A FERPA violation can lead to federal investigation and required corrective action by a covered school or educational institution. FERPA is structured around conditions on federal education funding; it does not impose a standard per-record fine payable to each affected student. The facts, applicable disclosure exception, and institution’s response determine the enforcement issue. [1][2]
First identify the protected record and the disclosure
FERPA generally concerns records directly related to a student and maintained by an educational agency or institution, or someone acting for it. Not every comment about a student or every piece of information held by a school is an education record. The statute also permits specified disclosures without consent. [1]
A useful complaint identifies what information was released, who maintained it, who received it, when the release occurred, and why consent or an applicable exception did not authorize it. Preserve the actual email, portal access record, notice, or other evidence rather than relying only on a description from another person.
Institutional and individual consequences differ
The statute authorizes federal enforcement and restricts funding for covered noncompliance, while directing that enforcement follow unsuccessful efforts to secure voluntary compliance. Schools can also impose employment discipline under their own policies. Those personnel consequences are different from a federal FERPA penalty against an individual teacher. [1]
A vendor’s responsibilities can arise through the disclosure conditions and its agreement with the school. FERPA restricts certain redisclosures and can require a period without access to education-record information after specified third-party violations. Do not assume that outsourcing the records removes the school’s obligations. [1][2]
Who can complain and when
The Student Privacy Policy Office accepts written complaints from parents or students who hold the FERPA rights. Rights generally transfer when the student turns eighteen or attends a postsecondary institution. A complaint ordinarily must be filed within 180 days of the violation or when the complainant knew or reasonably should have known about it. [3]
The Department encourages attempting resolution with the institution before a FERPA complaint, but does not make that step mandatory for FERPA. Use the current complaint form, supply specific factual allegations, and retain proof of submission. [3]
The Supreme Court held in Gonzaga University v. Doe that FERPA’s relevant provisions do not create personal rights enforceable through Section 1983. An administrative privacy complaint should not be confused with a personal damages award. [4] Other state or federal claims require their own legal basis. Compare HIPAA access to a spouse's medical records and challenging a school's Section 504 decision to distinguish different education and privacy rights.
Primary sources
- 20 U.S. Code 1232g – Family Educational and Privacy Rights
- Family Educational Rights and Privacy Act (FERPA)
- File a Complaint
- Gonzaga University v. Doe, 536 US273 (2002)
Sources checked: October 31, 2026.