Schools collect substantial information about students: academic records, attendance, behavior, health data, and increasingly, data generated through online platforms and school-issued devices. Most parents assume this information is kept private, but who can access it and under what circumstances is more nuanced than many expect.
Student privacy rights in California schools come from several overlapping sources. Federal law sets a baseline. California law adds its own protections, some of which go further than federal requirements. And specific rules apply to educational technology companies that handle student data, separate from what applies to the schools themselves.
Three laws account for most of what parents encounter: FERPA for school records; COPPA for online services used by younger children; and California’s own statutes governing how schools and technology vendors handle student information. Each addresses a different part of the picture.
What Student Privacy Rights Cover in California Schools
Privacy rights in the school context generally fall into a few categories.
Education records: Documents, files, and other information directly related to a student and maintained by the school or district. FERPA is the primary federal law governing these records.
Student personal information held by technology vendors: Data collected through online learning platforms, educational apps, and school-issued devices. California’s SOPIPA and Education Code section 49073.1 apply here, in addition to FERPA where the school is involved.
Online privacy for children under 13: COPPA applies to operators of websites and online services used by children under 13. It primarily regulates the companies offering those services, with schools sometimes acting as an intermediary between those companies and parents.
These categories overlap in some situations and apply independently in others. A school’s gradebook is an education record. An educational app’s behavioral analytics may be covered by SOPIPA whether or not the school has a formal contract with the vendor. An online service a student uses at home for a school project may implicate COPPA if the child is under 13.
FERPA and California Student Education Records
The Family Educational Rights and Privacy Act, commonly known as FERPA (20 U.S.C. section 1232g), is the federal law that governs the privacy of student education records. It applies to any school or educational agency that receives funding from the U.S. Department of Education. That covers virtually all California public schools and many private schools.
What Counts as an Education Record
An education record under FERPA is any record directly related to a student, maintained by the school, district, or a party acting on the school’s behalf. That includes:
- Grades, transcripts, and academic performance data.
- Enrollment and attendance records.
- Health records maintained by the school (though health records may also have separate HIPAA-related considerations in some contexts).
- Disciplinary records.
- Test scores, evaluations, and special education records.
- Financial records in the context of student financial aid.
- Communications or notes that are shared with other school staff and relate to a student.
FERPA does not protect every piece of information related to a student. Records kept solely by the person who made them, and not shared with others, are generally not education records. Law enforcement records maintained by school police are also excluded.
Personally Identifiable Information
FERPA specifically protects personally identifiable information (PII) from a student’s education records. PII includes the student’s name, address, Social Security number, student identification number, and any information that could reasonably be used to identify the student. When a school shares student records, it must generally ensure that PII is not disclosed without authorization.
When FERPA Rights Transfer to the Student
Under FERPA, privacy rights belong to the parents while the student is under 18 and attending a K-12 school. At age 18 or upon enrollment in a postsecondary institution, FERPA rights transfer to the student. Parents no longer have automatic access to the records.
What Rights Do Parents Have Under FERPA?
FERPA gives parents four main rights with respect to their child’s education records.
The Right to Inspect and Review Records
Parents may request to inspect and review their child’s education records. After receiving a written request, the school must provide access within 45 days. If the parent cannot physically visit the school to review records, the school must provide copies or make other arrangements.
California law generally provides a shorter timeline for K-12 records. Under California Education Code section 49069, a parent who requests copies of pupil records must receive them within five business days of the request. California’s requirement is more protective than FERPA’s 45-day federal standard.
The Right to Request Corrections
Parents may request that the school amend an education record they believe is inaccurate, misleading, or violates the student’s privacy rights. If the school agrees, it must correct the record. If it disagrees, it must offer the parent a formal hearing to challenge the accuracy of the record.
The Right to Control Disclosure
Schools generally cannot share a student’s education records without written consent from the parent. There are important exceptions to this rule, discussed below. But the default is that sharing requires consent.
The Right to File a Complaint
If a parent believes a school violated FERPA, they can file a complaint with the U.S. Department of Education’s Student Privacy Policy Office. The office investigates complaints and can take corrective action against schools that do not comply with FERPA requirements.
