FERPA Directory Information: What Schools May Release
Directory information is a specific, defined category under FERPA that a school may disclose without written consent, as long as the school has given public notice and allowed families or eligible students the chance to opt out. It is not a blanket exception. It is a narrow carve-out with its own definition, its own notice requirement, and its own limits, set out in 34 CFR 99.3 and 34 CFR 99.37.
This is a plain-language walkthrough of what directory information actually covers, what the annual notice requirement means in practice, and how the opt-out mechanism works, based on the regulatory text and guidance from the US Department of Education Student Privacy Policy Office.
What FERPA actually protects, in one sentence
The Family Educational Rights and Privacy Act, 20 USC 1232g, generally prohibits a school from disclosing personally identifiable information from a student's education records without written consent from a parent or an eligible student, defined as a student who has reached 18 or is attending a postsecondary institution. Directory information is the specific, named exception to that general rule.
What counts as directory information under 34 CFR 99.3
34 CFR 99.3 defines directory information as information contained in a student's education record that would not generally be considered harmful or an invasion of privacy if disclosed. The regulation gives a list of categories that a school may designate as directory information, though a school is not required to designate all of them. Commonly designated categories include:
- Name
- Address
- Telephone number
- Email address
- Photograph
- Date and place of birth
- Major field of study
- Grade level or dates of attendance
- Enrollment status, such as full-time or part-time
- Participation in officially recognized activities and sports
- Weight and height of members of athletic teams
- Degrees, honors, and awards received
- The most recent educational institution attended
34 CFR 99.3 explicitly excludes a student's Social Security number and student identification number from directory information, though 99.3 carves out a narrow case for a student ID or user ID that is displayed in an electronic system and cannot be used alone to gain access to education records without a separate factor such as a PIN or password. Each institution decides, within the regulatory list, exactly which categories it designates as its own directory information, and that designation is published in the school's own policy rather than fixed by federal law alone.
The public notice requirement under 34 CFR 99.37
34 CFR 99.37 requires that before a school discloses directory information without consent, it must give public notice to parents of students in attendance, or to eligible students, identifying the specific categories it has designated as directory information. The notice must also explain the right to opt out and the deadline for doing so. 34 CFR 99.37 itself does not state a frequency. The separate requirement to notify parents and eligible students of their FERPA rights annually comes from 34 CFR 99.7, which is why most institutions fold the directory information notice into the same start-of-year package. Schools have discretion in how they deliver the public notice, provided it reaches the relevant population, and many publish it in a student handbook, a catalog, or a dedicated privacy notice distributed at the start of each academic year.
The notice requirement is what makes the directory information exception legally usable. A school cannot rely on the exception for a category of information it has not properly designated and noticed, and it cannot disclose directory information about a student who has properly opted out within the window the school provided.
How the opt-out mechanism works
Once a school has provided the required public notice, parents of students in attendance, or eligible students themselves, have the right to opt out of the disclosure of some or all of the designated directory information categories. The regulation leaves the specific mechanics of how a family exercises that opt-out to the school, as long as the process is clearly communicated in the notice. An opt-out is not automatic and generally does not carry over from a prior year without the school's own policy saying so, which is why the annual notice matters even for returning students.
Once a valid opt-out is on file, the school must treat that student's designated information as protected, not as directory information, for future disclosures, even though it otherwise fits the definition.
| Element | Governing citation | What it requires |
|---|---|---|
| Definition of directory information | 34 CFR 99.3 | Lists categories a school may designate, excludes SSN and student ID |
| Disclosure exception itself | 34 CFR 99.31(a)(11) | Permits disclosure of directory information where public notice under 99.37 has been given |
| Public notice before disclosure | 34 CFR 99.37 | Must identify designated categories and the opt-out process |
| Annual notification of FERPA rights | 34 CFR 99.7 | Separate yearly notice of rights; commonly delivered with the directory information notice |
| Opt-out right | 34 CFR 99.37 | Parents or eligible students may block disclosure of some or all categories |
| General consent requirement | 20 USC 1232g; 34 CFR 99.30 | Applies to all disclosures that are not directory information or another named exception |
Directory information and texting, specifically
A phone number designated as directory information under a school's own policy, with proper annual notice given, is a different situation under FERPA than using a phone number obtained through admissions or enrollment records for outreach that has not gone through that designation and notice process. Schools building texting programs, whether for admissions, advising, or general communication, should confirm which contact information falls under a directory information designation and which is being used under a different basis, such as directory consent given at enrollment or another applicable exception. This distinction is the core of what a texting program needs to get right, and it is covered in more operational depth in this guide to FERPA compliant student texting.
