Who Can See Your Grades? A Plain-Language Guide to FERPA and Your Academic Privacy Rights

Most college students sign dozens of forms during enrollment without pausing to read them. Buried among housing agreements and tuition payment plans is often a brief reference to the Family Educational Rights and Privacy Act — better known as FERPA. It is a federal law that has governed academic record privacy since 1974, yet a remarkable number of students graduate without ever understanding what it actually protects, who it restricts, and — perhaps most importantly — where it falls short.

This article is not a legal brief. It is a practical map of a law that affects every student in the United States who attends a federally funded institution, which means virtually every public university, community college, and most private colleges in the country.

What FERPA Actually Protects

At its core, FERPA grants students two fundamental rights: the right to inspect their own educational records, and the right to request corrections to records they believe are inaccurate or misleading. Once a student turns 18 — or enrolls in a postsecondary institution regardless of age — those rights transfer from the parents to the student.

The records covered under FERPA are broader than most people assume. Grades and transcripts are the obvious examples, but the law also applies to enrollment records, financial aid files, disciplinary proceedings, and even certain advising notes. If a document is directly related to a student and maintained by the institution, it almost certainly falls under FERPA's umbrella.

The practical effect is straightforward: your college cannot share those records with a third party without your written consent. A parent calling the registrar to ask about your GPA? Legally, the office is not permitted to confirm or deny anything without your authorization on file. A family friend who works in the admissions office? Same restriction applies.

The Exceptions That Surprise Most Students

Here is where FERPA becomes considerably more complex — and where students are most frequently caught off guard. The law contains a notable list of exceptions that permit institutions to disclose educational records without obtaining student consent first.

Some of these exceptions are intuitive. Schools may share records with other school officials who have a legitimate educational interest, such as an academic advisor reviewing a student's course history. They may also share records with institutions to which a student has applied for transfer, provided certain conditions are met.

Other exceptions are less obvious. In a health or safety emergency, schools may disclose information to appropriate parties if knowledge of that information is necessary to protect the student or others. Judicial orders and lawfully issued subpoenas can also compel disclosure, though institutions are generally required to notify the student before complying — unless the subpoena explicitly prohibits such notification.

Perhaps the most frequently misunderstood exception involves what FERPA calls "directory information." This category can include a student's name, address, phone number, email address, enrollment status, dates of attendance, and field of study. Institutions are permitted to disclose directory information publicly unless a student formally opts out. Many students are unaware they must take an affirmative step to restrict this information — it is not protected by default.

When Employers Request Records Directly

A common scenario plays out every year across the United States: a prospective employer contacts a college registrar directly, requesting confirmation of a candidate's degree or transcript. What happens next depends on whether the student has provided written consent.

Without that consent, a properly operated registrar's office will decline to release substantive records. However, employers may still be able to confirm basic directory information if the student has not opted out. This distinction matters. An employer might not receive a full transcript, but they could potentially confirm that a person with a given name attended an institution during a particular period.

For students navigating job applications, the takeaway is practical: understand what your institution classifies as directory information, opt out of its public disclosure if you prefer privacy, and be prepared to provide signed authorization when a legitimate employer requests formal verification through appropriate channels. Reputable credential verification services operate precisely to facilitate this process in a compliant manner.

Data Breaches and the Limits of FERPA's Protection

FERPA was written in an era of paper files and locked cabinets. The law has not kept pace with the digital realities facing modern institutions. When a university suffers a data breach — and these incidents have increased substantially over the past decade — FERPA does not independently require the institution to notify affected students. Notification obligations, where they exist, typically come from state breach notification laws rather than federal education privacy rules.

This gap is significant. A student's grades, enrollment history, and financial aid data may be exposed in a cyberattack, and the federal law most directly governing that data provides no mandatory reporting framework. Students affected by such incidents may have remedies under state law or through institutional policy, but FERPA itself offers limited recourse.

This reality underscores the importance of proactively understanding what data your institution holds, how it is stored, and what security practices are in place. Many registrar offices publish data governance policies; reviewing them is a reasonable first step.

Your Right to Inspect and Dispute Your Records

Beyond privacy, FERPA grants students a meaningful right to review their own academic records. Upon written request to the registrar, an institution must provide access within 45 days. This right extends to all covered educational records, not simply transcripts.

If a student believes a record contains an inaccuracy — a grade incorrectly entered, an enrollment date that does not match reality, or a disciplinary notation that misrepresents events — FERPA provides a formal process for requesting amendment. The institution must either correct the record or explain in writing why it declines to do so. If the institution refuses, the student is entitled to a formal hearing. If the hearing does not resolve the dispute, the student may insert a statement into the record explaining their objection.

This mechanism is not designed to challenge a professor's academic judgment — a student cannot invoke FERPA simply because they disagree with a grade. It is intended to address genuine errors of fact.

Taking Control Before a Problem Arises

The most effective approach to academic privacy is proactive rather than reactive. Before a situation arises — whether that is a job application, a graduate school inquiry, or a family dispute over records — students benefit from taking several concrete steps.

First, request a copy of your own educational records from your institution's registrar. Reviewing them confirms their accuracy and familiarizes you with exactly what is on file. Second, determine what your institution classifies as directory information and submit an opt-out request if broader disclosure is not in your interest. Third, understand the consent forms you sign — particularly any blanket authorizations that may grant ongoing access to your records by third parties.

Finally, recognize that FERPA is a floor, not a ceiling. Institutions may adopt policies that are more protective than the federal baseline requires. Knowing your institution's specific practices gives you a clearer picture of your actual rights.

Academic records are among the most consequential documents a person accumulates during their educational career. The law that governs them deserves more than a passing glance at an enrollment form. Understanding FERPA — its protections, its exceptions, and its limitations — is a practical step toward managing your academic identity with the same care you would give any other significant personal record.