Last week, the Department of Education’s Student Privacy Policy Office (SPPO) issued a Dear Colleague Letter to Chief State School Officers and Superintendents that requires certification of compliance with the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA) by April 30, 2025.  Specifically, ED is requiring each state agency to submit documentation no later than April 30, 2025, confirming that both the agency and local school districts are complying with FERPA and PPRA, particularly in relation to the identified priority concerns. We anticipate that state education agencies will provide guidance on the specific steps districts must take to demonstrate compliance. 

According to Secretary of Education Linda McMahon, “many states and school districts have enacted policies that presume children need protection from their parents” and are evading or misapplying FERPA. Therefore, going forward, “the Department of Education will insist that schools apply FERPA correctly to uphold, not thwart, parents’ rights.” 

At the direction of Secretary McMahon, the SPPO’s letter identified several areas of priority concern and the proactive measures the office intends to take to address them.  

• Parent Right to Inspect and Review. Schools must ensure policies and practices do not circumvent parental access to inspect and review education records. The SPPO specifically identifies the practice of schools creating “gender plans” for students and then denying parental access by claiming these plans are not education records. According to SPPO, FERPA does not distinguish between an “official student record” or “cumulative file” – any information directly related to a student and maintained by an educational agency is part of the student’s “education records” to which parents have a right to inspect and review.  

• Student Safety. Schools should not withhold information from parents that identifies other students who have made death threats against their children. The letter explains that to the extent an education record in question directly relates to more than one student and the information cannot be segregated and redacted without destroying its meaning, the parents of both students have the right to inspect and review that information.  

• Annual Notification. Schools must comply with FERPA’s annual notification requirements, which can include publication in the school activities calendar, newsletter, student handbook, or displayed prominently on the school’s website.  

• Military Recruiters. Schools must provide student information to military recruiters, when requested, unless the parent has opted out of providing such information.  

In preparation for the certification requirement, districts are encouraged to conduct a self-audit of their policies, procedures, and handbooks to ensure alignment with FERPA and PPRA requirements.  

The DCL was issued alongside the SPPO’s launch of investigations into the California and Maine Departments of Education for potential FERPA violations. The SPPO reports that California schools may be inadvertently violating FERPA while trying to comply with a newly enacted state law, the “Support Academic Futures and Educators for Today’s Youth Act.” In Maine, the SPPO has reportedly received multiple complaints of schools potentially violating or misapplying FERPA by adopting policies that limit parental rights, such as claiming “gender plans” are not education records. 

Under federal law, failure to comply with FERPA could result in loss of federal funds. Typically, an extensive administrative process is required before funds can be cut off, which includes an opportunity to be heard and an appeal process. The administration, however, has been moving quickly to withhold funds at the outset of recent Title VI and Title IX investigations, compelling schools and universities to negotiate agreements or file lawsuits seeking injunctions. Districts are encouraged to seek legal counsel regarding these obligations under FERPA and PPRA and the steps that should be taken to evaluate and certify compliance.