Proposed FERPA Amendments have placed student privacy, parent access, vendor disclosures and school recordkeeping under renewed federal review. The key point for families and institutions is procedural as much as substantive: some changes remain proposed, one Senate bill has only been introduced, and existing FERPA duties continue to govern schools unless Congress or the Department of Education completes a binding change.
For communities affected by harmful disclosure, exclusion from records, or confusing school data practices, that distinction matters. Prevention depends on knowing what the law already requires, what federal officials are considering, and where schools may need clearer internal controls before a complaint becomes an enforcement dispute.
Proposed FERPA Amendments And Current Status
FERPA Amendments Still Proposed
The U.S. Department of Education’s Unified Agenda lists RIN 1875-AA15 as a proposed rule concerning FERPA regulations at 34 CFR Part 99. The agenda entry describes an NPRM projected for September 2026 and identifies subjects including the definition of education records, non-consensual disclosures, vendors, subpoenas, law enforcement requests, complaints, investigations and enforcement procedures, according to the Unified Agenda entry.
That entry is significant, but it is not the same as a final regulation. A Unified Agenda listing signals agency plans and priorities; it does not itself amend the Code of Federal Regulations. As of September 28, 2026, the public-facing analysis should treat the rulemaking as proposed unless the Department issues formal text through the required rulemaking process.
What A Proposed Rule Can And Cannot Do
A notice of proposed rulemaking can frame the agency’s preferred interpretation, ask for public comment and identify where federal officials think existing rules need clarification. It cannot, by itself, resolve every operational question for schools. Districts, colleges and state agencies still must work from current FERPA regulations while watching for text that may change how records, consent and enforcement are handled.
That caution is especially relevant for smaller schools and community programs that may not have large compliance offices. Policy staff should separate three categories: current FERPA duties, proposed regulatory changes, and pending legislation. Mixing those categories can mislead families and staff about what rights exist today.
FERPA Amendments And Records Access
Education Records Remain The Starting Point
FERPA’s central protection concerns education records maintained by schools or parties acting for them. The proposed rule’s focus on clarifying the definition of an education record matters because access rights often turn on whether a note, electronic file, support plan, survey response, data field or third-party record falls inside that definition.
For prevention work, the practical question is direct: what information is being created, where is it stored, and who can retrieve it when a parent or eligible student makes a lawful request? Schools that keep sensitive information in disconnected systems may create risk even without intending to deny access. A file can be difficult to locate because of poor records architecture, not because anyone made an explicit decision to conceal it.
Parent Access And Student Safety Concerns
Recent federal privacy disputes have included records connected to student gender identity, support plans and parental inspection rights. The research record for this topic describes enforcement pressure around whether such plans are education records subject to parent access. That issue is legally and socially sensitive, so schools should avoid blanket promises that sensitive information can always be kept outside a parent-access process.
At the same time, student safety and dignity should not be treated as administrative afterthoughts. A prevention-centered response does not require casual disclosure. It requires clear rules, careful documentation, staff training and honest communication about the legal limits of confidentiality. For readers comparing related student-record disputes, The Parative Project has also examined how a FERPA regulations proposal could affect vendor disclosures and enforcement.
Consent, Vendors And Voter Data
Vendor Disclosures Are A Key Test
The Department’s agenda identifies non-consensual disclosures, including disclosures to vendors, as an area under review. That matters because many schools rely on outside systems for enrollment, learning platforms, assessment, analytics, messaging and administrative services. If proposed rules narrow or clarify when vendors may receive personally identifiable information, institutions may need to revisit contracts, data maps and destruction timelines.
Vendor governance is not only a compliance issue. For families who have experienced misuse of sensitive information, the harm often comes from not knowing who received a record or why. Clear consent practices and transparent data-sharing notices can reduce confusion before a crisis develops.
S. 5408 Targets Specific Postsecondary Disclosures
Congress has also entered the debate through narrower legislation. Senate Bill S. 5408 was introduced on September 16, 2026, and would prohibit certain postsecondary disclosures of personally identifiable information, including directory information, to measure student voter registration or voting rates without prior, informed, written consent. It would also prohibit the sale of student personally identifiable records, including directory information, without consent, under the introduced text of S. 5408.
The bill’s wording is important because it addresses directory information, a category that students and families may wrongly assume is harmless. Directory information can still become sensitive when combined with other data or used for purposes students did not expect. S. 5408 had been introduced, not enacted, as of September 28, 2026, so institutions should not describe it as current law.
Enforcement Pressure And Community Prevention
Institutions Need A Records Map
FERPA compliance is often discussed after a complaint, but prevention starts earlier. Schools should know which offices create student records, which outside platforms hold them, which employees have access, and how requests are logged. A records map can reveal gaps between policy and practice, especially when sensitive information is stored in counseling files, survey tools, health records, student information systems or informal spreadsheets.
For community advocates, the most useful questions are concrete. Does the institution know where personally identifiable information is stored? Can it explain when consent is required? Can it identify vendors that receive data? Does it have a process for subpoenas and law enforcement requests? Are staff trained not to promise confidentiality beyond what law and policy permit?
Why The Stakes Are Higher For Affected Students
Student privacy disputes do not affect all communities in the same way. Students dealing with family conflict, disability records, pregnancy information, immigration-related concerns, discipline files, mental health data or identity-related records may face higher personal consequences if records are disclosed without care. Survivor-informed prevention work asks institutions to limit unnecessary collection, restrict access, and communicate rights in plain language.
In an exploration of the broader public interest in civic and education issues, CA Views offers insights into how government records, individual rights, and local institutions interact significantly. In the school context, this principle is crucial: privacy protections must be both understandable to families and executable by institutions to be effective consistently.
What FERPA Amendments Mean For Student Privacy
The proposed rulemaking and S. 5408 point toward a more contested period for student data governance. FERPA Amendments do not settle every question today, but they signal pressure for clearer definitions, tighter consent rules, closer review of vendor arrangements and stronger enforcement processes.
Schools should avoid treating the proposals as either irrelevant or already binding. The better approach is to prepare: inventory records, review vendor contracts, update parent and eligible-student request procedures, and train staff on the difference between confidential conversations and maintained education records.
For students and families, the immediate lesson is practical. Ask what records exist, where they are held, who receives them and what consent process applies. For institutions, the prevention lesson is equally direct: collect less when possible, document carefully when necessary, and ensure that any disclosure rests on a clear legal basis rather than habit or convenience.