FERPA and student data: complete guide for US colleges and universities

Federal and state privacy laws apply to every piece of data your institution collects about a prospect or student

In the United States, student data privacy is governed by a layered framework of federal and state regulations. The cornerstone is FERPA (Family Educational Rights and Privacy Act), administered by the US Department of Education, which protects education records of students at institutions receiving federal funding — effectively every accredited college and university in the country. But FERPA is only the starting point: state laws such as the CCPA (California Consumer Privacy Act), Virginia's CDPA, Colorado's CPA, and dozens of other state data breach notification laws add additional obligations that vary by jurisdiction.

Non-compliance is not a theoretical risk. In 2025, the FTC (Federal Trade Commission) and multiple state attorneys general took enforcement actions against educational organizations for inadequate data practices. FERPA violations can result in loss of federal funding — a threat that effectively means institutional closure. State privacy law violations carry fines ranging from $2,500 to $7,500 per violation under the CCPA alone.

This guide covers the concrete obligations for higher education institutions: data categories, legal bases for processing, consent requirements, student rights, compliance officer roles, and the emerging implications of AI regulation for admissions tools and chatbots.

Categories of personal data processed by a university

Prospect data (pre-enrollment)

Data collected before enrollment forms the first privacy perimeter for any institution. This includes:

Identification data — name, email address, phone number, collected through inquiry forms, chatbot, or campus tour registration
Browsing data — pages visited, time spent, acquisition source, gathered by Google Analytics or equivalent
Conversational data — questions posed to the chatbot, conversation history, language used
Application data — transcripts, college essay, SAT/ACT scores, letters of recommendation, identity documents submitted through the Common App or Coalition App

89% of prospects ask about tuition costs and 78% inquire about internship and co-op opportunities (Source: analysis of 12,000 Skolbot chatbot conversations, Sept 2025 — Feb 2026). These exchanges constitute protected data the moment an identifier (name, email) is linked to the conversation.

Enrolled student data

Once enrolled, a student generates a significantly larger volume of data:

Academic data — grades, attendance, progression, GPA, degree certificates
Financial data — tuition charges, payment schedules, scholarships, FAFSA information
Campus life data — building access (ID card), dining services, housing records
Sensitive data — disability accommodations, health records (campus health center), disciplinary records

Under FERPA, education records include virtually all records maintained by the institution that are directly related to a student. Directory information (name, enrollment status, major) can be disclosed without consent only if the institution has followed proper notification procedures and students have had the opportunity to opt out.

Alumni data

Processing alumni data (directories, donations, networking events) requires careful attention to privacy obligations. While FERPA rights transfer to the student upon reaching 18 or attending a postsecondary institution, many state privacy laws continue to apply to alumni data. Consent given during enrollment does not automatically cover post-graduation engagement.

The US student data privacy framework

FERPA: the federal foundation

FERPA applies to all institutions that receive federal financial assistance. Its core provisions:

Access rights — Students (and parents of dependent students) have the right to inspect and review education records within 45 days of a request.
Amendment rights — Students may request correction of records they believe are inaccurate or misleading.
Consent requirement — Institutions generally must obtain written consent before disclosing personally identifiable information from education records.
Directory information exception — Institutions may disclose directory information without consent, provided students have been notified and given the opportunity to opt out.
School official exception — Disclosure to school officials with a legitimate educational interest does not require consent.
Legitimate educational interest — Must be defined in the institution's annual FERPA notification.

The US Department of Education's Student Privacy Policy Office provides detailed guidance and handles FERPA complaints.

State privacy laws: the expanding patchwork

Beyond FERPA, institutions must comply with state-specific privacy regulations:

California (CCPA/CPRA) — Applies to institutions meeting revenue or data-processing thresholds. Gives consumers the right to know, delete, and opt out of the sale of personal information. The California Attorney General enforces.
Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA) — Similar consumer privacy frameworks with varying thresholds and enforcement mechanisms.
State data breach notification laws — All 50 states have data breach notification requirements. Institutions must notify affected individuals within timeframes ranging from 30 to 90 days depending on the state.
State student privacy laws — Some states (e.g., California's SOPIPA, New York's Education Law 2-d) impose additional protections specifically for student data.

Title IX and civil rights data

Data related to Title IX investigations, disability accommodations under the ADA, and civil rights compliance under the Civil Rights Act carries additional handling requirements. This data is typically subject to stricter access controls and longer retention mandates.

Common mistake: treating FERPA as the only obligation

Many institutions treat FERPA as their sole privacy obligation. This is a significant compliance gap. FERPA addresses education records but does not cover all personal data processing — particularly marketing data, website analytics, and chatbot interactions with prospects who have not yet enrolled. State consumer privacy laws (CCPA, CDPA, CPA) fill these gaps and impose independent obligations.

The correct approach: use FERPA for education records, apply state privacy laws for consumer and marketing data, and implement a comprehensive privacy program that addresses both.

