The 2024 PowerSchool breach affected 62 million students. The 2022 Illuminate Education breach affected 10 million. Both vendors had checked the "FERPA compliant" box in district procurement. Neither had the controls to back it up. The FTC went after Illuminate for storing student data in plain text and delaying breach notifications for nearly two years. In March 2025, the U.S. Department of Education required every state agency to certify FERPA compliance by April 30. Districts are paying attention.
If you sell EdTech to K-12 or higher ed, "Vendor confirms FERPA compliance" is no longer a checkbox the procurement team waves through. It's a clause your security questionnaire response has to defend. The vendors that can defend it close the contract. The ones that can't get filtered out before the demo.
The good news: FERPA compliance for EdTech is more about data-handling practices than technical certifications. It's also faster and cheaper than SOC 2. If you're already building responsibly, you're probably closer than you think.
What is FERPA, Really?
FERPA (Family Educational Rights and Privacy Act) gives parents rights over their children's education records—and requires schools to protect those records. When schools share student data with EdTech vendors, the vendor becomes a "school official" with access to that data.
What FERPA Protects
- Student names and contact information
- Grades, transcripts, and academic records
- Disciplinary records
- Financial aid information
- Any data that could identify a student
What FERPA Requires of Vendors
- Use data only for contracted purposes
- Don't re-disclose data to third parties
- Implement reasonable security measures
- Allow data deletion when relationship ends
- Support parent/student access rights
Unlike HIPAA, FERPA doesn't specify exact technical requirements. It requires "reasonable methods" to protect student data. What's reasonable depends on the sensitivity of data and your resources—but you need to be able to defend your choices.
The FERPA Checklist for EdTech Startups
1. Data Minimization & Purpose Limitation
Why it matters for EdTech: Schools are increasingly wary of vendors that collect more data than necessary. Data minimization is now a competitive advantage.
- Collect Only What's Needed — Document why you need each data field. If you can't justify it, don't collect it.
- Purpose Limitation — Use student data only for the contracted educational purpose. No analytics, no advertising, no selling data.
- No Behavioral Advertising — This is explicitly prohibited. Don't even think about targeted ads based on student data.
- Data Retention Limits — Define how long you keep data and delete it when no longer needed or when the contract ends.
Many states have laws stricter than FERPA (California's SOPIPA, New York's Education Law 2-d). If you're selling nationwide, design for the strictest requirements.
2. Third-Party & Subprocessor Controls
Why it matters for EdTech: Schools hold you responsible for your vendors. One careless subprocessor can tank your district relationships.
- Inventory Your Subprocessors — List every third party that might access student data (hosting, analytics, support tools).
- Contractual Protections — Ensure subprocessors are bound to the same FERPA obligations as you.
- No Unauthorized Sharing — Never share student data with third parties for their own purposes.
- Subprocessor Transparency — Be prepared to disclose your subprocessors when schools ask.
Common gotcha: Using Google Analytics or Intercom with student data? You need to ensure those vendors are FERPA-compliant or exclude student sessions from tracking entirely.
3. Access Controls & Authentication
Why it matters for EdTech: Schools need to trust that only authorized users can see student data—and that students only see their own data.
- Role-Based Access — Teachers see their students. Admins see their school. Students see only themselves.
- Secure Authentication — Support SSO integration with school identity providers. Implement password requirements or passwordless where possible.
- Session Management — Automatic timeouts for inactive sessions. Allow schools to revoke access.
- Audit Logging — Track who accessed what data and when. Schools may request this for investigations.
4. Security Measures
Why it matters for EdTech: While FERPA doesn't mandate specific controls, schools are asking more detailed security questions. Having solid fundamentals matters.
- Encryption at Rest — Encrypt stored student data. AES-256 is the standard.
- Encryption in Transit — TLS 1.2+ for all data transmission. No exceptions.
- Secure Development — Follow OWASP guidelines. Conduct security testing before releases.
- Incident Response — Have a plan for data breaches. Many state laws require specific notification timelines.
