With Congress engaged in broader debates about education, technology and data privacy, this is a moment when FERPA modernization is no longer an abstract policy discussion. Congress should update FERPA so it can do what its original authors intended: safeguard student privacy and serve families.

FERPA was enacted in 1974 — over 50 years ago — to codify with whom and under what circumstances schools could share students’ personally identifiable information. But since then, the ways in which student data is handled have seismically shifted. 

Today, districts and schools store and share data digitally — not on paper stored in filing cabinets. Yet FERPA remains rooted in a paper-record era that predates real-time dashboards and digital tools. The law does not yet account for the rapidly evolving technology-driven practices that affect student privacy.

Parents are rightly wary of how their children’s data is collected, stored and used — especially as data breaches continue to make headlines. A FERPA that reflects America’s current digital landscape is long overdue. 

Because FERPA has never been statutorily updated, states and school systems are left to navigate a murky and complicated legal landscape as they work to both protect students and share data in smart ways. This ambiguity can result in states, school districts or colleges and universities from responsible data-sharing practices out of fear of violating FERPA’s convoluted provisions.

All this ultimately denies families access to the very insights and information they need to advocate for their children. Heightened concern about student data privacy should be met with clearer rules designed to modernize security protections and build trust with families, not used as an excuse to prevent action or to cease sharing useful information with parents.

This is not what student data privacy should look like. And it’s certainly not what families deserve. The nation can — and must — do better.

A modernized FERPA must ensure that student information is safeguarded with the highest standards of security and ethical use, while empowering families with the information they need to make informed decisions. Parents are clear that they want access to this information: say they support requiring schools to provide access to transparent data on student achievement, discipline and enrollment for families and policymakers. And say easier access to information would help them feel more confident about their ability to help their child make decisions about life after high school. 

It’s time for Congress to modernize FERPA so it works for today’s families. That means setting strong, enforceable privacy standards to ensure student data is protected. It also means affirming families’ rights to access information that empowers them: data on academic progress, school quality and services available to help students thrive.

An updated FERPA should also unlock the potential of state data systems that securely connect longitudinal information across early childhood, K-12, postsecondary and workforce programs — systems that can enable parents, students, educators, policymakers and the public to understand what’s working for students and what’s not. Today, FERPA’s framework does not reflect how cross-agency data can be used to, for example, connect high school students with college scholarship programs or assess return on investment for a district’s tutoring programs.

Student privacy and parent empowerment are not competing goals. With the right legal framework, congressional leaders can achieve both. Parents shouldn’t have to choose between protecting their children’s information and knowing how to help them succeed.

While the matter focused on a student with disabilities, Trump officials appear to have homed in on it because it addressed a separate question central to the administration’s agenda: Do parents have a right to read staff emails about their children?

With the administration accusing districts of hiding students’ gender transitions from parents, experts say their answer is yes. 

“I don’t think there’s any question that they’re going to say [emails] should be available to parents,” said Amelia Vance, president of the nonprofit Public Interest Privacy Center. 

Education Secretary Linda McMahon signaled the department’s intention when she said districts have turned the “concept of privacy on its head to facilitate ideological indoctrination … without parental interference or even involvement.” 

In a message to the Wisconsin district, a department official acknowledged the issue’s importance to parents, students and school officials and said that districts can expect “guidance or regulations in the foreseeable future.” Contacted Aug. 14, department spokeswoman Madison Biedermann had no updates on timing. 

Enforcing the Family Educational Rights and Privacy Act, which gives parents the right to inspect and amend their children’s education records, is a central focus of the administration’s parental rights agenda. The law was enacted 50 years ago, long before the advent of digital records. In the past, courts have sided with districts that argued emails were not education records, while parents say they should be treated just like report cards or schoolwork. Districts are likely to push back on being required to disclose internal messages about students, Vance said. Not only might a search eat up staff time, but “people say stupid things in emails.”

‘Numerous’ requests

Biedermann, the department spokeswoman, would not say why officials revived the 12-year-old complaint.

But in the March letter reminding states of their responsibilities under FERPA, McMahon said “schools are routinely hiding information about the mental and physical health of their students from parents.”

