FERPA & Student Texting: Staying Compliant

ferpa compliant texting

FERPA & Student Texting: Staying Compliant

Text messaging has become a preferred channel between schools and students because it is immediate and reaches people where they already are. But when a message carries personally identifiable information from a student education record, it falls inside FERPA, the Family Educational Rights and Privacy Act, codified at 20 U.S.C. 1232g and implemented at 34 CFR Part 99. This guide covers what FERPA actually requires, what it does not, and where a texting vendor fits.

Understanding FERPA and Its Implications

FERPA is codified at 20 U.S.C. 1232g and implemented at 34 CFR Part 99. It gives parents rights in their children's education records, and those rights transfer to the student at age 18 or on enrolling at a postsecondary institution, at which point the student is an eligible student under 34 CFR 99.3. As a default, 34 CFR 99.30 requires signed and dated written consent before a school discloses personally identifiable information from an education record. That default is not absolute. 34 CFR 99.31(a) permits disclosure without consent if the disclosure meets one or more of a listed set of conditions, which include disclosure to school officials with a legitimate educational interest, directory information, health or safety emergencies under 99.31(a)(10) and 99.36, judicial orders and lawfully issued subpoenas, and audit or evaluation of federal or state education programs. Knowing which exception you are relying on is the practical part of FERPA work.

The implications for institutions are significant. Schools must ensure that any communication involving student information is secure and that the basis for each disclosure is documented. This includes text messaging, which, if not handled appropriately, can lead to unauthorized disclosure. FERPA enforcement, though, is administrative rather than private: in Gonzaga University v. Doe, 536 U.S. 273 (2002), the Supreme Court held that the relevant FERPA provisions create no personal rights enforceable under Section 1983, so students and parents cannot sue a school or a vendor under FERPA. Complaints go to the Department of Education's Student Privacy Policy Office, and the ultimate remedy is withdrawal of federal funding. The private-litigation exposure in student texting comes from a different statute, the TCPA, which under 47 U.S.C. 227(b)(3) allows recovery of actual monetary loss or $500 per violation, whichever is greater, with discretionary trebling up to three times for willful or knowing violations.

It's important for administrators to regularly review their communication policies and ensure all staff are aware of FERPA requirements. This includes understanding what constitutes an education record and the circumstances under which information can be shared. By staying informed, schools can avoid inadvertent breaches and maintain trust with students and parents.

The Role of AI-Powered SMS in FERPA Compliance

No vendor is FERPA compliant on its own. FERPA, at 20 U.S.C. 1232g and 34 CFR Part 99, binds the educational agency or institution. The ordinary route for an outside party is designation as a school official with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B), which requires that the party perform an institutional service the institution would otherwise use employees for, be under the direct control of the institution as to the use and maintenance of education records, and be subject to the redisclosure limits of 34 CFR 99.33(a). The institution must also state its school official and legitimate educational interest criteria in the annual notice required by 34 CFR 99.7. School official is one of several independent exceptions in 99.31(a), which applies if a disclosure meets one or more of a list that also includes directory information, health or safety emergencies, judicial orders, and audit or evaluation. FERPA carries no private right of action: Gonzaga University v. Doe, 536 U.S. 273 (2002), held that the relevant FERPA provisions create no personal rights enforceable under Section 1983; enforcement runs through the Department of Education and the ultimate remedy is withdrawal of federal funding. Within that arrangement, FRANSiS™ supports compliance as an AI Powered Helper that answers routine inbound questions and routes anything sensitive or unusual to the appropriate staff member, so that judgment calls about disclosure stay with the institution rather than with the platform.

Moreover, these platforms are purpose-built for mission-driven verticals, such as education, enabling schools to tailor communication strategies to their specific needs. By integrating AI into their communication systems, schools can enhance efficiency while maintaining the privacy and security of student data. The automation of routine tasks also allows staff to focus on more critical responsibilities, improving overall operational efficiency.

In addition to handling inbound communication, AI-powered SMS platforms support outbound messaging in a compliant manner. Consent management tools ensure that messages are only sent to individuals who have provided the necessary permissions, further safeguarding against potential FERPA violations.

Ensuring Data Security with Advanced Encryption

FERPA itself imposes no encryption mandate. Unlike the HIPAA Security Rule at 45 CFR Part 164 Subpart C, 34 CFR Part 99 sets no technical security standard; it governs access, consent, and disclosure. Encryption is nonetheless sound practice, is often required by state student-privacy laws and district policy, and reduces the impact of a breach. FRANSiS™ encrypts data at rest with 256-bit AES and in transit with TLS 1.2 or higher, so student information is protected in storage and in delivery.

Encryption not only protects against unauthorized access but also helps maintain the integrity of the data being transmitted. In the event of a data breach, encrypted data is significantly more difficult for malicious actors to exploit, providing an additional layer of security for educational institutions.

Schools should also implement policies for regular audits and updates to their security protocols. Staying current with the latest encryption standards and practices is essential for maintaining FERPA compliance and protecting student data from evolving threats.