When Can Schools Share Student Information?
Several exceptions allow schools to disclose student records without prior parental consent. Understanding these exceptions helps parents know what to expect.
School Officials With a Legitimate Educational Interest
A school may share student records with its own officials, staff, and certain contractors who have a legitimate educational interest in the information. A teacher reviewing an IEP, a counselor addressing a behavioral issue, or a school-contracted testing company may access records without separate parental consent.
Transfers to Other Schools
When a student transfers to another school, the previous school may share education records with the receiving school without parental consent. The school should make a reasonable effort to notify the parent before disclosing records, though this is not always required.
Audits and Evaluations
Authorized federal, state, and local officials conducting audits of education programs may access student records without parental consent, subject to additional data protection requirements.
Health or Safety Emergencies
FERPA permits disclosure of student records when there is a genuine safety emergency. The school must determine that knowledge of the information is necessary to protect the health or safety of the student or others. This exception is intended to be narrowly applied to actual emergencies.
Court Orders and Legal Process
Schools may disclose student records pursuant to a court order or lawfully issued subpoena. Schools must generally try to notify the parent before complying, unless the court has ordered that the existence of the subpoena not be disclosed.
Directory Information
Directory information includes basic facts like the student’s name, address, phone number, photograph, grade level, dates of attendance, and participation in school activities. Schools may share directory information without parental consent, but only after providing annual notice to parents and giving them the opportunity to opt out.
If a parent submits a written opt-out request, the school must treat that information as non-directory. Parents who want to restrict sharing of their child’s directory information should check whether the district’s annual notice offers an opt-out option.
COPPA and Student Online Privacy
COPPA (15 U.S.C. sections 6501 through 6506) applies to operators of websites and online services directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13. It requires those operators to obtain verifiable parental consent before collecting, using, or disclosing personal information from children.
COPPA is primarily a law about technology companies, not schools. COPPA regulates what an online service operator can do with a child’s information, not what a school can do with its own records.
How COPPA Applies in Schools
When a school enrolls students in an online service, the school may consent to data collection on behalf of parents, but only for educational purposes. This is called the school-consent mechanism. The key limitation: the school’s consent covers only educational uses. The operator cannot use the information for commercial purposes such as targeted advertising.
COPPA applies based on the child’s age (under 13) and the nature of the service (directed to children, or with actual knowledge of serving children under 13). A general-purpose app that a student happens to use for school is not automatically covered by COPPA unless it meets those conditions.
COPPA vs. FERPA
COPPA and FERPA address different concerns. FERPA focuses on education records maintained by covered schools. COPPA focuses on online operators collecting data from young children. The same situation can implicate both laws. A school that uses an online platform to store student grades may have FERPA obligations, while the platform may separately have COPPA obligations regarding children’s accounts.
A technology company’s COPPA obligations do not eliminate FERPA obligations, and a school’s FERPA compliance does not substitute for the company’s COPPA obligations. Both sets of rules apply to their respective covered parties.
California Student Data Privacy Protections
California has enacted two complementary laws that protect student data in the digital learning environment. Together, they create requirements that exceed what federal law alone provides.
SOPIPA: Obligations on Educational Technology Companies
SOPIPA (California Business and Professions Code sections 22584 et seq.) applies to operators of websites, online services, apps, and mobile applications designed and marketed for K-12 school purposes. The law applies whether or not the operator has a formal contract with a school.
Covered operators cannot:
- Use student information for targeted advertising directed at students or their parents.
- Sell, rent, or disclose student information to third parties for purposes unrelated to the educational service.
- Build profiles of students for non-educational purposes.
- Use student information collected through a K-12 service in another service unrelated to education.
The law also requires covered operators to implement and maintain reasonable security procedures and practices that protect student data. Schools and districts may request that an operator delete student information.
Covered student information includes names, addresses, behavioral data, academic records, test results, browsing history, search queries, and other data students generate through these services.
