A FERPA violation happens when a school discloses personally identifiable information (PII) from a student’s education records without consent and outside the law’s exceptions, or when it denies parents and eligible students their rights over those records.
Most violations are accidental: a grade report goes out with reply-all, a transcript lands in the wrong inbox, or an honor roll is published without checking who opted out.
The Family Educational Rights and Privacy Act (FERPA) applies to every school and district that receives U.S. Department of Education funding. The FERPA violation examples below are the ones that show up most in parent complaints and internal reviews, each with a way to prevent it.
Here are the 10 most common:
- Unauthorized disclosure of grades
- Letters of recommendation containing PII
- Group emails to multiple recipients
- Discussing a student’s information publicly
- Explaining a student’s absence without consent
- Mishandling records on digital platforms
- Improper release of directory information
- Leaving student records unsecured
- Failure to provide access to student records
- Improper disposal of records
Why FERPA Violations Are Hard to Avoid
FERPA defines PII broadly.
Beyond names and student IDs, it covers any information that, alone or in combination, is linkable to a specific student. Staff are left deciding case by case whether a detail in an email, a text, or a hallway conversation identifies someone.
The law’s exceptions add another layer of judgment. Directory information can be shared without consent unless a family has opted out, and each school decides what counts as directory information.
“Legitimate educational interest” is also defined locally in each institution’s annual FERPA notice, so the line between authorized and unauthorized access shifts from one district to the next.
Visibility is an even harder problem, because student information now moves through email, text messages, Teams and Google Chat, edtech platforms, and AI chatbots. Many districts capture only some of those channels. Text messages are a common blind spot, since carrier-based archiving misses iMessage and RCS entirely. A disclosure in an uncaptured channel leaves nothing the district can search, so it usually surfaces only when a parent complains or a records request comes in.
AI tools are the newest version of this gap. When staff paste grades or disciplinary notes into a generative AI chatbot, the conversation sits on a vendor’s servers, outside the district’s archive.
Thin IT staffing and uneven training make these gaps harder to close, especially in districts where a single administrator handles records requests, retention, and privacy questions.
10 Common FERPA Violation Examples
The table below summarizes common examples of FERPA violations, where they happen, and how to prevent each one.
| Violation | Typical scenario | Channel | How to prevent |
| Unauthorized disclosure of grades | Grades posted with names or student IDs | LMS, bulletin boards, email | Share grades through password-protected portals |
| Letters of recommendation containing PII | GPA or class rank included without consent | Letters, email | Get signed consent before using record details |
| Group emails to multiple recipients | Recipient list reveals a protected group | Use BCC and check recipient lists | |
| Discussing a student’s information publicly | Grades or discipline discussed where others can hear | In person, staff group chats | Limit discussions to authorized staff in private |
| Explaining a student’s absence without consent | Medical or family reasons shared with other parents | In person, text, email | Use neutral wording unless consent is on file |
| Mishandling records on digital platforms | Transcript sent to the wrong address, over-shared cloud folder | Email, cloud storage, Teams | Verify recipients, encrypt, and restrict sharing |
| Improper release of directory information | Honor roll published with opted-out students | Website, social media, print | Check opt-out records before every release |
| Leaving student records unsecured | Open SIS session or files on an empty desk | Workstations, paper files | Lock storage and set automatic screen locks |
| Failure to provide access to student records | Parent request delayed past 45 days | Records office | Log and track every access request |
| Improper disposal of records | Printed records in the recycling bin | Paper, hard drives, backups | Shred paper and use certified data destruction |
Unauthorized disclosure of grades
Posting or sharing grades in a way that identifies a student, without consent, is one of the most frequent FERPA violation examples.
A list of exam scores on a classroom door or in a shared LMS folder counts even when it uses student ID numbers instead of names, because those numbers can be linked back to individual students.
Prevention tip: Use password-protected systems to share grades securely and ensure that only the student can access their information.
Letters of recommendation containing PII
A recommendation letter based on a teacher’s personal observations doesn’t require consent.
The problem starts when the letter includes information from the education record, such as GPA, class rank, or test scores. Even a well-meant letter for a scholarship or job application becomes an unauthorized disclosure if there’s no signed consent on file.
Prevention tip: Before writing a letter of recommendation, get the student’s written consent to include any education record details and keep the consent on file.
Group emails to multiple recipients
Many schools designate student email addresses as directory information, but the recipient list itself can still disclose protected information.
An email sent to every student on academic probation, or to every parent whose child failed a course, tells each recipient who else belongs to that group. If some families have opted out of directory information, exposing their addresses in the To or CC field is a violation on its own.
Prevention tip: Always use the BCC field for group emails to prevent recipients from seeing each other’s email addresses.