In a sign of its commitment to reshaping FERPA, the department hired Lindsay Burke in June as its deputy chief of staff for policy and programs. The author of the education section of , a vision for Trump’s second term, she contends that FERPA should offer parents the right to sue districts they think have violated their rights. Filing a complaint is currently the only option under the law. She also argues that students shouldn’t be able to change their gender identity at school without a parent’s permission.  

Like many districts faced with similar FERPA requests, Middleton Cross Plains, northwest of Madison, leaned on a that many experts feel is out of step with the digital age. It suggests that communications like email are not part of a student’s official record unless they are printed and physically placed there. 

FERPA was originally intended to target records “stored in file folders and cabinets,” said Andrew Manna, an Indiana attorney who represents districts. “There is no software that I am aware of that can sort through the digital storage of emails, so it is a ‘hide and seek’ approach to trying to find the email specific to a student.” 

Districts also say that combing through years of emails is too burdensome for staff and is likely to produce irrelevant communication. Vance suggested that argument might be outdated “at this moment in time with what AI is capable of.”

But while there might be more tech tools to conduct searches, there’s no guarantee AI is secure, said Stephanie Jones, an attorney with a firm representing districts in Illinois. 

Searching emails “is both an art and a science,” she said. As an example, a district she represents once had a request for emails related to a student with the last name Fridge. “You wouldn’t believe how many employees try to sell their college kid’s dorm room fridge through district email.”

In the Wisconsin case, Frank Miller, acting director of the Education Department’s privacy office, determined that the district was simply following long-standing legal precedents on FERPA when it declined to provide a parent with staff emails about her child. 

Superintendent Dana Monogue wasn’t in charge when the parent filed the complaint, but said she was pleased with the outcome.

“Like all districts, we receive numerous student record requests each year and this letter will provide useful guidance regarding our obligations,” Monogue said. 

But while he gave the district a pass, Miller had more to say. 

He referenced a second court ruling, from 2009, that often guides the way districts handle requests for emails. In , a federal district court in California said an email about a student is only part of the official record if the district “maintains” it in a central location.

Emails “have a fleeting nature” and “may be sent, received, read and deleted within moments,” the judge said in that case. 

The department, Miller said, rejects the Tulare interpretation, even though it’s been widely adopted by districts. Middleton Cross Plains officials told the parent that it used Infinite Campus, a “third-party, cloud-based” system to store emails, and said that emails that are “simply still on a server” are not education records.

A recent is another sign that the legal landscape could be shifting. The state Supreme Court ruled that emails stored in an online platform are still subject to FERPA.

‘Defies reality’

Jim Wheaton, an associate professor at William and Mary Law School, has little tolerance for districts that turn down parents’ requests for emails.

“Essentially, a school [or] district can simply decide not to physically put something in a file, and important, relevant discussions about a child suddenly fall outside FERPA,” said Wheaton, who runs a law clinic for students who intend to work as special education advocates. “The idea that files continue to be physical paper defies reality.”

As an alternative, some parents file public records requests to obtain emails, but districts often charge hefty fees to cover the staff time involved, and may heavily redact the documents before releasing them. Wheaton said public records laws are not an adequate FERPA substitute.

“I once received a letter asking me to prepay a quarter million dollars before they would do the search,” he said.

In 2024, Tamara Quick, a Virginia mother of five, asked the Spotsylvania school district for emails regarding her ninth-grader. Because of her dyslexia, Brennan attends a private school at the district’s expense.

When Quick learned teachers weren’t following her daughter’s special education plan, she hoped some email exchange between the district and the school might reveal why Brennan wasn’t being challenged in reading and spelling. 

“Any information you have about my kids, I have a right to see,” she said. 

Instead, the district said it had not “maintained” any communications with the girl’s teachers and, therefore, had “no education records responsive” to her request. Quick ultimately took the district to court, saying she couldn’t get the emails through the Virginia Freedom of Information Act either. 

In court records, the district said she never filed a formal request. An attorney for the district said officials “make every effort” to produce the records parents want, but “do not have time for games.”

The district eventually offered to look for emails for Quick and give her a cost estimate. But she didn’t think she should have to pay. Under the Individuals with Disabilities Act, parents have a their children’s records before a meeting to discuss special education services. 

She’s paying anyway. To this date, she’s spent over $30,000 on her case, withdrawing funds from a retirement account.

