Why It Matters

A fresh Congressional Research Service report on FERPA legal issues lands at a moment when the 50-year-old student privacy law is being pulled in three directions at once: the Trump administration is using it as a weapon in the parental rights fight, immigration enforcement has created new ambiguity about what schools must hand over to federal agents, and the spread of artificial intelligence tools in classrooms is raising questions the statute was never designed to answer.

The central tension is structural. The Family Educational Rights and Privacy Act gives parents the right to access their children's education records and bars schools from releasing those records without consent, but enforcement depends almost entirely on the Department of Education, which can withhold federal funding from noncompliant schools. Students and parents cannot sue. That asymmetry means the law's meaning, in practice, shifts with the priorities of whoever runs the department.

The Big Picture

Congress passed FERPA in 1974 with two goals: guarantee parental access to education records and stop the widespread, often unauthorized sharing of student information with outside parties. The statute applies to any school receiving federal financial assistance from ED, a condition that covers virtually every public school and most private colleges in the country.

The law's core prohibition is broad: schools cannot release education records, including personally identifiable information, without written parental consent. But the prohibition is riddled with exceptions, and the CRS report devotes the bulk of its analysis to mapping them. Schools may share records with other school officials who have a legitimate educational interest, with state and local education authorities conducting audits, with law enforcement under specific conditions, and in health and safety emergencies. They may also release "directory information" like names, addresses, enrollment status, and similar basic data without affirmative consent, as long as they give parents advance notice and an opportunity to opt out.

Third-party technology vendors occupy a particularly murky corner of the law. Schools routinely share student data with outside software providers under the "school official" exception, which permits disclosure to contractors performing functions the school would otherwise handle itself. The provider must operate under the school's direct control and may only use the data for the specific purpose for which it was disclosed. The CRS report flags that the expansion of AI tools in classrooms may generate novel questions about whether student data processed by those tools is adequately protected - a gap the statute, written decades before such tools existed, does not directly address.

The report also highlights the statute's enforcement architecture as a defining limitation. FERPA does not create a private right of action. The Supreme Court confirmed in Gonzaga University v. Doe (2002) that the statute creates no personal rights enforceable through a lawsuit. ED's Student Privacy Policy Office handles complaints and can, in cases of non-compliance, withhold or terminate federal funding, but that threat is rarely carried to its conclusion.

Political Stakes

The most politically charged section of the CRS report involves parental access to information about students' gender identity, a fight that has now reached the Supreme Court and produced active federal enforcement actions.

Some states, including Iowa and Indiana, have passed laws requiring schools to notify parents when a student requests a change in pronouns. Several school districts in other states have moved in the opposite direction, adopting policies that prohibit disclosing a student's gender identity to parents without the student's consent. Parents in those districts have sued, arguing the policies violate their constitutional rights.

In 2026, the Supreme Court weighed in on an emergency basis. In Mirabelli v. Bonta, 146 S. Ct. 797 (2026), the Court partially reinstated a district court's injunction against California's non-disclosure policies, ruling that parents had adequately alleged violations of both the Free Exercise and Due Process Clauses of the Constitution. The Court found the California policies likely triggered strict scrutiny (the most demanding form of constitutional review) because they substantially interfered with parents' right to guide their children's religious development. The decision, issued through the Court's emergency docket, will likely shape how lower courts handle similar challenges going forward.

The Trump administration has moved aggressively on the same front through FERPA enforcement. On March 28, 2025, ED issued a Dear Colleague Letter declaring that school policies prohibiting parental access to information about students' gender identity violate educational records privacy law. ED subsequently found the California Department of Education out of compliance with FERPA on January 28, 2026, citing "gender support plans" maintained in separate filing systems inaccessible to parents. California's CDE issued guidance to schools on February 11, 2026, directing them to make such plans available to parents consistent with FERPA. ED also found four Kansas school districts in violation of federal law for similar policies in April 2026.

For Democrats and school districts that have implemented non-disclosure policies, the administration's enforcement posture presents a direct threat to those policies, backed by the potential loss of federal funding. For Republicans, the enforcement actions represent a tangible use of existing law to advance parental rights without requiring new legislation. For the public, the stakes are immediate: how schools handle a child's gender identity records now carries federal legal consequences.

Immigration Enforcement

The report identifies a second politically live question: whether schools must comply with administrative subpoenas from Immigration and Customs Enforcement seeking student records.

FERPA allows but does not require schools to disclose education records in response to a "lawfully issued subpoena." Immigration enforcement authority under federal law includes the power to issue administrative subpoenas. The CRS report notes that if an immigration administrative subpoena is issued consistent with federal statutory parameters, it might qualify as a lawfully issued subpoena under FERPA. But administrative subpoenas are not self-executing, and some schools may take the position that a court order is required.

Multiple states, including California, Illinois, New York, Massachusetts, and the District of Columbia, have issued guidance to school districts advising caution in responding to immigration enforcement requests. The legal question of whether those schools are on solid ground under FERPA remains unresolved.

For the administration, the ambiguity is a potential obstacle to enforcement. For Democratic-led states, the uncertainty provides legal cover to resist. For Congress, the CRS report suggests this is a gap that could be addressed through legislation clarifying schools' obligations.

The Bottom Line

The CRS report closes with a section on what Congress could do, and the options it outlines are pointed. First, lawmakers could amend FERPA to define schools' obligations more specifically when responding to immigration administrative subpoenas, resolving an ambiguity that has left schools, states, and federal agencies operating without clear rules.

Second, the report notes that a bill introduced in the 119th Congress, the Parental Rights Relief Act, would create a private right of action under FERPA, allowing courts to issue declaratory relief, injunctions, and attorneys' fees where violations are found. The report flags that Congress's ability to create such a right is not unlimited (the Constitution's Article III standing requirements mean plaintiffs would still need to demonstrate a concrete injury), but the absence of any private enforcement mechanism remains a structural weakness in the law.

FERPA is simultaneously being used as an active policy tool by the current administration and exposed as a statute whose ambiguities have not kept pace with the legal and technological landscape. The gender identity enforcement actions have demonstrated that ED is willing to use the funding threat as a lever.

Access the Legis1 platform for comprehensive political news, data, and insights.

Spot something wrong? Report an issue with this article