official exception, provided the conditions are met and the district's annual notification defines its school-official criteria. This is the ordinary basis on which rostering, messaging and assessment vendors operate. Confirm the analysis with your own counsel.
What must a district record when it discloses student records?
Part 99 requires a record of most non-consent disclosures — who received the information and the legitimate interest they had — kept with the student's records and available to the parent. Disclosures to school officials under the district's own criteria are treated differently, which is why those criteria need to be written down.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.