Using FERPA to Protect Your Child’s Test Data
Standardized test results can reveal far more than a score. A student’s record may include testing accommodations, answers, demographic details, disability-related information, growth reports, and identifiers that connect results to a particular child. Families have a right to understand how this information is collected, stored, and shared.
The Family Educational Rights and Privacy Act, commonly called FERPA, gives parents important rights over education records held by schools and participating education agencies. It does not eliminate every form of data collection or create a general right to refuse a state test, but it can help families inspect records, challenge errors, and question improper disclosures.
Understand What FERPA Covers
FERPA generally applies to schools and education agencies that receive funds from programs administered by the U.S. Department of Education. Test records maintained by a school, including individually identifiable assessment results, are usually considered education records. A parent or eligible student may inspect and review those records.
The right belongs to the parent while the student is under 18 and has not attended a postsecondary institution. When the student turns 18 or enrolls in college, FERPA rights generally transfer to the student. Schools must provide an annual notice explaining their FERPA procedures, including how families can request records and seek corrections.
FERPA also limits disclosure of personally identifiable information without written consent, although several exceptions apply. These may include disclosures to school officials with legitimate educational interests, certain audits or evaluations, health and safety emergencies, and contractors performing institutional services.
Locate The Data And Its Custodians
Begin by identifying every organization involved in the assessment. The school district may hold individual score reports, answer documents, accommodation information, and testing correspondence. A regional or state education department may retain additional records, while a testing vendor may process information under a contract with the school or agency.
Ask for the district’s FERPA policy, annual notice, data governance policy, vendor agreements, and privacy notices. Look for terms such as personally identifiable information, student identifiers, biometric information, metadata, de-identification, redisclosure, and data retention. These documents can show whether a vendor is acting as a school official and what limits apply to its use of student information.
Families concerned about the broader policy environment can also examine how private organizations have shaped education and assessment systems through education policy influence. That context does not replace a FERPA request, but it can help parents understand why particular data systems and testing arrangements exist.
Submit A Precise Records Request
Send a written request to the district’s FERPA office, registrar, superintendent, or designated records official. Clearly identify the student, relevant school years, assessments, and categories of records sought. Request electronic copies when possible, and keep proof of delivery.
A strong request might seek score reports, raw or item-level results if maintained, testing accommodations, answer documents, student growth calculations, data-sharing logs, consent forms, vendor contracts, and records describing retention or deletion. Ask the district to identify any withheld records and the legal basis for withholding them.
Schools generally must provide access within 45 days of receiving a request. FERPA does not necessarily require the school to create a new report, explain every statistical calculation, or provide records that the school does not maintain. Still, a precise request can reveal what exists and who controls it.
| Family Action | What It Can Accomplish | Important Limit |
|---|---|---|
| Inspect and copy records | Shows what information is maintained about the student | The school need not create new records |
| Request correction | Allows a challenge to inaccurate or misleading information | FERPA is not a general dispute process for grades or policy judgments |
| Ask about disclosures | Clarifies how information was shared in some circumstances | Some disclosures may be excluded from an accounting |
| Opt out of directory information | Limits certain directory-information releases | It does not automatically stop every permitted FERPA disclosure |
| File a federal complaint | Brings an alleged FERPA violation to the Department of Education | The complaint process does not guarantee a particular remedy |
Challenge Errors In The Record
If a score, accommodation, student identifier, or other factual detail is wrong, submit a written amendment request. Describe the disputed entry, explain why it is inaccurate or misleading, and attach supporting documents. Ask that the record be corrected and retain a copy of everything submitted.
If the school refuses, it must generally inform the parent of the right to a hearing. A hearing is designed to determine whether the record is inaccurate or misleading, not whether the family agrees with the school’s educational judgment. If the decision remains unfavorable, the parent may place a written statement in the record explaining the disagreement.
FERPA does not usually require deletion of an accurate record. It also does not guarantee access to personally identifiable data held entirely outside the school’s education records system. State privacy laws, district policies, contracts, and public-records laws may provide additional rights or protections.
Control Directory Information Carefully
Schools may designate certain information as “directory information,” such as a student’s name, grade level, participation in activities, or honors. FERPA permits disclosure of directory information without consent if the school has given required notice and provided an opportunity to opt out.
Review the district’s directory-information definition rather than assuming that all student data is covered. Submit the opt-out by the district’s stated deadline and specify that it applies to the student. Ask whether the opt-out affects printed publications, online directories, military recruiters, college recruiters, and third-party platforms.
An opt-out does not necessarily prevent disclosures made under other FERPA exceptions. Families should therefore ask separately about assessment vendors, data dashboards, research arrangements, and state reporting systems.
Raise Concerns Beyond The Records Office
A FERPA request can document a problem, but broader testing concerns may require communication with district leaders, elected representatives, and state officials. Explain the specific record, disclosure, retention practice, or policy at issue, and attach relevant documentation without unnecessarily distributing sensitive student information.
Parents seeking a formal state-level response can use this guidance on writing to the education commissioner. Keep the letter factual, identify the action requested, and ask for a written response.
If a family believes a school or agency violated FERPA, it may file a complaint with the U.S. Department of Education’s Student Privacy Policy Office. Complaints generally must be submitted within 180 days of the alleged violation or the date the complainant knew or reasonably should have known about it.
Prepare Before You Write
A careful paper trail makes it easier to protect a child’s education records and identify the proper decision-maker.
- Save score reports, privacy notices, consent forms, emails, and testing instructions in one secure folder.
- Record the dates of every request, response, disclosure notice, and follow-up communication.
- Ask for the district’s data-sharing, retention, breach-response, and directory-information policies.
- Redact other children’s information before sharing documents with advocates or public officials.
- Escalate unresolved concerns through the district, state education agency, and federal FERPA complaint process as appropriate.
Families can use FERPA as a practical accountability tool: inspect what has been collected, challenge factual errors, restrict directory-information releases, and demand clarity about outside data processors. Taking these steps helps parents make informed decisions about testing and gives communities a documented basis for seeking stronger student privacy protections.