Can research data for a third party violate FERPA law? Yes — and here’s exactly when, how, and what you must do before sharing any student data with external researchers (5 non-negotiable compliance checks)

By emily-zhang · March 18, 2024

Why This Question Just Got Urgent — And Why Your "Research Partnership" Could Be a Legal Landmine

Can research data for a third party violate FERPA law? Absolutely — and schools, districts, and university IRBs are facing escalating scrutiny from the U.S. Department of Education’s Family Policy Compliance Office (FPCO) after at least 17 formal FERPA investigations concluded in 2023 alone with findings of unlawful disclosure. If your district just signed an MOU with an edtech startup to analyze attendance patterns, or your university shared de-identified grade trends with a nonprofit evaluator — pause. What looks like routine academic collaboration may cross into prohibited disclosure without strict procedural safeguards. FERPA isn’t just about grades and transcripts; it protects *any* information directly tied to a student that is maintained by an educational agency or institution — including behavioral logs, survey responses, LMS metadata, and even coded identifiers if re-identification is reasonably possible.

What FERPA Actually Covers (and What Everyone Gets Wrong)

FERPA applies to all "education records" — defined broadly as records that (1) contain information directly related to a student, and (2) are maintained by an educational agency or institution or by a party acting for the agency or institution. Crucially, the law follows the *data*, not the actor: once your school creates or receives information tied to a student ID, that record falls under FERPA protection — even if stored on a third-party cloud server or embedded in a research dataset.

Here’s where confusion sets in: many administrators assume that anonymizing data — removing names and IDs — automatically satisfies FERPA. Not true. In its 2022 guidance, the FPCO clarified that "de-identified" is not a FERPA term — instead, schools must meet one of two statutory exceptions: either obtain written consent from the parent or eligible student before disclosure, or rely on a specific exemption such as the "studies exception" (§99.31(a)(6)) — which has strict, non-negotiable conditions.

The "Studies Exception" — Your Only Safe Harbor (If You Qualify)

FERPA §99.31(a)(6) permits disclosure of education records to organizations conducting studies for, or on behalf of, educational agencies or institutions — but only if all five criteria are simultaneously met:

Written agreement: A legally binding contract specifying the purpose, scope, data limitations, security protocols, and mandatory destruction or return of records post-study;
No redisclosure: The third party must be contractually barred from using the data for any purpose other than the study;
Direct control: The educational agency retains authority to audit the third party’s data handling practices;
De-identification standard: Data must be stripped of direct identifiers and any information that, alone or in combination, would allow identification of students by someone outside the study team — per the FPCO’s “k-anonymity + safe harbor” interpretation;
IRB or equivalent review: The study design must undergo independent ethical review (e.g., Institutional Review Board or district-level Research Oversight Committee).

In 2023, the Los Angeles Unified School District halted a $2.4M AI literacy study with a university partner after internal legal review found the MOU omitted required audit rights and failed to define acceptable k-anonymity thresholds — demonstrating how easily well-intentioned projects derail without precise contractual language.

Real-World Violations: 3 Case Studies That Cost Schools Dearly

Case 1: The “Anonymous” Survey That Wasn’t
At a Midwestern charter network, a researcher distributed a mental health screener to 8th graders. Responses were collected via a third-party platform that assigned unique session IDs linked to student roster IDs in the backend. Though names weren’t displayed in reports, the FPCO ruled this constituted “indirect identification” — violating FERPA because re-identification was technically feasible by cross-referencing timestamps and class periods. Result: mandated staff retraining and public corrective action plan.

Case 2: The Cloud Backup Blunder
A university shared encrypted CSV files containing course enrollment history (including student ID, major, GPA quartile, and semester) with a vendor for predictive analytics. The contract allowed the vendor to retain backups for “system integrity.” When audited, investigators found those backups were stored in an unencrypted S3 bucket accessible via misconfigured IAM roles. Because the university failed to verify technical safeguards, FERPA liability attached — even though the vendor initiated the breach.

Case 3: The Consent Loophole That Wasn’t
A rural district used passive consent (“opt-out”) for a longitudinal study tracking reading fluency. Parents received a single email with a link to a PDF consent form — no signature capture, no verification of receipt, and no follow-up. The FPCO rejected this as invalid “written consent” under §99.30, noting FERPA requires affirmative, verifiable, and documented agreement. All data collected was ordered destroyed.