Discussing a student’s information publicly
FERPA covers oral disclosures of information from education records as well as written ones.
A conversation about a student’s failing grades or disciplinary record in a hallway or a busy staff room can reach people with no legitimate educational interest.
The same applies to staff group chats that include coaches, volunteers, or employees outside the student’s support team.
Prevention tip: Keep discussions about specific students private and limited to staff who need the information to do their jobs.
Explaining a student’s absence without consent
Telling another parent that a student is out because of a medical condition or a family situation discloses information the school holds in that student’s record.
A coach who explains that a player is benched because of grades or a suspension makes the same kind of disclosure, regardless of intent.
Prevention tip: Use neutral wording such as “the student is unavailable” unless the family has consented to more detail.
Mishandling records on digital platforms
Digital tools create new ways to disclose records, and most of them come down to a wrong click or a loose setting.
Common examples include:
- A transcript emailed to the wrong address
- Another student’s grades visible in a browser tab during a screen share
- Records stored in a shared cloud folder with overly broad permissions
- A disciplinary issue discussed in a Teams channel open to staff without a legitimate educational interest
- Student records forwarded to a personal email account when a staff member leaves
- Identifiable student work or photos posted online without consent
Prevention tip: Adopt secure email systems, verify recipient details, and use encryption when transmitting sensitive student records electronically.
Improper release of directory information
Schools can release directory information, such as names, honors, and activities, without consent as long as families had the chance to opt out.
The violation happens when a school ignores those opt-outs, for example by publishing an honor roll or a sports roster that includes students whose families declined.
Prevention tip: Keep a current opt-out list and check it before anything goes on the website, district social media accounts, or in print.
Leaving student records unsecured
A folder of grades left on an empty desk or a computer still logged in to the student information system exposes records to anyone who walks by.
Even if no one looked, the school hasn’t used reasonable methods to limit access to staff with a legitimate educational interest, which FERPA requires.
Prevention tip: Always store physical records in locked cabinets and password-protect digital files. Use secure logins for computers and file management systems.
Failure to provide access to student records
Parents and eligible students have the right to inspect education records, and schools must respond within a reasonable time, no later than 45 days after the request.
Losing track of a request, or refusing it without a valid reason, violates that right.
Prevention tip: Establish clear procedures for handling requests for education records and ensure compliance with the required timeline.
Improper disposal of records
Records containing PII that aren’t destroyed securely can be recovered and read by anyone who finds them.
The usual cases are printed grade sheets or disciplinary notes thrown in a regular recycling bin, and digital files deleted from a folder but still recoverable on a hard drive or in backups.
Prevention tip: Shred paper records and use certified data destruction for drives and devices once records reach the end of their retention period.
Emerging FERPA Risk Areas
The newest FERPA violation examples involve AI tools, cloud platforms, and third-party services, where one bad setting can expose records for an entire school.
AI tools and student data
Note-taking apps, chatbots, and AI tutoring platforms can expose student PII when staff enter it without safeguards.
Grades, disciplinary records, or counseling notes pasted into a generative AI tool may be processed or stored outside the school’s control, especially when there’s no data agreement with the vendor and no record of what was shared.
Third-party edtech platforms
Schools rely on edtech vendors for classroom management, assessment, messaging, and analytics. A vendor can receive student records without consent as a “school official” only when it meets all of these conditions:
- It performs a service the school would otherwise handle with its own staff.
- It’s under the school’s direct control regarding the use and maintenance of education records.
- It uses the data only for the authorized purpose and doesn’t pass it on.
If a vendor falls short on any of them, sharing records with it is a disclosure the school is responsible for.
Cybersecurity threats and data breaches
Ransomware, compromised accounts, and phishing can expose transcripts, contact details, and disciplinary records in bulk.
A breach isn’t automatically a FERPA violation, but investigators can look at whether the school used reasonable safeguards. The faster a district isolates affected systems, reviews audit trails, and confirms what was exposed, the smaller the incident stays.
Remote and hybrid learning environments
Video classes, shared drives, and parent messaging apps multiply the places where records can leak, from class recordings shared beyond the class to messaging tools that show families each other’s contact details.
Each platform adds sharing settings that someone has to configure and review.
FERPA Violation Consequences and Penalties
FERPA has no fines and no private right of action, so FERPA violation consequences come through the Department of Education, state law, and public scrutiny.
Federal enforcement and funding
Parents and eligible students file complaints with the Student Privacy Policy Office (SPPO). When SPPO finds a violation, it first asks the school to comply voluntarily, usually through a resolution agreement that requires policy changes, staff retraining, and follow-up reporting.
If a school refuses, the Department can impose the most serious FERPA violation penalties: withholding federal payments, issuing a cease-and-desist order, or ending the school’s eligibility for federal funds.