Education Code Section 49073.1: Obligations on Schools and Districts
California Education Code section 49073.1 requires school districts to include specific privacy protections in contracts with third-party providers of digital educational services. Where SOPIPA regulates what vendors can do, section 49073.1 regulates what contracts schools must require vendors to agree to.
Under section 49073.1, contracts between schools or districts and digital storage or educational software providers must include provisions that:
- Prohibit the vendor from selling student information.
- Prohibit the use of student data for targeted advertising.
- Specify how the vendor may use student information, limiting use to the purposes spelled out in the contract.
- Require the vendor to delete student data upon termination of the contract.
- Include security requirements to protect student data.
Together, SOPIPA and section 49073.1 create obligations from two directions: direct prohibition on companies under SOPIPA regardless of any contract, and contractual requirements imposed through the school’s procurement process under section 49073.1.
How California Law Compares to Federal Requirements
In several respects, California student data privacy law is more protective than the federal baseline. SOPIPA applies to K-12-directed technology companies regardless of age, whereas COPPA applies only when children are under 13. Education Code section 49073.1 extends contract-based protections to all K-12 students. California’s 5-business-day timeline for providing copies of pupil records is shorter than FERPA’s 45-day maximum.
Privacy and School-Issued Devices or Educational Technology
When a school issues a device or requires use of a specific online platform, the school takes on a role in managing the privacy of data that device or platform generates.
Students using school-issued laptops or tablets may generate substantial data: browsing history, login activity, communications, file access, keystrokes, and location data if the device includes GPS. Whether and how that data is collected, stored, and used depends on school policies, device management software, and applicable state law.
Parents have a right to ask their school:
- What monitoring or tracking software is installed on school-issued devices.
- What categories of data the school or its vendors collect through those devices.
- Who has access to that data and for what purposes.
- What the school’s data retention and deletion policies are.
- Whether students are permitted to use school-issued devices for personal activity, and whether that activity is also monitored.
Can Schools Monitor Student Activity?
Schools have authority to monitor student activity on school-issued devices and networks. The extent of that authority depends on the type of monitoring and the circumstances.
Monitoring for Safety and Compliance
Schools commonly use device management software and network monitoring tools to enforce acceptable use policies, block prohibited content, and ensure devices are used for educational purposes. A student who signs an acceptable use agreement as a condition of receiving a device is on notice that school device use may be monitored.
Some monitoring extends beyond devices. School cameras, entry logs, and disciplinary tracking systems collect information about student movement and behavior on campus. This monitoring is generally considered within a school’s operational authority.
Limitations on Monitoring
Schools generally cannot conduct the equivalent of a physical search of a student’s personal device without reasonable suspicion of a policy violation or legal infraction. The Fourth Amendment applies in the school context, though at a lower standard than the probable cause required for a law enforcement search.
Monitoring of personal devices brought by students to school involves different considerations than monitoring of school-issued equipment. A school’s authority over a student’s personal device is more limited than its authority over equipment the school owns.
California has also addressed school authority over student phones specifically. The firm’s article on California school phone confiscation rules under AB 3216 explains what schools can and cannot do when it comes to personal phones on campus.
Privacy During Disciplinary Investigations
FERPA applies to records resulting from a school disciplinary investigation, just as it does to other education records. A parent generally has the right to review disciplinary records maintained about their child. Records of disciplinary findings and actions taken are education records subject to FERPA protections.
Information obtained during a genuine safety emergency may be shared under FERPA’s safety exception, but this is not a general override of privacy protections. Schools should not broadly share student information under the guise of safety.
What Parents Can Do About a Potential Privacy Issue
If you believe your child’s privacy rights were violated, or if you want to proactively understand how the school handles student data, several steps are available.
- Request your child’s records. Submit a written request to the school or district for copies of your child’s education records. Under California Education Code section 49069, the school must provide copies within five business days.
- Ask about the school’s privacy policies. Schools must provide annual notification under FERPA about parents’ rights. Ask specifically about directory information opt-out procedures and vendor data practices.
- Review vendor contracts. Schools in California are required under Education Code section 49073.1 to include specific privacy terms in contracts with digital education vendors. You can ask your district for information about the vendors it uses and the contracts in place.
