FERPA and Texting Students: What Universities Need to Know
FERPA doesn't forbid texting students. It governs who sees information from education records. What that means for vendors, staff access, lock screens, parents and retention, and the questions to take to counsel.
Key takeaways
- FERPA doesn't prohibit texting students. The questions it raises are about what a vendor sees, what staff see, what shows on a lock screen and what happens to the messages.
- Vendors usually receive student data under the school official exception, which depends on the institution's direct control, limits on use and redisclosure, and the criteria in its annual notice.
- Give a texting vendor only what the work needs. A name, a phone number and a schedule often go a long way; counseling records shouldn't be part of it.
- Confirm each number belongs to the student, ideally by having them opt in from their own phone, and keep grades, balances and counseling out of the first line.
- This is general information, not legal advice. Take the specifics to your counsel and registrar.
The question often comes up in an early meeting, from someone in the registrar's office or general counsel: "Are we even allowed to text students about this?" It's a fair question, and the honest answer is that FERPA doesn't forbid texting students. What it governs is who can see personally identifiable information from education records, and texting raises that question in a few specific places: what a vendor sees, what staff see, what ends up on a lock screen, and what happens to the messages afterward.
This guide walks through FERPA and texting students in plain terms, so a student success team can go into that meeting knowing the right questions. It is general information, not legal advice. FERPA questions turn on facts and on your institution's own policies and annual notice, so take the specifics to your counsel and registrar.
What FERPA covers, in plain terms
The Family Educational Rights and Privacy Act protects the privacy of students' education records. A few basics shape everything else:
- Education records are, broadly, records directly related to a student and maintained by the institution or by a party acting for it. That can include far more than transcripts: advising notes, alerts and, potentially, messages a vendor keeps on the institution's behalf.
- At the college level, the rights belong to the student. Once a student is attending a postsecondary institution, FERPA rights generally transfer from parents to the student.
- Disclosure generally requires written consent, unless one of FERPA's exceptions applies. The exceptions most relevant here are for school officials with a legitimate educational interest, directory information and health or safety emergencies.
- Directory information is information an institution designates as generally not harmful to disclose, often including a phone number. Students can opt out, and each institution's designation is its own, so check yours.
The U.S. Department of Education's Student Privacy Policy Office publishes guidance and answers to common questions. It's a good place to send anyone who wants the source rather than a summary.
Texting a student about their own record
Telling a student about their own hold, grade or appointment is communication with the student, which FERPA permits. The practical risk is that the person reading the text isn't the student. Two things matter most.
Make sure the number is theirs
Phone numbers on file are often a parent's, from an admissions form filled out at seventeen, or out of date. A text about a failing midterm sent to a parent's phone is a very different thing from one sent to the student. The cleanest fix is to have each student opt in from their own phone, which confirms the number and records their consent in one step.
Assume someone else may see the first line
On many phones the first line of a text shows on the lock screen or in a banner. Write first lines that would be fine for a roommate to read: "quick question about spring registration" rather than "your unpaid balance put a hold on your account". Keep grades, balances, counseling and anything disciplinary out of the preview entirely, and let the student open the thread for detail.
When a vendor sees student data
Most texting platforms need some student data: at minimum a name and a phone number, often a schedule, sometimes holds or alerts. Institutions usually share that under FERPA's school official exception, which can extend to contractors and other outside parties when, in general terms, the outside party:
- performs a service or function the institution would otherwise use its own employees for;
- is under the institution's direct control with respect to the use and maintenance of the education records; and
- uses the information only for the purposes it was disclosed for, and doesn't redisclose it except as FERPA allows.
The vendor also has to meet the criteria your institution sets out in its annual FERPA notice for who counts as a school official with a legitimate educational interest. If your notice doesn't contemplate contractors, that's worth fixing before a pilot, not after.
FERPA doesn't spell out a required contract form, but a written agreement is the clearest way to show direct control. Expect it to cover the permitted purposes, the data involved, limits on redisclosure, security, breach notification, and return or destruction of data when the work ends.
Journey processes student data only under a written agreement with the institution, as a school official with a legitimate educational interest, and SOC 2 certification is in progress.