While most higher education prospects are 18 or older, dual enrollment programs, early college initiatives, and some freshman admits may involve minors. Under FERPA, parents control access to education records until the student turns 18 or attends a postsecondary institution. Under COPPA (Children's Online Privacy Protection Act), websites and apps directed at children under 13 require verifiable parental consent.

For minor prospects: parental consent may be required for marketing communications. Forms must include age verification and, where applicable, parental consent mechanisms.

An AI chatbot that collects personal data must inform the prospect before the conversation begins:

That they are interacting with an artificial intelligence (emerging transparency norms under state AI laws and the NIST AI Risk Management Framework)
What data is collected and why
How to exercise their rights (access, correction, deletion)
How long conversations are retained

An information banner at the chatbot launch, with a link to the privacy policy, fulfills this obligation. The chatbot must not condition access to information on providing personal data: a prospect should be able to ask about programs without giving their name or email.

Student data rights

The rights your institution must guarantee

Federal and state laws confer multiple rights on data subjects (prospects, students, alumni). Your institution must have operational procedures to respond to each:

Right of access (FERPA) — Students may inspect and review all education records within 45 days.
Right to amendment (FERPA) — Correction of inaccurate or misleading records.
Right to consent to disclosure (FERPA) — Students control who receives their education records, with enumerated exceptions.
Right to file a complaint (FERPA) — With the Student Privacy Policy Office at the US Department of Education.
Right to know (CCPA/state laws) — What personal information is collected, used, and disclosed.
Right to delete (CCPA/state laws) — Request deletion of personal information, subject to exceptions.
Right to opt out (CCPA/state laws) — Of the sale or sharing of personal information.
Right to non-discrimination (CCPA/state laws) — For exercising privacy rights.

Cascading deletion: a technical challenge

When a prospect exercises the right to deletion under state privacy laws, all data concerning them must be removed from every system: CRM, chatbot, email platform, named analytics, backups. The cost per enrolled student ranges from $3,000 to $4,200 in the US (Source: estimates based on NACAC, EAB, IPEDS data). Each deletion request therefore represents a marketing investment loss — all the more reason to minimize data collection from the outset.

Deletion must be completed within the timeframe specified by the applicable state law (typically 45 days under the CCPA). A documented cascading deletion process, tested regularly, is essential.

Privacy compliance officers: roles and obligations

When is a dedicated privacy officer required?

Unlike the EU's GDPR, US federal law does not mandate a specific data protection officer role. However, FERPA requires institutions to designate a school official responsible for education records. In practice, most institutions of any size designate a Chief Privacy Officer (CPO), Chief Information Security Officer (CISO), or compliance officer to manage privacy obligations across the institution.

The EDUCAUSE Higher Education Information Security Council recommends dedicated privacy staffing for any institution processing data from more than a few hundred students. Regional accreditation bodies (SACSCOC, HLC, MSCHE, WASC, NEASC, NWCCU) increasingly expect documented privacy governance as part of institutional effectiveness standards.

Internal or external compliance?

Both options are valid. An internal privacy officer understands institutional processes better but risks conflicts of interest if they also hold a decision-making role. External privacy consultants bring specialist expertise but need time to understand the specific context of higher education.

The privacy officer must have direct access to senior leadership, authority to implement policy changes, and adequate resources (budget, tools, staff).

AI regulation and its implications for universities

The evolving US AI regulatory landscape

The United States does not yet have a comprehensive federal AI law equivalent to the EU AI Act. However, the regulatory landscape is evolving rapidly:

Federal level:

The Executive Order on Safe, Secure, and Trustworthy AI establishes principles and directs federal agencies to develop sector-specific guidance.
The NIST AI Risk Management Framework (AI RMF) provides a voluntary framework for managing AI risks, including in education applications.
The FTC has authority over unfair and deceptive AI practices and has issued guidance on AI transparency and algorithmic fairness.

State level:

Colorado's AI Act (effective 2026) imposes obligations on developers and deployers of "high-risk AI systems," which may include admissions algorithms.
Illinois' AI Video Interview Act requires consent before AI-analyzed video interviews.
Multiple states have proposed or enacted AI transparency and bias audit requirements.

AI in admissions: emerging obligations

AI systems used for admissions decisions, application screening, or financial aid determination face growing scrutiny:

Algorithmic fairness — The FTC and Department of Education have signaled that AI tools producing discriminatory outcomes in admissions could violate Title VI of the Civil Rights Act and Title IX.
Transparency — Applicants are increasingly expected to be informed when AI is used in evaluating their application.
Human oversight — Best practice (and emerging legal requirement) is that AI may recommend but must not make final admissions decisions without human review.
Bias auditing — The NIST AI RMF recommends regular bias testing of AI systems, particularly those affecting educational access.