“Obviously it would have been cheaper for me to say, ‘OK, I’ll pay $2,000 for you to search for these emails,’ but that would be me agreeing that was appropriate,” she said.

‘Very negative things’

Parents may have multiple reasons for requesting staff emails, but McMahon’s March letter about privacy focused primarily on gender issues. Schools, she said, “promote and enable the transitioning of minor children, regardless of their mental state or their vulnerabilities.”

That’s what worried Amber Lavinge, a Maine parent, when she sought emails between staff members in the Great Salt Bay Community School district. It was late 2022 and she had just learned that a school social worker had given her 13-year-old daughter a chest binder to support a gender transition. But the district didn’t provide what she was looking for, said Adam Shelton, an attorney with the libertarian Goldwater Institute, which is handling her against the district. 

“She had a lot of questions and was just trying to understand what was going on,” he said. While the case, pending before the U.S. Court of Appeals for the First Circuit, doesn’t focus on emails or student records, he said he has a hard time understanding how any form of communication pertaining to a student wouldn’t constitute an education record. “Schools exist for the sole purpose of educating children.” 

Narrowing down which emails to release might be tricky, but Matt Cohen, a civil rights attorney in Chicago, said there are other reasons why districts avoid it.

“Sometimes teachers or administrators say very negative things about a child or the parents in the email that they’re not saying publicly,” he said. “It helps to establish that there is actual animus or discrimination going on.”

Jones, the other Illinois attorney, agrees that there can be a “reputational cost” for districts if they have to release embarrassing emails. That’s why she advises district staff to avoid “watercooler conversations” in emails — something many more are likely to take seriously if they know parents might read what they write, Jones said. 

“It has to pass the grandma test,” she said. â€œIf you don’t want your grandma reading it, then don’t put it in an email.”

While scrolling through Instagram, the mother noticed her child’s friends also called the teen Toby. So she began digging for further evidence of something she had started to suspect — that the ninth grader, with the school’s support, was transitioning from female to male.

“I’m like ‘Hey, you can’t deny it anymore’ ” said Lydia, who did not want to use her last name out of a desire to protect her child, now 17.

The school’s principal, following guidance that allows students to decide whether to inform parents of their gender identity, refused to meet with her. But she found clues elsewhere — an alternate ID card with the name Toby stuffed in a backpack, and emails between district staff discussing which name to use in the yearbook.

Over time, she discovered her child’s transition was an open secret at school — one kept by staff, administrators, a district equity officer, the superintendent, even the president of the local teachers union.

“They were strategizing against me,” Lydia said.

Her experience now lies at the center of a major push by the U.S. Department of Education to clamp down on policies that allow schools to conceal changes in students’ gender identity from parents.  

In a March press release announcing an investigation into , Education Secretary Linda McMahon said teachers and counselors should stay out of “consequential decisions” about children’s sexual identities. Officials are probing similar allegations in and .

In an unprecedented move, the department is threatening to pull millions of dollars in federal education funding from all three states. 

But it’s putting all schools on notice. In , federal officials warned states and districts that their support of student “gender plans” had become a “priority concern.” For educators, the message was as stunning as its rationale. The department is relying on a novel, and according to some critics, incorrect, interpretation of a 50-year-old student privacy law known as the Family Educational Rights and Privacy Act, or FERPA.

The law is typically used to safeguard student records and allow parents to inspect them. But it doesn’t compel schools to inform parents how their children identify in the classroom. If schools link a record to a student, “the parent has a right of access to it if they request it,” said LeRoy Rooker, who oversaw compliance with FERPA at the Education Department for over 20 years. But “the school doesn’t have to be proactive and call and say ‘Hey, we did this.’ ”

Department leaders appear to be stretching the reach of the law in an attempt to bolster conservative arguments that schools are meddling in deeply personal decisions that should be left to parents. In response to the Washington investigation, state Superintendent Chris Reykdal said in a statement that his state is the “latest target in the administration’s dangerous war against individuals who are transgender” and that officials are twisting student privacy laws “to undermine the health, safety and well-being of students.” 

To Julie Hamill, a Los Angeles-area attorney who to investigate, Lydia’s story demonstrates that a law designed to keep parents informed is now working against them.