- Opt out of directory information sharing. To prevent sharing of your child’s directory information, submit a written opt-out request to the school before the deadline in the annual notice.
- Challenge inaccurate records. If you believe a school record contains inaccurate or misleading information, you have the right under FERPA to request that the school amend it. If the school refuses, you are entitled to a formal hearing.
- File a complaint with the U.S. Department of Education. If you believe the school violated FERPA, you can file a complaint with the Student Privacy Policy Office at the U.S. Department of Education.
- Report COPPA or SOPIPA concerns. COPPA violations by online operators can be reported to the Federal Trade Commission. SOPIPA is enforced by the California Attorney General. Both agencies have authority to take enforcement action against companies that violate these laws.
When Should You Speak With an Education Attorney?
Many student privacy questions can be resolved by communicating directly with the school or district. But some situations may benefit from legal review.
Consider speaking with an education attorney when:
- The school has refused your request to inspect or copy your child’s education records.
- You believe the school disclosed your child’s records to an unauthorized party.
- Student data was shared with a technology vendor in a way that appears to violate California law.
- Records contain inaccurate information affecting your child’s academic standing or disciplinary history, and the school has refused to correct them.
- The school is using a monitoring system that you believe violates your child’s rights.
- Your child has a disability and you have questions about how privacy rights interact with special education records and proceedings.
- A privacy violation is connected to a broader pattern of treatment you believe raises discrimination or civil rights concerns.
More information about student rights in California schools is available through the firm’s overview of educational rights for California students. Parents dealing with suspension or disciplinary issues may also find it useful to review the firm’s article on California student suspension laws, which covers student and parent rights during the disciplinary process.
Schedule a Consultation
If you believe your child’s privacy rights were violated, or if you need help understanding what information a school is permitted to share, a legal review of the specific facts can help you evaluate your options.
Contact Kassouni Law at 877-770-7379 or submit an inquiry at kassounilaw.com/contact. Submitting a contact form does not create an attorney-client relationship.
Frequently Asked Questions
Can a school share my child’s records without my permission?
Generally, no. FERPA requires schools to obtain written parental consent before disclosing a student’s education records. There are exceptions, including disclosures to school officials with a legitimate educational interest, transfers to receiving schools, emergency situations, and directory information if the parent has not opted out. Understanding which exception applies in a specific situation matters when evaluating whether a disclosure was appropriate.
How quickly must a California school respond to a records request?
California Education Code section 49069 requires schools to provide copies of requested pupil records within five business days. This California requirement is more protective than FERPA’s federal standard, which gives schools up to 45 days to accommodate an inspection request. If a school fails to respond within the five-business-day period, the parent should follow up in writing and document the delay.
Does COPPA apply to online services my child uses at school?
COPPA applies to operators of websites and online services directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13. When a school enrolls students in an online platform, the school may consent to data collection on behalf of parents, but only for educational purposes. The technology company still cannot use that data for advertising or other commercial purposes. COPPA does not automatically cover every app or website a child uses at school.
What is SOPIPA and how does it protect California students?
SOPIPA is codified at California Business and Professions Code sections 22584 and following. It applies to websites, apps, and online services designed and marketed primarily for K-12 school purposes. Covered operators cannot use student data for targeted advertising, cannot sell student information, and cannot build profiles for non-educational purposes. SOPIPA applies regardless of whether the company has a contract with a school, and covers all K-12 students regardless of age.
Can schools monitor students on school-issued devices?
Schools generally have authority to monitor activity on school-issued devices, particularly when students have signed an acceptable use agreement that puts them on notice of monitoring. Monitoring may include filtering software, network activity logging, and device management tools. Schools have more limited authority over students’ personal devices brought to school. The Fourth Amendment applies in the school context at a lower standard, permitting searches based on reasonable suspicion of a policy violation.
This article provides general legal information about student privacy rights in California schools and does not constitute legal advice. Privacy law is highly fact-specific, and the applicable rules depend on the type of information, the entity involved, and the specific circumstances. No attorney-client relationship is created by reading this content. Please consult a qualified California education attorney for advice about your child’s specific situation.