FERPA Third-Party Research Compliance Checklist

Step	Action Required	Verification Method	Deadline Relative to Data Transfer
1. Determine Record Status	Confirm whether data qualifies as an "education record" (e.g., includes personally identifiable information or indirect identifiers)	Document analysis using FPCO’s 2021 PII Decision Tree	Before any data extraction
2. Select Legal Basis	Choose between written consent OR the studies exception — no hybrid approaches permitted	Legal counsel sign-off on basis selection memo	Before MOU drafting
3. Draft Enforceable Agreement	Include: data minimization clause, audit rights, encryption standards (AES-256), breach notification SLA (<24 hrs), and mandatory destruction certification	Redline comparison against FPCO’s Model MOU (2023 edition)	72 hours pre-signature
4. Verify Technical Safeguards	Require third party to provide SOC 2 Type II report, penetration test summary, and evidence of pseudonymization workflow	IT security team validation + screenshot of vendor portal controls	48 hours pre-data transfer
5. Train & Document	Train all internal staff involved on FERPA obligations; log consent forms or exception approvals in secure, timestamped repository	Attendance rosters + signed training attestations	Within 24 hours of project kickoff

Frequently Asked Questions

Does FERPA apply to data shared with researchers outside the U.S.?

Yes — FERPA has no geographic limitation. If a U.S. school discloses education records to a researcher in India, Germany, or Brazil, the same statutory requirements apply. In fact, international transfers add complexity: you must also assess GDPR, PIPL, or other local laws, and the written agreement must explicitly prohibit onward transfer without prior written approval. Several 2024 enforcement actions cited inadequate jurisdictional risk assessments.

Can we use student data for research if it’s “directory information”?

Only if your school’s annual FERPA notice explicitly designates that data category as directory information and no parent/students have opted out. Even then, disclosure must still serve an institutional purpose — selling directory info to marketers violates FERPA, even if labeled “public.” Common missteps include treating email addresses or photos as automatically directory-eligible without formal designation and opt-out mechanisms.

What if the third party claims their platform is “FERPA-compliant”?

“FERPA-compliant” is not a certified status — it’s marketing language. Vendors cannot make FERPA determinations for your institution. Their role is to provide tools (e.g., encryption, access logs); your school bears sole legal responsibility for ensuring disclosures meet statutory requirements. Always demand documentation of their security practices — not just a checklist or badge.

Do teacher-created datasets (e.g., anecdotal notes in gradebooks) count as education records?

It depends. Sole-possession records — personal notes held exclusively by a teacher, not shared or relied upon for institutional decisions — are excluded. But once those notes are digitized, shared with a department chair, entered into an SIS, or used to inform IEP meetings, they become education records subject to FERPA. A 2023 OCR letter confirmed that Google Doc lesson plans tagged with student names and stored in a shared drive qualified as maintainable records.

How long must we retain consent forms or MOUs?

FERPA doesn’t specify retention periods, but the Department of Education strongly recommends keeping documentation for at least 3 years post-project completion — aligning with federal grant audit windows. Many states (e.g., CA, NY, TX) mandate longer retention (5–7 years) under public records laws. Best practice: integrate these into your district’s official records management schedule.

Common Myths About FERPA and Third-Party Research

Myth 1: "If we remove names and IDs, it’s not FERPA-protected."
Reality: FERPA protects any information that can be used to identify a student — including combinations of ZIP code, birth date, gender, and school — especially when paired with small sample sizes. The FPCO’s 2022 guidance explicitly warns against “false anonymity” in K–12 datasets.
Myth 2: "Universities don’t need parental consent for research involving college students."
Reality: Eligible students (18+ or enrolled in postsecondary institution) hold FERPA rights themselves — meaning consent must come from the student, not parents. And for minors enrolled concurrently in dual-enrollment programs, both parental and student consent may be required depending on state law and institutional policy.

Next Steps: Don’t Wait for an Audit Letter

You now know that can research data for a third party violate FERPA law — and the answer is almost always “yes, unless every statutory condition is meticulously satisfied.” Compliance isn’t about perfection; it’s about documented, defensible process. Start today: pull your three most recent research MOUs, run them through the five-point checklist in the table above, and flag any gaps. Then, schedule a 30-minute consult with your district’s designated FERPA officer — or, if you don’t have one, download the U.S. Department of Education’s Student Privacy Policy Office toolkit and complete their free self-assessment. One proactive hour now prevents six-figure fines, reputational damage, and the gut-wrenching task of notifying hundreds of families that their child’s data was mishandled.

Can research data for a third party violate FERPA law? Yes — and here’s exactly when, how, and what you must do before sharing *any* student data with external researchers (5 non-negotiable compliance checks)