FERPA is the United States statute governing the privacy of student education records. It gives parents, and students once they turn eighteen, the right to inspect and seek correction of those records, and it restricts disclosure without consent — with exceptions for school officials with a legitimate educational interest, and for vendors operating under the school official exception.
FERPA
Statute United States
FERPA is the statute every American EdTech contract is written against, and its central mechanism is consent and delegation rather than security. A school may share records with a vendor acting as a school official, under direct control, for a defined purpose — which is a delegation of authority, negotiated in a contract and described nowhere machine-readable.
- Inspection and correction - Parents and eligible students may see the record and challenge what is in it.
- Consent before disclosure - The default is no disclosure, with enumerated exceptions rather than a general permission.
- The school official exception - How vendors lawfully hold student data: under the institution’s direct control, for a defined purpose.
- Directory information - A carve-out institutions define themselves, with an opt-out — one of the few places a student choice becomes data.
- Enforcement through funding - The remedy is federal funding, not a private right of action, which shapes how seriously it is treated.
FERPA governs disclosure and asks nothing about interfaces, which is the pattern this research has recorded in every regulated market. Its distinctive feature is that the permission it turns on is delegated — a parent for a child, an institution for both, a vendor under the institution’s control. The State of Education & EdTech APIs measures consent and delegated identity as a legible surface at 3.3% of the education market. In the sector where the data subject is most often a minor and the authority is always delegated, that surface is effectively absent.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of Education & EdTech APIs
The delegation statute of US education — a parent for a child, an institution for both — in a market describing consent and delegated identity at 3.3%.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
WCAG
Unrelated in subject, related in pattern: both are obligations institutions meet without publishing a machine-readable artifact.