”The parents are in the dark,” said Hamill of the conservative California Justice Center. “Parents will not know student records are being withheld unless they’ve somehow discovered it on their own.”

In tackling the role of schools in student gender transitions, the department is dipping into one of the more emotionally fraught issues in the culture war, one that President Donald Trump campaigned on and weaponized once he was back in the White House. 

In one of his first , Trump said, without evidence, that schools are “steering students toward surgical and chemical mutilation.” In March, who reversed their gendering processes. She criticized the “lengths schools would go to in order to hide this information from parents.”

To many experts, the administration’s scrutiny is out of proportion to the scope of the issue. In the overwhelming majority of cases, schools and students are just navigating preferred names and pronouns, and even those situations are infrequent. Multiple estimate that about 3% of teens are transgender. Far fewer are likely to approach school officials with a request for a name or pronoun change, said Brian Dittmeier, the director of public policy at GLSEN, which advocates for LGBTQ students.

Loretta Whitson, executive director of the California Association of School Counselors, said it is “rare” for school officials to discuss transitioning with students, and that her group’s members say the only gender plans they’ve completed were done at the request of parents. 

At the same time, most Americans agree that schools should get parents’ permission before changing a child’s pronouns in school records. Polls in and found that roughly three-quarters of adults support mandatory parental notification.

‘This is not real’

Lydia’s story exemplifies that loss of trust in the system.

The artist and former ballerina she thought of as her daughter began identifying as transgender upon entering Academy of the Canyons, a public high school in Santa Clarita, an upscale suburb of Los Angeles. Homeschooled since kindergarten, the teen wanted to pursue art and take advantage of options in their district. The school is located on a college campus where students can attend post-secondary classes while earning their high school diplomas.

“I thought it would be a good opportunity,” Lydia said.

In the fall of 2021, while cleaning the ninth grader’s bedroom, Lydia flipped through some art journals. But instead of schoolwork, she found disturbing sketches of bloody body parts and notes about wanting a chest binder, top surgery and a new name. 

“Shocked and scared” that her child might be suicidal, her thoughts turned immediately to a friend of her son’s who’d recently taken his own life, apparently without warning. 

“No suicide notes. No threats,” she recalled. “The ones that never use it as a weapon are the ones that follow through.”

She began searching for answers online. Initially, she only found sites about supporting a child’s transition  — advice she rejected.

Unlike many parents in her shoes, she’s neither conservative nor religious. In fact, she quipped, an outsider might have assumed she was  “the poster mom for transitioning my kid.”

She described her own parents — a Black father and a Jewish mother — as “hippie artists” who raised her to be a “free thinker” without religion. Lydia’s mother changed her name to Michael in the 1960s because it was easier to make it in the art world with a man’s name. A lifelong Democrat, Lydia voted against a ban on gay marriage when it was on the state ballot in 2008.

But when it came time to have kids of her own, she embraced more conservative values, wanting to “protect their childhood.”

Speaking as a liberal, Lydia said, “I really should have been like ‘Yeah, sure, explore your transgenderism.’” But instead, she did the opposite, taking a hard line against the shift. “I said ‘ I love you, but I’m not affirming you. This is not real.’ ” 

That view belies a that some children can identify differently as young as 3 or 4. Other research shows children can experience due to gender dysphoria — feeling that their sex was misassigned at birth — starting at age 7. 

In attempting to explain what was happening with her child, Lydia turned to a controversial theory of researcher Lisa Littman. In a , the former Brown University scientist described the rise in rapid onset gender dysphoria among  as a “contagion” driven by peer pressure and social media.

“I did what every parent did during the pandemic — let their kid be online way too much,” Lydia said. 

Littman’s research methods from her own university and the broader research community because she based her conclusions largely on reports from self-selecting parents recruited from online forums that were unsupportive, or at least skeptical, of gender transition. They included , which labels itself as “a community of people who question the medicalization of gender-atypical youth.” 

Littman later published an amended of the paper, responding to the controversy and clarifying that the behavior she observed did not amount to a formal diagnosis. Her work, however, continues to drive trans-inclusive policies in school and the views of the Trump administration — and Lydia.

“There is no such thing as a trans child,” Lydia said. 