5. Parental Rights & Transparency
Why it matters for EdTech: FERPA gives parents (and eligible students) rights to access and correct education records. You need to support this.
- Data Access Requests — Have a process for parents to request access to their child's data.
- Correction Requests — Allow for data corrections when parents identify errors.
- Privacy Policy — Clear, readable privacy policy that explains your data practices.
- Data Deletion — Process for deleting student data upon school or parent request.
Sign the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement. It's free, it's standardized, and it shows schools you take privacy seriously. Over 2,800 vendors have signed.
Common FERPA Mistakes EdTech Founders Make
Mistake 1: Treating Freemium Teachers as Direct Consumers
Many EdTech products offer free tiers to individual teachers. But the moment that teacher uses your product with their students, you're likely receiving education records from the school—even if the school didn't sign the contract. Tread carefully with "bottom-up" adoption models.
Mistake 2: Using Student Data for Product Development
It's tempting to use student interaction data to improve your product. But unless this is explicitly permitted in your agreement with the school, you're violating FERPA's "school official" exception. Get explicit consent or use only de-identified, aggregated data.
Mistake 3: Not Having a Data Deletion Process
When a school contract ends, you're typically required to delete or return all student data. Many startups don't have automated processes for this—leading to panicked manual cleanups or, worse, keeping data they shouldn't have.
Mistake 4: Ignoring State-Level Privacy Laws
FERPA is the federal floor, but 46 states have their own student privacy laws—many stricter than FERPA. California's SOPIPA, Colorado's Student Data Transparency and Security Act, and New York's Ed Law 2-d all add requirements. If you're selling nationally, you need to know these.
Realistic Timeline: EdTech Startup to FERPA Compliant
Total: 6-8 weeks for a seed-stage EdTech startup. FERPA is generally faster than SOC 2 or HIPAA because it's more about practices than audited controls.
How Much Does FERPA Compliance Cost for an EdTech Startup?
Realistic total for a seed-stage EdTech startup: $5,000-20,000 first year. FERPA is one of the more affordable compliance frameworks because it doesn't require formal audits.
FERPA vs Other Frameworks for EdTech
FERPA is table stakes for EdTech. If your product is used by children under 13, add COPPA. Consider SOC 2 once you're pursuing larger district or university contracts that require it.
Quick Start: Your First Week
Day 1-2: Data Inventory
List every piece of student data you collect. For each, document: what it is, why you need it, where it's stored, and who can access it.
Day 3-4: Subprocessor Audit
List every third-party service that might touch student data. Review each for privacy policies and FERPA commitments.
Day 5: Privacy Policy Review
Read your current privacy policy. Does it clearly explain student data practices? If not, start drafting updates.
Day 6-7: Explore SDPC
Visit studentdataprivacy.org. Review the National Data Privacy Agreement (NDPA). Consider signing to streamline future school contracts.
Next Steps
FERPA compliance is achievable for even the smallest EdTech team. The key is treating student data with respect, being transparent about your practices, and having clear processes for the full data lifecycle.
Schools want to work with vendors who make compliance easy. Be that vendor, and you'll find doors opening that stay closed to less-prepared competitors.
Close more district contracts on FERPA strength
vCISO Lite ships with FERPA-specific controls tracking, student-data-privacy policy templates, a sub-processor register, and the district-ready security questionnaire responses your procurement teams have been Googling for. Built for the EdTech startups that need to look enterprise-ready to a school district that just survived the PowerSchool fallout.
If you're heading into a district procurement cycle, a state-level certification requirement, or a re-procurement after a competitor's breach, visit vcisolite.com to learn more and get started.
Where this matters next
COPPA compliance for EdTech with under-13 users — the federal child-privacy law that sits alongside FERPA when your product touches elementary classrooms.
SOC 2 automation tools: best practices for 2026 — once FERPA is locked, this is the next certification larger districts and universities increasingly require.
Cybersecurity risk assessment: a practical guide — the dollar-denominated assessment methodology that turns student-data risk into board-defensible budget priorities.