Lesson 6: What can your family see in your college records? Educator guide

One envelope, two boxes

The story: The family chat wants an answer

Rafa is 18 and has just started college. He commutes from the next block and helps at his family’s shop after class. His parents help pay his tuition bill.

At the start of October, the college mailed Rafa a family-access form. He has not opened the envelope. On Sunday night, the family group chat lights up. His mom writes, “Did the tuition form come? We want to help with the bill.” His dad goes further: “Send us the login and we’ll take care of everything.”

Rafa is glad to share the bill. But he wants to read the rest of the form first. His older friend Caio sits with him and reads it with Rafa, not for him. “Being the older friend doesn’t make this my decision,” Caio says.

You are at the table too. Your job is to read each box on the form before Rafa signs.

Reading the form section by section

In Lesson 5, you read a pay statement line by line. A form works the same way. Rafa’s form has three sections. Section 1 is about billing: his parents could view statements and make payments. Section 2 is about academic records: his parents could get information about his grades, enrollment and standing. Section 3 says his choice lasts until he changes it in writing.

Each section has its own yes-or-no box. That means Rafa does not have to choose all or nothing. He can check yes for billing. He can wait on grades until he talks with his family.

In Lesson 4, you learned that a decision-maker is the person or group with the power to make a particular choice. Here, the decision-maker is Rafa. Consent is permission a person gives for something specific, such as sharing a record with a named person. Giving his dad his login would skip that choice entirely.

The real law behind the form

FERPA, the Family Educational Rights and Privacy Act, is a federal law about who can see student education records. An education record is a record directly about a student that a school or college keeps. Grades and schedules can be education records. Under the general rule, FERPA rights move from parents to the student at age 18 or when the student starts college (U.S. Department of Education, Student Privacy Policy Office, no date listed).

There are exceptions. A college may share records with parents if the student is a dependent for federal tax purposes. But the Education Department says this sharing is allowed, not required. So Rafa should ask his records office what his college does.

Key terms in this passage

FERPA

FERPA, the Family Educational Rights and Privacy Act, is a federal law about who can see student education records.

Education record

An education record is a record directly about a student that a school or college keeps.

Consent

Consent is permission a person gives for something specific, such as sharing a record with a named person.

Decision-maker

A decision-maker is the person or group with the power to make a particular choice.

Real sources cited

• U.S. Department of Education, Student Privacy Policy Office, “What is FERPA?,” No date listed. Open the source (opens in a new tab)
• U.S. Department of Education, Student Privacy Policy Office, “Must postsecondary institutions provide a parent with access to an eligible student’s education records?,” No date listed. Open the source (opens in a new tab)

Helping with the bill is not the same as seeing grades

The story: A login request on Sunday night

Rafa, 18, is a few weeks into his first year of college. He commutes from the next block, helps at his family’s shop after class and relies on his parents to help pay tuition. At the start of October, the college mailed him a family-access form. The envelope is still sealed.

On Sunday night, the family group chat catches up with him. His mom asks whether the tuition form came, because they want to help with the bill. His dad offers a shortcut: “Send us the login and we’ll take care of everything.” The offer is generous and practical, and it would hand over far more than a bill.

Rafa does not want a fight. He wants to understand what he is signing. He asks Caio, an older friend who rents a room on the block, to read the form with him. Caio is clear about his role. He will sit with Rafa while he asks questions, but being older does not make this his decision. When someone suggests sending his parents a photo of the form, Caio points out the trade-off. A photo is easier to send, and it is also easier to lose control of.

Your role is to read each box on the form before Rafa signs.

Separating the parts of the form

Lesson 5 taught you to read a document line by line before deciding what it means. The form rewards the same patience. Section 1 covers billing and payments: the named person could view account statements and make payments. Section 2 covers academic records: the named person could receive information about grades, enrollment and academic standing. Section 3 says the authorization stays in effect until Rafa changes or withdraws it in writing. Each of the first two sections has its own yes-or-no box.