‘A lot of weight’

It is a debate where the voices of kids directly affected are often absent. J.J. Koechell, a Wisconsin 20-year-old, transitioned in sixth grade after a suicide attempt. He now advocates for other LGBTQ students he says are “entitled to some privacy and consent.”

“They’re trying to figure things out and they don’t want to get it wrong. To disappoint parents is a lot of weight on a struggling youth.”

He watched the school district he attended, Kettle-Moraine, and “safe spaces.” In 2023, as the result of , leaders stopped allowing staff to refer to students by different names and pronouns without parents’ permission. Some staff members over the controversy, including a librarian Koechell trusted. Koechell dropped out and is now finishing high school online.

“My teachers were all I had at school. I didn’t have any friends,” he said. “Coming out was a matter of life and death for me. My identity wasn’t and still isn’t optional.” 

Protecting students like Koechell is the purpose of a new California law — , also known as the “SAFETY Act.” It prohibits schools from requiring staff to disclose a child’s gender identity to their parents. 

In announcing the Department of Education’s investigation of the state, Secretary McMahon said the law “appears to conflict with FERPA.” But GLSEN’s Dittmeier highlighted that the legislation still requires schools to comply with the federal privacy law — and honor parents’ requests for records. 

One department staffer is worried where the investigation could lead. 

“This is irregular, based on our history — to take up an allegation [with] no official complaint, but one that is motivated by an attorney group that is bending the department’s ear about something,” said an employee familiar with the case who asked to speak anonymously to protect his job. He said the administration’s goal is to pressure states and districts into rescinding policies that allow students to decide when to go public with their gender identity. “This will result in districts adopting forced outing and will result in harming children.”

‘Life-altering decisions’

In , the was raging long before the current controversy. 

, police removed state Superintendent Tony Thurmond from a meeting in the Chino Valley Unified School District after a tense exchange with board members over the district’s parental notification policy. He warned the board that their policy could “put our students at risk because they may not be in homes where they can be safe.” The state later against the district as well as others that passed similar measures. 

Continuing its battle with Thurmond, Chino Valley is now the state over the SAFETY Act, saying that minors are “too young to make life-altering decisions” without their parents. 

National data show that of trans and nonbinary students say their home is gender-affirming. found that transgender adolescents assigned female at birth were more likely than other teens to report being psychologically traumatized by parents or other adults in the home. 

“There have been kids whose parents have physically abused them and kicked them out of the house when this information is disclosed,” said Amelia Vance, president of the Public Interest Privacy Center and an expert on student privacy. 

Even before California passed the SAFETY Act, the state education agency and the urged schools to get students’ permission before informing parents about changes in their gender identity.  When officials at Hart Unified High School District refused to meet with Lydia, they cited a that protects trans students’ access to programs, sports and facilities that align with their gender identity. 

On the advice of an advocacy group, Lydia initially filed a public records request in search of a “secret social transition” plan she believed Academy of the Canyons maintained. She also asked for communications between her child and teachers using the “non-birth name.”

The district turned her down.

Contacted by ĂŰĚŇÓ°ĘÓ, Hart Unified spokeswoman Debbie Dunn declined to answer questions about the investigation or Lydia’s experience, but said officials would “continue to follow the laws and procedures applicable to the district.”

In January 2023, Lydia spoke at a school board meeting about being shut out by the district. Her story caught the attention of Board Member Joe Messina, a conservative radio talk show host.

“She came up to the podium one night and she was crying,” he said. “She looked at the superintendent and said, ‘I’ve reached out to you. You’ve not called me back’. She looked to the trustee who handles her area and she said, ‘I’ve left you four messages. You’ve never called me back.’ ”

Messina and Lydia talked after the meeting, and he connected her with the Pacific Justice Institute, a right-leaning law firm.

He noted that the issue transcended their political differences. “Lydia’s a lifelong Democrat, and I’m an outspoken Republican,” Messina said. “For her and I to come together — the rest of the world would say, ‘What’s wrong with you people?’” 

Even with advocates on her side, Lydia continued to face obstacles. For months, the Academy of the Canyons declined to release an autobiographical English essay written by her child under the name Toby.

The district finally turned it over on advice from their lawyers. The essay revealed the child’s trepidation about coming out to Lydia. The piece recounted a moment before the pandemic, when the student, then 11, broached the subject of being queer. Lydia said her child was first exposed to LGBTQ issues while participating in a homeschool theater group. 

