FERPA & AI Compliance

Overview

The Family Educational Rights and Privacy Act (FERPA) is a United States federal law enacted in 1974 that protects the privacy of student education records. Administered by the Student Privacy Policy Office within the U.S. Department of Education, FERPA applies to educational institutions and agencies that receive funding under programs administered by the Department, which includes virtually every public K-12 school, college, and university in the country. Violations can result in the withdrawal of federal funding, making FERPA a critical priority for educational institutions.

FERPA grants parents and eligible students (those 18 and older or attending postsecondary institutions) specific rights regarding education records. These include the right to inspect and review records, the right to request amendments to inaccurate records, the right to consent to disclosures of personally identifiable information (PII) from education records, and the right to file complaints with the Department of Education. When students reach age 18 or enter postsecondary education, these rights transfer from parents to the student.

For AI applications in education, FERPA creates significant constraints on how student data can be used. Adaptive learning platforms, early warning systems that predict dropout risk, automated essay scoring, and learning analytics dashboards all rely on student data that FERPA protects. Educational institutions must make sure that AI systems processing student records respect FERPA's consent requirements, disclosure limitations, and record-keeping obligations. The growing use of AI in education has prompted the Department of Education to issue guidance on how FERPA applies to ed-tech and AI-driven educational services.

AI-Specific Requirements

FERPA's consent requirements are central to AI use in education. Generally, institutions must obtain written consent from parents or eligible students before disclosing personally identifiable information from education records. There are several exceptions, including the "school official" exception (34 CFR 99.31(a)(1)), which allows disclosure to school officials with legitimate educational interests, and the "directory information" exception for basic information that the institution has designated as directory information. For AI systems, the school official exception is most commonly invoked when AI vendors process student data on behalf of the institution.

When educational institutions engage AI service providers under the school official exception, they must make sure that the provider performs an institutional service or function, uses PII only for the purposes specified in the agreement, is under the direct control of the institution with respect to the use and maintenance of education records, and complies with FERPA's restrictions on re-disclosure. The institution remains responsible for FERPA compliance even when using third-party AI services. This gives institutions a strong reason to keep control over student data rather than sending it to external cloud AI platforms.

FERPA also requires institutions to keep a record of each request for access to, and each disclosure of, personally identifiable information from education records (34 CFR 99.32), although disclosures to school officials with legitimate educational interests are exempt from that record. Even so, institutions need to know which systems and vendors hold education records and what they do with them. The Department of Education's guidance emphasizes due diligence on AI vendors, including their data security practices, data retention policies, and data deletion capabilities. Institutions that fail to maintain adequate oversight of AI vendors risk FERPA violations that could jeopardize their federal funding.

How Ertas Helps

Ertas Studio trains on Ertas's cloud GPUs, so a training dataset is uploaded to Ertas and stored so runs can be repeated. If it contains personally identifiable information from education records, uploading it is a disclosure that needs consent or an exception, such as the school official exception with the direct control that exception requires. For most projects the cleaner path is to de-identify first, removing names, student IDs and other identifiers so the records are no longer personally identifiable, and to edit and approve each example in Data Craft, Studio's dataset builder. You can delete uploaded datasets when the project ends.

Day-to-day use is where identifiable student data shows up, because staff and students ask about real records. Export the trained model as GGUF or safetensors and run it in the institution's own environment, and those prompts and outputs never reach Ertas, which keeps inference out of FERPA's disclosure questions. The institution owns the model, and its version stays fixed until it retrains. The adaptive model endpoint and enterprise builds can run the model in the institution's own cloud or on-premise.

Consent and annual notices, legitimate educational interest determinations, access control and logging where the model runs, and staff training stay with the institution.

Compliance Checklist