That structure changes the decision. Rafa does not face a single choice between trusting his family and shutting them out. He faces two separate choices, and each has its own trade-off, a word you learned in Lesson 4. Saying yes to billing gives his parents what they asked for. Saying yes to grades may be fine too, but Rafa wants to talk with them before he decides.

Lesson 4 also gave you the term decision-maker, the person or group with the power to make a particular choice. On this form, the decision-maker is Rafa. Consent is permission a person gives for something specific, such as sharing a record with a named person. For college records, consent is written and names the record, the person and the purpose.

What FERPA does and does not say

FERPA, the Family Educational Rights and Privacy Act, is a federal law about who can see student education records. An education record is a record directly about a student that a school or college keeps, such as grades, transcripts or schedules. Under the general rule, the rights transfer from parents to the student at age 18 or when the student enters college at any age (U.S. Department of Education, Student Privacy Policy Office, no date listed). The Education Department publishes a plain guide for these “eligible students” (U.S. Department of Education, March 8, 2023).

Helping pay tuition does not, by itself, give those rights back to a parent. FERPA does have exceptions. A college may share records with parents if the student is a dependent for federal tax purposes, or in a health or safety emergency. The Education Department says this sharing is allowed, not required, so each college decides how it handles these cases.

Why do these rules matter so much? Student records now live in large software systems. A breach at the company PowerSchool exposed millions of student records (Education Week, January 9, 2025). Knowing which record, which permission and which office to ask is how Rafa keeps family support from turning into giving away every login.

Key terms in this passage

FERPA

FERPA, the Family Educational Rights and Privacy Act, is a federal law about who can see student education records.

Education record

An education record is a record directly about a student that a school or college keeps.

Consent

Consent is permission a person gives for something specific, such as sharing a record with a named person.

Decision-maker

A decision-maker is the person or group with the power to make a particular choice.

Real sources cited

• U.S. Department of Education, Student Privacy Policy Office, “What is FERPA?,” No date listed. Open the source (opens in a new tab)
• U.S. Department of Education, Student Privacy Policy Office, “An Eligible Student Guide to the Family Educational Rights and Privacy Act (FERPA),” March 8, 2023. Open the source (opens in a new tab)
• U.S. Department of Education, Student Privacy Policy Office, “Must postsecondary institutions provide a parent with access to an eligible student’s education records?,” No date listed. Open the source (opens in a new tab)
• Education Week, “What Schools Should Know About the PowerSchool Data Breach,” January 9, 2025. Open the source (opens in a new tab)

Consent, one box at a time

The story: Family support and a sealed envelope

Rafa, 18, is in his first weeks of college. He commutes from the next block and works at his family’s shop after class. His parents help with tuition, and they want to keep helping. At the start of October, the college mailed him a parent and family access form. He has not opened it.

On Sunday night, his parents bring it up in the family group chat. His mom asks whether the tuition form arrived so they can help with the bill. His dad proposes the simplest route from a parent’s point of view: send the login, and the family will take care of everything. Rafa answers that he can share the bill part and wants to read the rest first. His reply is honest and a little uncomfortable. It says yes to one kind of help and asks for time on another.

Caio, 24, the oldest in the crew, rents a room on the block and offers to sit with Rafa while he reads the form. He is careful about the limits of that help. Being the older friend does not make this his decision. When the conversation turns to exceptions in the law, Caio pushes for precision. Which exception, and does it even fit Rafa? Just saying “privacy law” will not answer his dad.

Your role in this case is to read each box on the form before Rafa signs.

A form is a set of separate decisions

The new skill in this case builds on Lesson 5. There, you read a pay statement line by line and matched each line to a record. Here, you read a form section by section and decide each part on its own. Section 1 would let a named person view account statements and make payments. Section 2 would let that person receive information about grades, enrollment and academic standing. Section 3 says the authorization lasts until Rafa changes or withdraws it in writing. The first two sections each carry a separate yes-or-no box.

The college’s annual notice adds the legal frame. Students have the right to inspect their education records, to request corrections and to consent to disclosures, except where the law allows disclosure without consent. The notice does not say which exceptions this college uses, and neither document says where Rafa sends a written change.