Historically, the Department hasn’t withdrawn federal funding from any institution solely for a FERPA violation, but enforcement has tightened in 2026. In June, the Department signed interagency agreements with the Justice Department, and SPPO has since referred districts that declined voluntary resolution for enforcement that could include court proceedings and loss of federal funding.
Topeka Public Schools’ August 2026 resolution agreement requires its FERPA training content to be pre-approved by SPPO.
These 2026 cases center on parents’ access to records about students’ gender identity, which makes failure to provide access a live enforcement risk.
Lawsuits under state law
FERPA doesn’t let parents or students sue, but state privacy laws, breach notification statutes, and negligence claims do.
After a disclosure, districts can face settlements, court judgments, and penalties from state regulators.
Reputational damage
Reputational damage usually arrives first.
An investigation can take months, but a publicized breach draws media attention and parent backlash within days. K-12 districts face school board scrutiny and pressure on leadership, and colleges also risk alumni support, donations, and research partnerships.
What to Do After a Suspected FERPA Violation
When student records may have been exposed, speed and documentation matter most. FERPA doesn’t prescribe a response workflow, but these six steps keep an incident contained and defensible:
- Contain the exposure: Revoke access, disable shared links, isolate affected systems, or ask the recipient of a misdirected message to delete it.
- Assess the scope: Identify which records were exposed, how many students are affected, and who received or opened the data.
- Escalate: Bring in compliance, IT, legal counsel, and district leadership.
- Document everything: Record the timeline, the actions taken, the systems involved, and who handled each step.
- Check notification obligations: FERPA doesn’t require breach notification, but many state breach laws do.
- Fix the cause: Update policies, tighten permissions, and retrain the staff involved.
Steps two and four depend on a complete record of what was sent and where it went. With email, chat, and text messages captured in one archive, a district can search every channel for the student’s name or ID at once, see who received each message, place a legal hold so related records can’t be deleted during the investigation, and export the results with a full audit trail for counsel or SPPO.
This is operational guidance, not legal advice. Coordinate incident response and notification decisions with counsel.
5 Steps to Avoid FERPA Violations
Most of the FERPA violation examples above trace back to unclear policies, loose access, untrained staff, or unvetted tools. These five steps close those gaps.
Set clear data retention and archiving policies
FERPA doesn’t set retention periods, so each district needs its own schedule.
Without one, records either pile up indefinitely, which widens the exposure in a breach, or get deleted too early, which can conflict with state public records laws.
The policy should define what to keep, for how long, who owns each record type, and how it’s destroyed.
Train staff by role
Annual training should cover what counts as PII, when the consent exceptions apply, and safe use of email, messaging, and AI tools.
Tailor it to each role:
- Teachers: Grades, recommendation letters, class discussions, and classroom apps
- IT and systems administrators: Access controls, encryption, vendor reviews, audit logging, and breach response
- Registrars and records officers: Access requests, opt-out tracking, retention schedules, and disclosure logs
- Principals and administrators: Policy enforcement, the annual FERPA notice, and complaints
- Counselors: Counseling and health information, including where state law or HIPAA may apply
Limit access with role-based permissions
Give staff access only to the records they need for their jobs. Combine role-based access controls with multi-factor authentication, and review access logs regularly to catch permissions that have drifted.
Vet edtech vendors before approving them
Before a new tool touches student data, ask the vendor:
- Will you sign a data sharing agreement that limits use to the stated educational purpose?
- Do you provide audit logs and role-based access controls?
- Do you have a documented incident response plan?
- Can you certify data deletion when the contract ends?
Keep opt-out records current
Track every directory information opt-out in one place, and make checking it a required step before releasing rosters, honor rolls, or photos.
How Jatheon Helps Schools Catch and Contain FERPA Violations
Jatheon’s education archiving platform captures district email, collaboration tools, text messages, and social media from 30+ sources in one archive, so student information stays searchable no matter which channel it moved through. The features that matter most for FERPA violations are:
- Keyword lists and AI classification: Saved keyword lists for student names, ID numbers, and terms like IEP or suspension help reviewers find messages that carry student PII, while AI classification and risk tagging push higher-risk items to the compliance dashboard.
- Role-based access: Permissions set by role, department, or school keep staff limited to the records they’re authorized to see.
- Tamper-proof audit trail: Every search, export, and policy change is logged, so the district can show who accessed which records and when.
- Automated PII redaction: Student names and other PII are redacted before records go out in response to a parent inquiry or a public records request.
- Legal hold: Every message tied to an incident or complaint is preserved, so nothing is deleted while it’s investigated.
- Retention and automated expunge: Retention tags apply by user, department, or content type, and records are deleted automatically when their retention period ends.
