FERPA Compliance for EdTech Companies: The Complete Guide to Student Privacy and Winning School District Contracts
The Family Educational Rights and Privacy Act (FERPA) is the federal law governing student education record privacy. Enacted in 1974, FERPA gives parents and eligible students specific rights over their educational records and places strict limitations on how schools and their service providers can use and disclose student data.
For EdTech companies, FERPA is the gatekeeping standard for selling into K-12 school districts and higher education institutions. If you cannot demonstrate FERPA compliance, you cannot win education contracts.
This guide covers what FERPA requires, who it applies to, how it intersects with COPPA, what school district procurement teams look for, and how to build the compliance infrastructure needed to compete in the education market.
What FERPA Covers
FERPA protects education records — any records that are directly related to a student and maintained by an educational agency or institution, or by a party acting on its behalf. This definition is broad and includes:
- Grades, transcripts, and academic performance data
- Student identification numbers and demographic information
- Disciplinary and attendance records
- Special education records (IEPs, 504 plans)
- Financial aid records
- Health records maintained by the school (distinct from HIPAA-covered records)
- Any data generated by technology platforms used by the school that relates to individual students
FERPA does not cover de-identified data (where PII has been removed), directory information that the school has designated with proper notice and opt-out procedures, law enforcement unit records, or postsecondary treatment records.
Who FERPA Applies To
FERPA applies to educational agencies and institutions that receive federal funding — which includes virtually every public K-12 school district, community college, and university in the United States, as well as many private institutions that participate in federal financial aid programs.
Critically, FERPA's restrictions extend to third-party service providers that access student education records. Under the "school official" exception (34 CFR 99.31(a)(1)), a school can disclose education records to a contractor provided that the third party performs a service the school would otherwise use employees for, operates under the school's direct control regarding education records, uses records only for the disclosed purpose, and does not re-disclose PII without authorization.
For EdTech companies, this means that when a school district adopts your platform, you become a "school official" under FERPA — legally bound by the same restrictions on student data use that apply to the school itself.
Student and Parent Rights Under FERPA
FERPA grants three core rights:
1. Right to Inspect and Review
Parents (or eligible students) can inspect and review education records within 45 days of request. For EdTech companies, this means your platform must be able to export all data related to a specific student upon school request.
2. Right to Request Amendment
Parents can request amendment of records they believe are inaccurate or misleading. The school must respond within a reasonable time. If declined, the parent has the right to a formal hearing.
3. Right to Consent to Disclosure
Schools must generally obtain written consent before disclosing PII from education records. Key exceptions for EdTech companies include the school official exception (contractors performing institutional services), the directory information exception, and the studies exception (research conducted for or on behalf of the school).
FERPA vs. COPPA: Understanding the Overlap
EdTech companies serving K-12 students under 13 must navigate both FERPA and the Children's Online Privacy Protection Act (COPPA). These laws have overlapping but distinct requirements:
| Aspect | FERPA | COPPA |
|---|---|---|
| Governing agency | U.S. Department of Education | Federal Trade Commission (FTC) |
| Who it applies to | Educational institutions receiving federal funding and their service providers | Commercial websites and online services directed to children under 13, or that knowingly collect data from children under 13 |
| Consent mechanism | Consent flows through the school (the school authorizes vendors under the school official exception) | Requires verifiable parental consent — but the FTC has recognized that schools can provide consent on behalf of parents in the educational context |
| Data covered | Education records (directly related to a student, maintained by the school or its agent) | Personal information from children under 13 (name, email, geolocation, photos, voice recordings, persistent identifiers) |
| Key restriction | Data can only be used for the purpose for which it was disclosed | Cannot condition a child's participation on collecting more data than reasonably necessary |
| Enforcement | Complaint to the Family Policy Compliance Office; potential loss of federal funding | FTC enforcement actions; civil penalties up to $53,088 per violation (2026 adjusted) |
The practical overlap for EdTech: When a school directs students under 13 to use your platform, the school can provide COPPA consent on behalf of parents — but only for educational purposes. If your platform collects data beyond educational needs, you need direct verifiable parental consent.
The safest approach: do not collect more data than necessary, do not use student data for advertising, and do not share it with third parties for non-educational purposes. This satisfies both FERPA and COPPA simultaneously.