Managing Consent for FERPA-Compliant Communication

Two different consents get confused here, and keeping them apart matters. FERPA consent, under 34 CFR 99.30, is signed and dated written consent to DISCLOSE personally identifiable information from an education record, and it is not required at all where a 34 CFR 99.31(a) exception applies. TCPA consent, under 47 CFR 64.1200, is consent to RECEIVE the text on a mobile number; 64.1200(a)(2) requires prior express written consent for telemarketing except that prior express consent suffices for messages sent by or on behalf of a tax-exempt nonprofit organization, which covers many public and nonprofit schools. FRANSiS™ provides tooling for the second: capturing and documenting opt-in, and processing revocation, which under 47 CFR 64.1200(a)(10) must be honored when made in any reasonable manner within a reasonable time not to exceed ten business days, with no exclusive method of revocation permitted. The FERPA decision about whether a given disclosure is lawful remains the school's.

Effective consent management involves obtaining explicit permission from parents or eligible students before communicating sensitive information. Schools should have clear policies in place for obtaining and recording consent, as well as for revoking consent if necessary. By maintaining comprehensive records of consent, schools can demonstrate compliance and mitigate the risk of potential violations.

Additionally, consent management tools can be integrated with existing student information systems, streamlining the process and reducing administrative overhead. This integration ensures that consent statuses are always up-to-date, minimizing the risk of inadvertently sending unauthorized communications.

Flat, Predictable Pricing for Budget-Conscious Institutions

Budget constraints are a common challenge for educational institutions, making cost-effective solutions essential. FRANSiS™ offers flat, predictable pricing with unlimited messaging, which helps schools manage budgets. Predictable pricing reduces the uncertainty associated with per-message billing and makes it easier to plan communication strategies against a known cost.

Predictable pricing is particularly beneficial for schools with limited resources, enabling them to allocate funds more efficiently across various programs and initiatives. By choosing a platform that offers transparent pricing, educational institutions can focus on enhancing their communication efforts without the distraction of fluctuating costs.

In addition to cost savings, the unlimited messaging feature allows schools to communicate freely with students and parents, enhancing engagement and ensuring timely dissemination of important information. This is particularly valuable in emergency situations, where rapid communication is essential.

Streamlined Onboarding for Quick Implementation

Implementing a new communication platform can be a daunting task for educational institutions, but FRANSiS™ simplifies the process with a streamlined onboarding experience. The platform's white-glove onboarding service ensures that schools can quickly integrate the system into their existing operations, with minimal disruption.

The onboarding process is designed to be completed in about four weeks, providing schools with a clear timeline for implementation. During this period, dedicated support staff guide institutions through each step, from setup to training, ensuring that all stakeholders are comfortable with the new system.

This comprehensive onboarding approach not only facilitates a smooth transition but also helps schools maximize the benefits of the platform from day one. By providing ongoing support and training, FRANSiS™ ensures that educational institutions can effectively leverage the platform's features to enhance their communication strategies.

The bottom line

FERPA compliance belongs to the school, not to any platform. What a vendor can do is fit cleanly inside the school official arrangement at 34 CFR 99.31(a)(1)(i)(B), stay within the redisclosure limits at 34 CFR 99.33(a), and give staff the access controls, audit logging, and consent records they need to show the basis for what was sent. FRANSiS™ supports that with encryption, role-based access, audit logging, TCPA consent tooling, and predictable pricing, and supports HIPAA compliance with a signed BAA where a campus health unit is separately covered. Used that way, schools can text families about student engagement without losing track of who authorized what.

Frequently Asked Questions

What is FERPA?

FERPA is the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g, implemented at 34 CFR Part 99. It gives parents rights of inspection, amendment, and control over disclosure of their children's education records; those rights transfer to the student at age 18 or on enrolling at a postsecondary institution.

Can a texting vendor be FERPA compliant?

No. FERPA binds the educational agency or institution, not the vendor. The ordinary route for a vendor is designation as a school official with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B), which requires performing an institutional service the school would otherwise use employees for, being under the direct control of the school as to the use and maintenance of education records, and being subject to the redisclosure limits at 34 CFR 99.33(a). The school specifies its criteria in the annual notice required by 34 CFR 99.7.

Does FERPA require encryption?

No. 34 CFR Part 99 sets no technical security standard, unlike the HIPAA Security Rule at 45 CFR Part 164 Subpart C. Encryption is sound practice and is often required by state student-privacy law or district policy, but it is not a FERPA mandate. FRANSiS™ encrypts data at rest with 256-bit AES and in transit with TLS 1.2 or higher.

Is consent always required before sharing student information by text?

No. 34 CFR 99.30 sets a written-consent default, but 34 CFR 99.31(a) permits disclosure without consent if the disclosure meets one or more of several listed conditions, including school officials with a legitimate educational interest, directory information, health or safety emergencies under 99.31(a)(10) and 99.36, judicial orders, and audit or evaluation. Separately, TCPA consent under 47 CFR 64.1200 governs whether you may send the text at all, and is a different question from whether FERPA permits the disclosure.

Can students or parents sue a school under FERPA?

No. In Gonzaga University v. Doe, 536 U.S. 273 (2002), the Supreme Court held that the relevant FERPA provisions create no personal rights enforceable under Section 1983. Complaints go to the Department of Education's Student Privacy Policy Office, and the ultimate remedy is withdrawal of federal funding. The private-suit exposure in student texting comes from the TCPA instead, under 47 U.S.C. 227(b)(3).

This article is informational and is not legal advice. FERPA, TCPA, and state requirements change; confirm current obligations with your own counsel.

Book a walkthrough →

More guides on this topic