Two earlier terms sharpen the analysis. A decision-maker (Lesson 4) is the person or group with the power to make a particular choice, and on this form that person is Rafa. A trade-off (also Lesson 4) exists in each section separately. Sharing billing costs little and gives his parents what they asked for. Sharing grades may strengthen family trust, or it may shift a conversation Rafa would rather have in person first. Consent is permission a person gives for something specific, such as sharing a record with a named person. For college records, it is written and specifies which record, to whom and for what purpose. A shared login is the opposite of specific.

The federal rule and its exceptions

FERPA, the Family Educational Rights and Privacy Act, is a federal law about who can see student education records. An education record is a record directly about a student that a school or college keeps. Under the general rule, FERPA rights transfer from parents to the student at 18 or when the student enters college at any age, and the law calls that student an “eligible student” (U.S. Department of Education, Student Privacy Policy Office, no date listed). Paying tuition does not, by itself, return those rights to a parent.

The exceptions are real and narrow. A college may disclose records to parents if the student is a dependent for federal tax purposes, and it may disclose in a health or safety emergency. The Department of Education stresses that these disclosures are permitted, not required (U.S. Department of Education, Student Privacy Policy Office, no date listed). That is why the practical step is a question to the records office, not an argument from the law alone. American University’s parent-access guide shows how one institution handles it, and it is one university’s process, not a national rule (American University, June 30, 2025).

Records management is also a data security problem. A breach at PowerSchool exposed millions of student records (Education Week, January 9, 2025). The Markup has reported on how school software companies gain access to student data, and where FERPA’s protections run out (The Markup, January 15, 2022). Registrars’ own professional code asks them to “protect the legitimate privacy interests of all individuals” (AACRAO Ethics and Practice, 2010).

Key terms in this passage

FERPA

FERPA, the Family Educational Rights and Privacy Act, is a federal law about who can see student education records.

Education record

An education record is a record directly about a student that a school or college keeps.

Consent

Consent is permission a person gives for something specific, such as sharing a record with a named person.

Decision-maker

A decision-maker is the person or group with the power to make a particular choice.

Real sources cited

• U.S. Department of Education, Student Privacy Policy Office, “What is FERPA?,” No date listed. Open the source (opens in a new tab)
• U.S. Department of Education, Student Privacy Policy Office, “Must postsecondary institutions provide a parent with access to an eligible student’s education records?,” No date listed. Open the source (opens in a new tab)
• American University, AU Central, “FERPA and parent-access guide,” June 30, 2025. Open the source (opens in a new tab)
• Education Week, “What Schools Should Know About the PowerSchool Data Breach,” January 9, 2025. Open the source (opens in a new tab)
• The Markup, “The Big Business of Tracking and Profiling Students,” January 15, 2022. Open the source (opens in a new tab)
• American Association of Collegiate Registrars and Admissions Officers (AACRAO), “AACRAO Ethics and Practice,” 2010. Open the source (opens in a new tab)

Records, rights and the limits of family access

The story: The login shortcut

Rafa, 18, is a first-year commuter who helps at his family’s shop after class. His parents contribute to his tuition. At the start of October, his college mailed him a parent and family access authorization. Before he opens it, his parents raise it in the family group chat. His mother offers help with the bill. His father proposes the shortcut many families would reach for: send the login, and they will handle everything.

The case turns on the difference between those two offers. Helping pay a bill requires access to billing. A login grants access to everything the account holds, including grades and schedules, and it bypasses any record of what was shared and why. Rafa answers that he can share the bill and wants to read the rest first.

Caio, 24, sits with him as he reads. He models the stance of a good advisor. He will help Rafa ask questions, but the decision is Rafa’s. He also resists vague reassurance. If the law has an exception, they should find out which one and whether it applies, because “privacy law” is not an answer Rafa’s father can act on.

Your role is to read each box on the form before Rafa signs.

Granular consent in practice

The form is built for separate decisions. Section 1 authorizes a named person to view account statements and make payments. Section 2 authorizes that person to receive information about grades, enrollment and academic standing. Section 3 makes the authorization durable until Rafa changes or withdraws it in writing. Each of the first two sections has its own yes-or-no box.