What the vendor should see, and what it shouldn't
The school official exception permits sharing; it doesn't make everything worth sharing. Give a texting vendor what the work needs and nothing more. A reasonable starting point:
| Data | Needed? | Notes |
|---|---|---|
| Name, phone number, student ID | Yes | The minimum to text and match records |
| Class schedule | Often | Lets texts avoid class times and land before the right moments |
| Holds, alerts | If used | Only for the nudges that act on them. The fact of a hold may be enough; the amount usually isn't needed |
| Grades | Rarely | A flag ("midterm below C") usually does the job better than a gradebook |
| Financial aid detail | Rarely | Status ("verification pending") rather than award amounts |
| Counseling or health records | No | These are handled under different rules, including FERPA's treatment-records provisions and sometimes state law. Keep a texting vendor out of them unless counsel says otherwise |
There's one category no data-sharing plan controls: what students text back. They'll mention a diagnosis, a breakup or a parent's job loss without being asked. Plan for those messages as sensitive records from the start, in where they're stored and who can read them.
Inside the campus, who on staff sees what
FERPA's legitimate educational interest test also applies inside the institution. A financial aid counselor working on a student's aid has one; a staff member curious about a student they don't work with doesn't. For a texting program, that suggests a few rules of thumb:
- Staff see the students they work with, and only what they need to act.
- A summary ("worried about tuition, due Friday") is usually enough. Full message transcripts should be visible to as few people as possible.
- Faculty get aggregate patterns or updates on alerts they raised, not other students' details.
- Access is reviewed each term, and removed when people change roles.
Today, Journey's partner dashboard shows staff each student's themes, not transcripts. Screens for building custom roles and setting office-level access are still in development.
Consent, parents and emergencies
Sharing a student's information with a parent generally requires the student's written consent, unless an exception applies. In the postsecondary setting, the exceptions people most often ask about are for students who are tax dependents of their parents, for health or safety emergencies, and, for students under 21, certain alcohol or drug violations. Each has conditions, and many institutions choose to share less than FERPA would allow. Ask counsel how your policy works before any texting workflow involves a parent.
The health or safety emergency exception deserves its own line in your crisis protocol. It can permit disclosure without consent when there's an articulable and significant threat, to people whose knowledge of the information is needed to protect someone, and it comes with recordkeeping duties. Who makes that call should be a person named in your protocol, never a piece of software.
FERPA also sets requirements for what written consent must include, and allows electronic consent under certain conditions. Whether a student's "yes" by text is enough for a particular disclosure is a question for counsel. Inside the institution, where staff with a legitimate educational interest are involved, consent often isn't required at all. We'd still ask the student before passing their story to another office, because it's their story, and a student who finds out their texts were passed around has every reason to stop texting.
Retention, deletion and the end of the contract
Messages pile up. A student who texts twice a week for four years leaves a long record. Decide up front:
- How long messages and summaries are kept, and whether that matches your records retention schedule
- Who can export them, and in what circumstances
- What the vendor does at the end of the contract: returns the data, destroys it, or both, with written confirmation
- How backups and logs are handled in that process
- How a request from a student to inspect their records would be fulfilled, if the messages are education records
Questions to take to counsel
- Does our annual FERPA notice define school officials broadly enough to include contractors like a texting vendor?
- Does the agreement establish direct control, limit use and redisclosure, and cover breach notice and data destruction?
- Are the messages students send to the vendor education records, and what follows from that for access and retention?
- Is phone number directory information for us, and how do we handle students who've opted out of directory disclosure?
- What may staff outside a student's direct support team see?
- What must be recorded if information is shared in a health or safety emergency, and by whom?
- Do any state student privacy, consumer privacy or texting laws add requirements beyond FERPA?
Bring those questions, and your vendor's written answers, to the same meeting. It is usually a much shorter meeting than the one where everyone discovers the questions for the first time. For the texting rules that sit alongside FERPA, see our guide to consent, opt-out and quiet hours, and for IT's side of the review, what a security review will ask.
Frequently asked questions
Is texting students a FERPA violation?
Not in itself. FERPA governs disclosure of personally identifiable information from education records, and communicating with a student about their own record is generally permitted. The risks are texting a number that isn't the student's and sensitive details showing on a lock screen. Check specifics with your counsel.
Can a texting vendor see student records under FERPA?
Often, under the school official exception, when the vendor performs a function the institution would otherwise use staff for, is under the institution's direct control in how it uses and keeps the records, and doesn't redisclose them. A written agreement is the clearest way to show that control.
Are text messages with students education records?
They may be, if they're directly related to a student and maintained by the institution or a party acting for it, such as a vendor. That affects access, retention and a student's right to inspect their records, so ask your counsel how your institution treats them.
Can we text a student's parents under FERPA?
Sharing a college student's information with parents generally requires the student's written consent unless an exception applies, such as tax dependency or a health or safety emergency. Many institutions choose to share less than FERPA allows, so check your policy and counsel first.
Is a student's phone number directory information?
It often is, but each institution designates its own directory information in its annual notice, and students can opt out. Check your institution's designation before relying on it.
