FERPA for ed-tech: the web-specific obligations no one tells you about

FERPA enforcement does not run through private lawsuits — it runs through federal funding and Data Privacy Agreement violations. Both make your web stack a contractual obligation. Here are the four web-layer obligations every ed-tech vendor inherits.

FERPA — the Family Educational Rights and Privacy Act — protects education records held by federally-funded educational institutions. For ed-tech vendors and the institutions that buy them, FERPA imposes web obligations that look superficially like HIPAA but with substantially different enforcement mechanics.

Who is subject

FERPA applies directly to educational agencies and institutions that receive funds under any program administered by the U.S. Department of Education — virtually every public school, most private schools, and every accredited college and university. Vendors don't fall under FERPA directly, but institutions are required to flow FERPA obligations down to their vendors through the Data Privacy Agreement.

Practical consequence: if you sell software to schools, your contract will impose FERPA obligations on you. Failure to comply terminates the contract, voids further business, and — in the worst case — costs the institution federal funding.

The four web-layer obligations

1. No student PII in URLs

Same pattern as the HIPAA “PHI in URLs” finding, applied to student identifiers, names, grades, and disability status. URL parameters get logged in too many places to count.

Fix pattern: pass identifiers in the request body, resolve from authenticated session server-side. Opaque URLs only.

2. HTTPS enforced on every page that displays student data

Per the FTC's 2017 ed-tech guidance and most state DPA templates, student-data pages must transport over HTTPS. HTTP fallback is explicitly out of bounds.

Fix pattern: 301-redirect all HTTP to HTTPS, set HSTS with reasonable max-age. Plumb's education module flags any page accepting HTTP on a student-record path.

3. Forms use POST, not GET

Search bars and filter forms that use GET write the search query into the URL. If the query contains a student name, last 4 of SSN, or student ID, you've leaked PII to your server logs, your CDN, and every referrer.

Fix pattern: every form that accepts student-identifying input uses method="post". Audit every search and filter UI in the platform.

4. Third-party scripts on student-data pages

Same threat model as HIPAA: a marketing pixel on a gradebook page is a FERPA disclosure to an unauthorized party. The institution's DPA with you will almost certainly enumerate which third parties are permitted as “school officials” under FERPA. Anything not on that list cannot load on student-data pages.

Fix pattern: maintain a strict allowlist of third-party origins permitted on student-data pages. Block by default; audit quarterly.

How enforcement works

FERPA has no direct private right of action — students and parents cannot sue under it. Enforcement runs through:

• Loss of federal funding. The Department of Education can withhold funding from institutions that fail to comply. This is the existential threat — most institutions cannot operate without federal money.
• State attorney-general actions. Many states (notably California, New York, Texas) have state ed-data privacy laws that run in parallel with FERPA, and AGs use those statutes to act on FERPA-style violations.
• Contract termination by institutions. An institution that learns a vendor has violated the DPA will terminate. Reputation damage in ed-tech is permanent — buying decisions in K-12 and higher-ed are heavily influenced by peer recommendations.

The student data privacy pledge and similar commitments

Many ed-tech vendors have signed the Student Privacy Pledge — a voluntary industry commitment. Signing the pledge is largely about signaling. Honoring it operationally is what wins or loses school contracts. The pledge incorporates FERPA web obligations and goes further: no targeted ads to students, no behavioral profiling, no sale of student data ever.

If you have signed the pledge or plan to, your web stack must reflect it. A Meta Pixel on a student-facing page is incompatible with the pledge by definition.

How Plumb fits

Plumb's education module runs the four checks above and emits findings into the same report your engineering team already uses. For ed-tech vendors during procurement, the FERPA-section of a Plumb report is concrete evidence to attach to the DPA submission. For institutions evaluating vendors, the report is a faster way to vet than a written attestation.

This article is not legal advice. FERPA obligations depend on the specific data flows in your platform and the terms of your DPAs. Engage education-privacy counsel for specifics.