“The weather was overcast, and we were driving home from theater rehearsal,” the then-10th grader wrote. “Once again summoning all my courage, I mentioned to her that one of my friends had confided in me about their attraction to girls, and that I too might be queer. Unfortunately, my mom’s immediate response was dismissive and critical.”

As parent-child confrontations often go, Lydia remembers it differently. She said she treated the declaration as a teachable moment.

“We talked about what that word meant,” she said, “and why I felt she had time as she grew up to really know what sexual orientation she would be.”

In a memo, the district’s lawyers also named the elephant in the room — that officials had been withholding the essay out of a desire to shield the child’s shifting gender identity.

“In general, parents have the statutory right to review a student’s classwork/homework,” the memo stated. “This issue becomes clouded … if the classwork could reveal a student’s gender identity/expression.”

Despite refusing to accept that her child was transgender, Lydia said she tried to stay connected. In 2023, they attended over a dozen concerts together, seeing Hozier, Bastille and Penelope Scott — experiences that Lydia called “part of the healing process.” The two went on a long-promised trip to Europe, during which Lydia gave her child an ultimatum: stop identifying as a boy or go back to being homeschooled. That fall, the school agreed to honor Lydia’s wishes to cease social transitioning, but her child still resisted, asking teachers to continue using the name Toby.  

This time, the district let Lydia know. 

Lydia did not make her child available for an interview, saying “she isn’t ready to tell her side of the story.”

Nearly two years later, she says her child, who graduated from high school last week, “wants to put it all behind her.” While the teen identifies as a girl, the changes have been subtle. There are days when she dresses in what her mom called “oversized, ugly boy shirts” and others when she does her makeup and wears more feminine clothes. Recently, she switched back to her birth name on all of her social media accounts.

“I get a little choked up,” Lydia said, “but that’s pretty huge.” 

PROTECT Kids

The story might have ended there, but Lydia’s two-minute plea to the Hart school board, across social media, reached other parent rights advocates just as Trump renewed his campaign for the White House. When the president took office, Hamill, with the California Justice Center, seized the opportunity to file a complaint with an administration guided by , the right-wing Heritage Foundation’s blueprint for the president’s second term.

Requiring schools to notify parents if a student changes their gender identity, which already do, is one of the tenets of the plan. Heritage expert Lindsey Burke, who joined the department Friday, also wants Congress to give FERPA more teeth by allowing parents to sue under the law. Currently, parents can only file a grievance with their state or the Education Department’s privacy office — for years. 

Privacy laws “are a core part of [the administration’s] arguments for how parental rights need to be respected and strengthened,” said Vance, the privacy expert. But the potential for lawsuits under FERPA, she added “would be extremely messy and expensive for schools.” 

In April, the House education committee advanced a bill —  the — that would require elementary and middle schools to secure parental consent before students change their pronouns or preferred names or use different bathrooms or locker rooms. 

The committee debate demonstrated the deep divisions over gender identity and how schools should accommodate LGBTQ students. Rep. Mark Takano, a California Democrat who is gay, offered a personal story.

“When I came out to my parents, it was at a time, place and manner of my own choosing,” he said. “I would not have wanted anyone else to make that decision for me.”

To Hamill, gender transition is much more than “coming out” because it can lead to physical changes that later regret. Research shows that figure is , a fraction of those who undergo surgery. Even so, she said California’s policies add up to an elaborate “concealment scheme” that pits children against their parents. 

“If you suspect the parents are abusive and they’re going to harm the child, you have to report that to [child protective services],” she said. “But the government cannot by default assume that every parent is harmful and is going to reject and hurt their children.”

FERPA permits parents and eligible students (typically over 18) to inspect and correct their education records. It also requires consent before disclosure of personally identifiable information from those records, though there are numerous exceptions. In addition, schools must notify parents and eligible students annually of their FERPA rights.

With the advent of education technology, FERPA is really showing its age. Though it has slightly since its enactment, the last congressional update was over a decade ago, and regulations from the Department of Education are also woefully outdated. (Updates to the regulations from the Department are frequently said to be imminent, but as of this writing, none are public.)

