At the start of the 2026-27 school year, the U.S. Department of Education’s Student Privacy Policy Office (SPPO) issued a Dear Colleague Letter reiterating the legal requirements for local education agencies and state education agencies around education records under the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA). This is a required notice under federal regulations, yet this Letter also emphasized particular points of potential noncompliance and reiterated that noncompliance can result in the loss of federal funding.
The Letter began by outlining the general requirements of FERPA and PPRA, focusing on the components of the laws related to parents’ rights. But the bulk of the Letter focused on what the SPPO stated to be “several areas of concern identified over the last year” and SPPO’s efforts, at Education Secretary Linda McMahon’s direction, to take “proactive measures” to address these issues.
Surveying and Evaluating Students
First, the Letter discussed what the SPPO noted to be “Non-Compliance with PPRA” based on “the quantity of complaints filed with SPPO and various media reports” reviewed by the Department. The Letter reiterated that PPRA requires school districts to provide specific notification to parents, and obtain parental consent, regarding particular surveys or evaluations given to students and the administration of certain types of physical exams or screenings. The PPRA also requires schools to work with parents collaboratively on the policies regarding such notice and consent requirements, and affords parents the opportunity to request to inspect certain instructional materials used as part of the curriculum.
Specifically, parents must consent before students are required to submit to a survey, evaluation, or analysis that concerns any of the following eight protected areas:
political affiliations or beliefs of the student or the student’s parent;
mental or psychological problems of the student or the student’s family;
sex behavior or attitudes;
illegal, anti-social, self-incriminating, or demeaning behavior;
critical appraisals of other individuals with whom respondents have close family relationships;
legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers;
religious practices, affiliations, or beliefs of the student or student’s parent; or
income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).
While the Letter noted that surveys or evaluations on any of these eight areas require parental consent, it focused on one area: “mental or psychological problems of the student or the student’s family.” The Department noted that many “mental health screening instruments” require students to answer questions about their “emotional wellbeing, internalized distress, social interactions, and other indicators of psychological or mental states or conditions,” which the Department clarified it considers to be instruments that elicit information that falls within the PPRA. Therefore, prior written parental consent is required before any such screeners can be administered to students. Schools should do an internal review of any such surveys, screeners, questionnaires, evaluations, etc., that could possibly touch on such topics to determine whether parental consent needs to be obtained in advance of the use of such instruments.
Parental Access and Inspection Rights
Another category of focus in the Letter is the PPRA and FERPA “Annual Notifications of Rights.” The Department states that “[m]any [local education agencies] are not effectively notifying parents . . . [and] eligible students of their rights under PPRA and FERPA.” The Letter notes that school districts are not required to provide individual notices to parents and eligible students but are required to provide notice “by such means that are reasonably likely to inform parents of their rights.” The Department is making it a point of emphasis in its enforcement this year to “ensur[e] that schools communicate these annual notifications clearly and effectively to parents.” The Letter stated notice could be provided via publication in the school activities calendar, newsletter, student handbook, or prominently displayed on the school’s website. While the Department provides latitude to schools to determine how to provide the annual notifications, schools should review their processes to ensure their notices are effectively reaching parents and eligible students.
The Department also emphasized the “Parental Right to Inspect and Review Education Records” and the fact that schools must have policies and practices that do not conflict with parents’ rights to “inspect and review” their children’s education records under FERPA. The Department takes the position that some school districts have engaged in such conflicting practices at the direction or with the tacit approval of the state education agencies. One specific example the Department cited was that “[m]any schools create ‘gender plans’ for students and assert these plans are not ‘education records’ under FERPA and therefore must be inaccessible to the parent.” The Letter noted the Department has investigated school policies keeping “‘gender’ related records in a separate file, distinct from a student’s ‘official record,’ or otherwise not classified as education records under FERPA.” The Letter reiterated prior guidance from the Department that FERPA requires schools permit parents to “inspect and review” all education records of their child upon request and added that “FERPA does not distinguish between a student’s ‘official record,’ ‘cumulative file,’ or ‘unofficial records.’” The Department acknowledged this guidance is in conflict with some state regulations and court rulings, so schools should consult counsel regarding appropriate next steps.
FERPA Contractor Rules
The Letter also discusses the practice of schools outsourcing institutional services or functions and that this outsourcing may include disclosing personally identifiable student information to outside contractors or other third parties. The Letter reiterated the “outsourcing” provisions of FERPA, which require:
the third party be performing a service or function the school would otherwise use employees to perform;
the school maintaining “direct control” over the third party’s use and maintenance of the education records; and
the school making clear to the third party that it is subject to FERPA’s requirements governing the use and redisclosure of personally identifiable student information from education records.
These requirements are not new, but the Letter indicates a renewed federal focus on this issue. School districts should review their policies and practices, as well as their contracts with third parties, to ensure these requirements are met.
Technology and Student Information
The Letter noted that SPPO receives questions and complaints about the use of personal devices by teachers in the classroom and the use of apps and other third-party web-based tools used by students as part of classroom curriculum. The Department noted FERPA does not directly address these issues, since FERPA does not protect the confidentiality of information in general but, instead, governs the disclosure of personally identification student information contained in education records maintained by the school. Still, Ohio’s Student Privacy Law unquestionably prohibits school employees from distributing personally identifiable information about students, of which photos would be included, outside of the district’s policies. Individual districts may also have board policies restricting employees from taking and sharing photos of students at school. Thus, in practice, the Letter should not change schools’ approaches on this issue.
Overall, the Letter highlighted the Department’s emphasis on the rights of parents and eligible students under FERPA and PPRA, and the Department’s anticipated investigation and enforcement efforts moving forward. Schools should ensure they continue to make compliance with these laws a priority.