The college’s annual FERPA notice sets the background rule. Students may inspect their records, request corrections and consent to disclosures, except where the law permits disclosure without consent. Together, the documents show what Rafa controls and what he still needs to learn: which exceptions this college applies and where a written change goes.

This case extends two earlier skills. Lesson 5 asked you to read a statement line by line. Here you read a form section by section and decide each part independently. Lesson 4 introduced the decision-maker, the person or group with the power to make a particular choice. Rafa holds that role, and the form’s structure lets him exercise it with precision. Consent is permission a person gives for something specific, such as sharing a record with a named person. For college records, it is written and identifies the record, the recipient and the purpose. A shared password is the opposite of that kind of consent.

FERPA’s structure and the question of trust

FERPA, the Family Educational Rights and Privacy Act, is a federal law about who can see student education records. An education record is a record directly about a student that a school or college keeps, on paper or stored digitally. Under the general rule, the rights transfer from parents to the student at 18 or upon entering college at any age, and the student becomes an “eligible student” (U.S. Department of Education, Student Privacy Policy Office, no date listed). The Department’s guide for eligible students explains consent, access and the exceptions in plain language (U.S. Department of Education, March 8, 2023).

The exceptions matter for families like Rafa’s. A college may disclose records to parents when the student is a dependent for federal tax purposes, or in a health or safety emergency. The Department describes these disclosures as permitted, not required, so practice varies by institution. American University’s parent-access guide illustrates one institution’s process, not a national rule (American University, June 30, 2025).

Records governance now reaches beyond the registrar. A breach at PowerSchool exposed millions of student records (Education Week, January 9, 2025). Classroom AI tools raise new questions about who can see student information (Chalkbeat, December 13, 2024). The Markup has reported on where FERPA’s protections run out when software companies handle student data (The Markup, January 15, 2022).

Professional codes describe both duties the registrar holds. AACRAO asks members to “protect the legitimate privacy interests of all individuals” and to “dispense complete, accurate, understandable, and truthful information and advice at all times” (AACRAO Ethics and Practice, 2010). The National Communication Association’s credo speaks to Rafa’s side: “We advocate sharing information, opinions, and feelings when facing significant decisions, while also respecting privacy and confidentiality” (NCA Credo for Ethical Communication, 2024). The case asks students to hold both values at once. Family support and privacy can be negotiated one box at a time.

Key terms in this passage

FERPA

FERPA, the Family Educational Rights and Privacy Act, is a federal law about who can see student education records.

Education record

An education record is a record directly about a student that a school or college keeps.

Consent

Consent is permission a person gives for something specific, such as sharing a record with a named person.

Decision-maker

A decision-maker is the person or group with the power to make a particular choice.

Real sources cited

• U.S. Department of Education, Student Privacy Policy Office, “What is FERPA?,” No date listed. Open the source (opens in a new tab)
• U.S. Department of Education, Student Privacy Policy Office, “An Eligible Student Guide to the Family Educational Rights and Privacy Act (FERPA),” March 8, 2023. Open the source (opens in a new tab)
• U.S. Department of Education, Student Privacy Policy Office, “Must postsecondary institutions provide a parent with access to an eligible student’s education records?,” No date listed. Open the source (opens in a new tab)
• American University, AU Central, “FERPA and parent-access guide,” June 30, 2025. Open the source (opens in a new tab)
• Education Week, “What Schools Should Know About the PowerSchool Data Breach,” January 9, 2025. Open the source (opens in a new tab)
• Chalkbeat, “AI presents explosive risks to student data privacy. These educators want to defuse them.,” December 13, 2024. Open the source (opens in a new tab)
• The Markup, “The Big Business of Tracking and Profiling Students,” January 15, 2022. Open the source (opens in a new tab)
• American Association of Collegiate Registrars and Admissions Officers (AACRAO), “AACRAO Ethics and Practice,” 2010. Open the source (opens in a new tab)
• National Communication Association (NCA), “Credo for Ethical Communication,” 2024. Open the source (opens in a new tab)