---
title: "FERPA (Family Educational Rights and Privacy Act)"
description: "FERPA protects the privacy of student education records at federally funded institutions. Why pasting student data into AI tools is a FERPA disclosure event and how to prevent it."
url: "https://sonomos.ai/glossary/ferpa/"
source: "https://sonomos.ai/glossary/ferpa/"
---

# FERPA (Family Educational Rights and Privacy Act)

The U.S. federal law that protects the privacy of student education records held by institutions receiving federal funding.

## In depth

The Family Educational Rights and Privacy Act (FERPA, 1974) applies to every educational institution that receives federal funding — from K-12 schools to public universities. It gives students (or parents of minor students) the right to access their education records and restricts disclosure to third parties without written consent. Education records are broadly defined: grades, transcripts, disciplinary records, financial aid records, schedules, and any personally identifiable information maintained by the institution. AI tools complicate FERPA because pasting student education records into a third-party model constitutes a disclosure. Legitimate exceptions — school officials with a legitimate educational interest, directory information (if not opted out) — do not automatically extend to AI vendors unless there is a specific services agreement that qualifies the vendor as a 'school official' with the required direct control test satisfied.

## Examples

- A teacher pasting a class roster with student names and grades into ChatGPT to draft a progress report.
- An EdTech platform using a cloud AI API to analyse student performance data without a FERPA-compliant services agreement.
- A school counsellor routing a student's disciplinary record through an AI summarisation tool to prepare for a parent meeting.

## How Locke handles ferpa (family educational rights and privacy act)

Locke detects student identifiers — names in educational contexts, student ID numbers, grades, and demographic combinations — locally, before any text reaches an AI model. On-device processing means no new disclosure event is created by running the protection layer itself.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Personally Identifiable Information (PII)

  Any information that can identify a specific person, either directly (name, SSN) or in combination with other data (zip code + birthdate).
- Shadow AI

  Employees using AI tools at work without organisational sanction — the AI-era version of shadow IT.
- Data Loss Prevention (DLP)

  A category of security tooling that inspects outbound data flows to prevent sensitive content from leaving an organisation's control.

## Reading on this topic

- [FERPA and AI: Can Schools and EdTech Use ChatGPT With Student Data? (2026 Guide)](https://sonomos.ai/blog/ferpa-ai-chatgpt-claude-schools-edtech-2026/)
- [Is Claude FERPA Compliant? A 2026 Guide for Schools and EdTech](https://sonomos.ai/blog/is-claude-ferpa-compliant-2026/)