What School District Procurement Teams Require
Winning school district contracts requires more than claiming FERPA compliance — districts have become increasingly sophisticated in their vendor evaluation processes. Here is what procurement teams typically require:
Data Privacy Agreements (DPAs)
Most states have adopted standardized student data privacy agreements. The Student Data Privacy Consortium (SDPC) National DPA is the most widely used template. Districts expect EdTech vendors to sign a DPA that specifies:
- What student data the vendor will collect and process
- How the data will be used (limited to the educational purpose)
- Where the data will be stored (data residency)
- How long the data will be retained and how it will be deleted
- Security measures the vendor has in place
- Breach notification requirements and timelines
- Subprocessor disclosures (third parties the vendor shares data with)
- Data return and destruction obligations upon contract termination
Security Assessments
Districts increasingly require vendors to complete security questionnaires or provide evidence of security certifications. Common requirements include:
- SOC 2 Type II report — the most frequently requested security certification in education procurement
- Encryption at rest and in transit — minimum TLS 1.2 for data in transit, AES-256 for data at rest
- Annual penetration testing — with a summary of findings and remediation evidence
- Incident response plan — documented and tested
- Employee background checks and security training — evidence that personnel with access to student data are vetted and trained
State Student Privacy Laws
Beyond FERPA, 48 states have enacted their own student data privacy laws with additional requirements. Key state laws include:
- California (SOPIPA): Prohibits using student data for non-educational advertising, creating advertising profiles, or selling student information.
- New York (Education Law 2-d): Requires a data privacy and security plan, parental notification, and annual reporting by the Chief Privacy Officer.
- Illinois (SOPPA): Requires a DPA for every vendor contract, breach notification within 30 days, and an annual data inventory published by the district.
- Colorado, Connecticut, Virginia, and others have enacted comprehensive data privacy laws with student data provisions.
EdTech companies selling nationally must comply with the most restrictive combination of federal and state requirements. In practice, this means designing your data practices to meet the strictest state requirements by default, rather than customizing by state.
Building FERPA Compliance Infrastructure
Technical Controls
Data minimization. Collect only the student data elements necessary for the educational service. If your platform does not need a student's home address to function, do not collect it.
Access controls. Implement role-based access with the principle of least privilege. Teachers should see only their students' data. District administrators should see only their district's data. Your support engineers should have access only when troubleshooting, with audit logging.
Encryption. Encrypt student data at rest (AES-256) and in transit (TLS 1.2+). Manage encryption keys separately from the data. Use the cloud provider's key management service (AWS KMS, GCP Cloud KMS, Azure Key Vault) with customer-managed keys for districts that require it.
Data retention and deletion. Implement automated data retention policies. When a contract ends, student data must be deleted or returned per the DPA terms — typically within 30-60 days. Build the deletion capability before you need it, not when a district asks for it.
Audit logging. Log all access to student data — who accessed what records, when, and from where. Retain logs for at least one year. These logs are essential for responding to data requests, investigating potential breaches, and demonstrating compliance during procurement reviews.
Breach detection and notification. Implement monitoring for unauthorized access to student data. FERPA does not specify a breach notification timeline, but most state laws require notification within 30-72 days. The SDPC DPA template typically requires notification within 72 hours.
Administrative Controls
FERPA training. Train all employees who handle student data on FERPA requirements, data handling procedures, and incident reporting. Document the training and maintain completion records.
Vendor management. If you use subprocessors (cloud providers, analytics services, support tools) that may access student data, ensure they are disclosed in your DPA and that your contracts with them include FERPA-aligned data protection terms.
Incident response. Maintain a documented incident response plan that specifically addresses student data breaches, including notification procedures for affected schools, districts, and state authorities.
How QuickTrust Helps EdTech Companies
QuickTrust supports EdTech companies building the compliance infrastructure needed to win school district contracts and meet FERPA requirements at scale.
Framework mapping. QuickTrust maps FERPA, COPPA, state student privacy laws, and SOC 2 requirements into a unified control set, identifying overlaps and eliminating duplicate implementation work. Many of the technical controls required for FERPA (encryption, access controls, logging, incident response) are the same controls required for SOC 2 — building both simultaneously is significantly more efficient than pursuing them separately.
Technical implementation. QuickTrust's engineering team implements the cloud infrastructure controls that district procurement teams evaluate: encryption configuration, IAM policies, centralized logging, network segmentation, automated backup and retention policies, and breach detection monitoring. These controls are implemented directly in your AWS, GCP, or Azure environment.
Evidence collection. QuickTrust's platform maintains an auditable evidence library that demonstrates compliance to procurement evaluators. When a district asks for evidence of encryption at rest, access review procedures, or penetration testing remediation, the evidence is organized, current, and ready to submit.
DPA support. QuickTrust helps EdTech companies review and respond to DPA requirements, ensuring that the technical controls and administrative processes described in the agreement are actually implemented and documented.
Conclusion
FERPA compliance is the price of entry for the education market. School districts are legally required to ensure their technology vendors protect student data, and they have become increasingly rigorous in evaluating vendor compliance. EdTech companies that treat FERPA as an afterthought — collecting data without clear justification, signing DPAs without implementing the required controls, or scrambling to respond to procurement questionnaires — lose contracts to competitors who have built compliance into their product and operations from the start.
The companies winning education contracts in 2026 have three things in common: a SOC 2 Type II report, a signed SDPC National DPA, and the ability to demonstrate — with evidence, not promises — that their technical controls meet the requirements specified in both. Building that compliance infrastructure takes focused effort, but the return is access to a $35 billion domestic EdTech market where compliance is the most effective competitive differentiator.