DEFINITION
FERPA (Family Educational Rights and Privacy Act)
The U.S. federal law that protects the privacy of student education records held by institutions receiving federal funding.
In depth
The Family Educational Rights and Privacy Act (FERPA, 1974) applies to every educational institution that receives federal funding — from K-12 schools to public universities. It gives students (or parents of minor students) the right to access their education records and restricts disclosure to third parties without written consent. Education records are broadly defined: grades, transcripts, disciplinary records, financial aid records, schedules, and any personally identifiable information maintained by the institution. AI tools complicate FERPA because pasting student education records into a third-party model constitutes a disclosure. Legitimate exceptions — school officials with a legitimate educational interest, directory information (if not opted out) — do not automatically extend to AI vendors unless there is a specific services agreement that qualifies the vendor as a 'school official' with the required direct control test satisfied.
Examples
- A teacher pasting a class roster with student names and grades into ChatGPT to draft a progress report.
- An EdTech platform using a cloud AI API to analyse student performance data without a FERPA-compliant services agreement.
- A school counsellor routing a student's disciplinary record through an AI summarisation tool to prepare for a parent meeting.
How Locke handles ferpa (family educational rights and privacy act)
Locke detects student identifiers — names in educational contexts, student ID numbers, grades, and demographic combinations — locally, before any text reaches an AI model. On-device processing means no new disclosure event is created by running the protection layer itself.
See the productRelated terms
- Personally Identifiable Information (PII)
Any information that can identify a specific person, either directly (name, SSN) or in combination with other data (zip code + birthdate).
- Shadow AI
Employees using AI tools at work without organisational sanction — the AI-era version of shadow IT.
- Data Loss Prevention (DLP)
A category of security tooling that inspects outbound data flows to prevent sensitive content from leaving an organisation's control.