Privacy concerns have steadily increased over the last few decades, as technology continues to develop and make increasingly intrusive incursions into every aspect of life. While FERPA does provide at least for students — unlike, say, consumers in general — the fact is, it does not mandate adequate safeguards.

Students and families in today’s digital world deserve modern protections that accurately reflect contemporary society and their learning experiences. Here are a few suggestions for bringing FERPA into its next half-century.

First, it should reflect that the information contained in student records is much broader than documents in files or scanned into computers. FERPA needs to protect students’ online information; protected “education records” should explicitly and unambiguously include online data created by students, including web browsing and search histories, interactions with tech tools and artificial intelligence chatbots, and other digital activity.

Second, the concept of directory information — things like a student’s name, address, telephone listing, email address, photograph, date and place of birth, height and weight (for athletic team members) and student ID numbers — needs an overhaul for the digital age. Under FERPA, schools can share this information with a third party or the public generally, unless a parent has opted out. 

is supposed to be data that is not considered harmful or invasive if disclosed. But given rapid advances in technology, much of it could lead to commercial profiling, identity theft and other harms. The definition should be narrowed, and parents should be allowed to choose what specific information schools can share. And that sharing should be opt-in, item by item, not the current blanket opt-out.

Third, the FERPA statute did not contemplate the extent to which ed tech and other third-party companies would be integrated into students’ daily lives. The Department of Education has since ” — to whom information can be shared without consent — to include ed tech vendors when they have a legitimate educational interest, perform a function the school would otherwise do, are under the school’s direct control with respect to use of student records and comply with other FERPA requirements. It would be helpful for Congress to very clearly indicate when FERPA-covered information may be shared with ed tech vendors and other third parties that students encounter on a daily basis.

FERPA should specify that students’ information — including and especially when shared with “school officials” — should be used for educational purposes only and not be offered for sale or used for targeted advertising.

Lastly, it is critical that schools safeguard student information. . It should mandate administrative, physical and technical safeguards, including training for individuals handling student information and prompt responses to data breaches. Schools need funding to better understand cybersecurity issues, as well as to build out necessary infrastructure to collaborate and coordinate cybersecurity efforts. Ideally, Congress would add new cybersecurity funding for schools, because many lack the financial means to implement adequate safeguards.

FERPA was passed 50 years ago in response to rising concerns about new technology. Technology has continued to evolve, and so must FERPA.

Investigators with the Los Angeles Unified School District’s inspector general’s office conducted a video interview with Chris Whiteley, the former senior director of software engineering at AllHere, after he told ĂŰĚŇÓ°ĘÓ his former employer’s student data security practices violated both industry standards and the district’s own policies. 

Whiteley told ĂŰĚŇÓ°ĘÓ he had alerted the school district, the IG’s office and state education officials earlier to the data privacy problems with Ed but got no response. His meeting with investigators occurred July 2, one day after ĂŰĚŇÓ°ĘÓ published its story outlining Whiteley’s allegations, including that the chatbot put students’ personally identifiable information at risk of getting hacked by including it in all chatbot prompts, even in those where the data weren’t relevant; sharing it with other third-party companies unnecessarily and processing prompts on offshore servers in violation of district student privacy rules. 

In an interview with ĂŰĚŇÓ°ĘÓ this week, Whiteley said the officials from the district’s inspector general’s office “were definitely interested in what I had to say,” as speculation swirls about the future of Ed, its ed tech creator AllHere and broader education investments in artificial intelligence. 

“It felt like they were after the truth,” Whiteley said, adding, “I’m certain that they were surprised about how bad [students’ personal information] was being handled.”

To generate responses to even mundane prompts, Whiteley said, the chatbot processed the personal information for all students in a household. If a mother with 10 children asked the chatbot a question about her youngest son’s class schedule, for example, the tool processed data about all of her children to generate a response. 

“It’s just sad and crazy,” he said.

The inspector general’s office directed ĂŰĚŇÓ°ĘÓ’s request for comment to a district spokesperson, who declined to comment or respond to questions involving the inquiry.

While the conversation centered primarily on technical aspects related to the company’s data security protocols, Whiteley said investigators probed him on his personal experiences with AllHere, which he described as being abusive, and its finances.