Information chatbots: lower risk, still regulated

Pre-admissions information chatbots carry lower regulatory risk than decision-making AI systems. The primary obligation is transparency: the prospect must know they are interacting with AI. Several state laws (including Colorado's AI Act) require this disclosure. The FTC's guidance on AI transparency applies regardless of specific state legislation.

Accreditation and data governance

Regional accreditation expectations

US regional accreditation bodies — SACSCOC, HLC, MSCHE, WASC, NEASC, NWCCU — evaluate institutional effectiveness, which increasingly includes data governance. Accreditation standards require:

Documented data governance policies and procedures
Evidence of compliance with applicable privacy laws
Regular assessment of information security practices
Institutional review board (IRB) oversight for research involving student data

IPEDS (Integrated Postsecondary Education Data System) reporting, managed by NCES, requires institutions to submit detailed student data. This data must be handled according to NCES confidentiality standards.

Programmatic accreditation

Specialized accreditation bodies (AACSB for business, ABET for engineering, ABA for law) may impose additional data handling requirements specific to their discipline. These should be incorporated into the institution's overall privacy framework.

Data security: technical and organizational measures

The principle of data minimization

Minimizing data collection is a best practice under FERPA and a legal requirement under many state privacy laws. For a chatbot, this means: not requiring name, email, or phone number to answer a question about programs. Identifier collection is only justified when the prospect wishes to be contacted.

Essential technical measures

Encryption — In transit (TLS 1.3) and at rest (AES-256) for all personal data
US-based hosting — Servers within the United States, compliant with applicable federal and state requirements. The FedRAMP framework provides a reference for cloud security, particularly for institutions handling federal data.
Pseudonymization — Separation of direct identifiers from behavioral data
Access logging — Traceability of who accesses which data, when
Encrypted backups — With regular restoration testing
Automated deletion — Purge of data beyond the defined retention period

Data risk assessments

Best practice — and increasingly required by state privacy laws — is to conduct data risk assessments before deploying systems that process significant volumes of personal data. For a university, this includes:

Deploying an AI chatbot that collects personal data
Using AI tools for application assessment
Campus security camera systems
Prospect profiling for marketing purposes

The assessment must describe the processing, evaluate its necessity and proportionality, identify risks, and propose mitigation measures. The NIST Privacy Framework and EDUCAUSE provide templates and guidance.

FAQ

Is an AI chatbot compliant with US student privacy laws?

Yes, provided key obligations are met: informing the prospect that they are interacting with AI (transparency), collecting only necessary data (minimization), offering easy access to privacy rights information, and implementing appropriate security measures. Under FERPA, chatbot conversations generally are not "education records" until a student is enrolled and the data is maintained by the institution as part of the student's record. However, state consumer privacy laws (CCPA, CDPA) may apply to all chatbot interactions regardless of enrollment status.

How long can you retain a non-enrolled prospect's data?

There is no single federal standard. Best practice is to retain marketing prospect data for no more than 2-3 years after the last contact. For a prospect who never responded: deletion after 2 years. For a rejected applicant: application file retention for 1-3 years (for potential legal claims), then deletion. Many institutions follow the NACAC (National Association for College Admission Counseling) recommended retention schedules. These periods must be documented in the institution's data retention policy.

Does emerging AI regulation ban AI use for admissions?

No. Neither federal guidance nor current state laws ban AI in admissions. However, AI systems used for admissions decisions face growing expectations around transparency, fairness, and human oversight. The NIST AI Risk Management Framework recommends documented risk management, bias testing, effective human oversight, and transparency toward applicants. Colorado's AI Act (effective 2026) may classify admissions algorithms as high-risk AI systems with specific compliance obligations.

Must a small college with 500 students have a privacy officer?

In practice, yes. While there is no federal mandate for a specific privacy officer title, FERPA requires a designated records custodian, and accreditation bodies expect documented privacy governance. For a small college, the role may be combined with other compliance functions or outsourced to a qualified consultant. EDUCAUSE and NACUBO offer resources for smaller institutions building privacy programs.

How do you handle a deletion request from an alumni?

Deletion cannot be total: the institution has legal obligations to retain proof of degree conferral and academic transcripts (FERPA requires maintaining education records). Financial data is subject to IRS record retention requirements (typically 7 years). However, marketing data, campus activity records, and communication preferences must be deleted upon a valid request under applicable state privacy laws. Document the response in writing, detailing which data was deleted and which was retained with its legal basis.

Student data privacy compliance is not a one-time project. It is a continuous process that touches every department of your institution — admissions, the registrar's office, marketing, IT, and senior leadership. Institutions that build privacy into their tools from the outset (privacy by design) protect their students and protect themselves.

To learn more about AI transparency obligations for universities, read our article on the AI Act and higher education. For technical protection measures, see our guide on protecting prospect data.

Federal and state privacy laws apply to every piece of data your institution collects about a prospect or student