A related and frequently asked question is whether a school can text parents of minor students without separate consent, which involves both FERPA and, for some communications, additional consent considerations under telemarketing and texting law. That specific question is addressed in this article on whether schools can text parents without consent.
This article is general information, not legal advice. Requirements vary by jurisdiction and change over time, so confirm your own obligations with qualified counsel or the relevant regulator.
Where to find the authoritative source
The regulatory text itself is published at 34 CFR Part 99, and the US Department of Education's Student Privacy Policy Office publishes guidance documents, model notices, and answers to frequently asked questions interpreting these provisions. Any school building or updating its directory information policy should start with the current regulatory text and the Student Privacy Policy Office's published guidance rather than relying on secondary summaries, including this one, as the final word.
For schools building outreach programs, including texting, that need to work correctly alongside these disclosure rules, FRANSiS for higher education covers how a messaging platform fits into a compliant outreach setup.
Frequently Asked Questions
What is directory information under FERPA?
Directory information is a defined category of student data, set out in 34 CFR 99.3, that a school may disclose without written consent because it is not generally considered harmful or an invasion of privacy. It includes items such as name, address, and dates of attendance, but excludes Social Security and student ID numbers, and a school must properly designate and notice each category before relying on the exception.
Can a school text a student's phone number without consent if it is directory information?
If a phone number is properly designated as directory information under the school's published policy, with the required annual notice given and no opt-out on file for that student, FERPA's directory information exception may apply to certain disclosures. Whether texting specifically is appropriate can also involve other legal considerations beyond FERPA, so schools should confirm the full picture with counsel.
Do parents have to opt out every year?
FERPA requires schools to give public notice of directory information categories and the opt-out right under 34 CFR 99.37, and separately to notify parents and eligible students of their FERPA rights annually under 34 CFR 99.7. The directory information regulation does not specify that a prior opt-out automatically carries forward. Whether an opt-out persists year to year depends on the individual school's own policy, so families should check their institution's specific notice each year.
What information is never considered directory information?
34 CFR 99.3 specifically excludes a student's Social Security number and student identification number from the definition of directory information, even if a school has designated other categories. Grades, disciplinary records, and other education record content generally fall outside directory information as well, unless specifically listed in the regulation's directory information categories.
Who enforces FERPA and where do I find official guidance?
FERPA is enforced by the US Department of Education, and the Student Privacy Policy Office within the Department publishes guidance, model notices, and answers to common questions about directory information and other FERPA provisions. Their published materials are the authoritative source for interpreting the regulation.
Can a college release a student's photo without consent?
A photograph can be included in a school's designated directory information categories under 34 CFR 99.3, which means it may be disclosed without separate consent if the school has properly noticed that designation and the student or family has not opted out. Schools vary in whether they include photographs in their own directory information policy.
Is there a difference between FERPA rules for K-12 schools and colleges?
The directory information framework in 34 CFR 99.3 and 99.37 applies across FERPA-covered institutions generally, but the definition of an eligible student, meaning who holds the consent right directly rather than through a parent, differs by age and enrollment level, since eligible students are those 18 or older or attending a postsecondary institution.
Does opting out of directory information stop a school from texting a student entirely?
Not necessarily. An opt-out under FERPA's directory information provisions limits disclosure of the opted-out categories to outside parties or unrestricted release; it does not by itself govern whether the school's own internal outreach, such as administrative or advising texts to the student, can occur, which typically depends on other consent or notice mechanisms the school has in place.
Build outreach that respects directory information rules
FRANSiS supports schools building compliant outreach programs, working alongside your existing directory information policy and consent processes. Contact us to talk through how a texting program fits your institution's FERPA framework.