Whiteley was laid off from AllHere in April. Two months later, a notice posted to the said a majority of its 50 or so employees had been furloughed due to its “current financial position” and the LAUSD spokesperson said company co-founder and CEO Joanna Smith-Griffin had left. The former Boston teacher and Harvard graduate was successful in raising $12 million in venture capital for AllHere and appeared with L.A. schools Superintendent Alberto Carvalho at ed tech conferences and other events throughout the spring touting the heavily publicized AI tool they partnered to create.

Just weeks ago, Carvalho spoke publicly about how the project had put L.A. out in front as school districts and ed tech companies nationally race to follow the lead of generative artificial intelligence pioneers like ChatGPT. But the school chief’s superlative language around what Ed could do on an individualized basis with 540,000 students had some industry observers and AI experts speculating it was destined to fail.

The chatbot was supposed to serve as a “friendly, concise customer support agent” that replied “using simple language a third grader could understand” to help students and parents supplement classroom instruction, find assistance with kids’ academic struggles and navigate attendance, grades, transportation and other key issues. What they were given, Whiteley charges, was a student privacy nightmare. 

Smith-Griffin recently deactivated her LinkedIn page and has not surfaced since her company went into apparent free fall. Attempts to reach AllHere for comment were unsuccessful and parts of the company website have gone dark. LAUSD said earlier that AllHere is for sale and that several companies are interested in acquiring it.

The district has already paid AllHere $3 million to build the chatbot and “a fully-integrated portal” that gave students and parents access to information and resources in a single location, the district spokesperson said in a statement Tuesday, and “was surprised by the financial disruption to AllHere.” 

AllHere’s collapse represents a stunning fall from grace for a company that was named among the world’s top education technology companies by Time Magazine just months earlier. Scrutiny of AllHere intensified when Whiteley became a whistleblower. He said he turned to the press because his concerns, which he shared first with AllHere executives and the school district, had been ignored.

Whitely shared source code with ĂŰĚŇÓ°ĘÓ which showed that students’ information had been processed on offshore servers. Seven out of eight Ed chatbot requests, he said, were sent to places like Japan, Sweden, the United Kingdom, France, Switzerland, Australia and Canada. 

‘How are smaller districts going to do this?’

What district leaders failed to do as they heralded their new tool, Whiteley said, is conduct sufficient audits. As L.A. — and school systems nationwide — contract with a laundry list of tech vendors, he said it’s imperative that they understand how third-party companies use students’ information. 

“If the second-biggest district can’t audit their [personally identifiable information] on new or interesting products and can’t do security audits on external sources, how are smaller districts going to do this?” he asked.

Over the last several weeks, the district’s official position on Ed has appeared to shift. In late June when the district spokesperson said that several companies were “interested in acquiring Allhere,” they also said its predecessor would “continue to provide this first-of-its-kind resource to our students and families.” In its initial response to Whiteley’s allegations published July 1, the spokesperson said that education officials would “take any steps necessary to ensure that appropriate privacy and security protections are in place in the Ed platform.” 

In in the Los Angeles Times, a district spokesperson said the chatbot had been unplugged on June 14. ĂŰĚŇÓ°ĘÓ asked the spokesperson to provide documentation showing the tool was disabled last month but didn’t get a response. 

Even after June 14, Carvalho continued to boast publicly about LAUSD’s foray into generative AI and what he described with third-party vendors. 

On Tuesday, the district spokesperson told ĂŰĚŇÓ°ĘÓ that the online portal — even without a chatty, animated sun — “will continue regardless of the outcome with AllHere.” In fact, the project could become a source of district revenue. Under the contract between AllHere and LAUSD, which was obtained by ĂŰĚŇÓ°ĘÓ, the chatbot is the property of the school district, which was set to receive 2% in royalty payments from AllHere “should other school districts seek to use the tool to benefit their families and students.” 

In the statement Tuesday, the district spokesperson said that officials chose to “temporarily disable the chatbot” amid AllHere’s uncertainty and that it would “only be restored when the human-in-the-loop aspect is re-established.” 

Whiteley agreed that the district could maintain the student information dashboard without the chatbot and, similarly, that another firm could buy what remains of AllHere. He was skeptical, however, that Ed the chatbot would live another day because “it’s broken”

“The name AllHere,” he said, “I think is dead.”