Privacy Quiz: How Do You Stop Schools From Sharing Kids’ Data?

For parents, the return to school means signing a stack of permission forms. One that's easy to miss deals with the privacy of your child's personal information - and your right to stop the school from sharing it.

Schools are allowed by federal law to share or sell "directory information" about their students with anyone - including data brokers and marketing companies - unless they have a parental opt-out form on file. That could subject parents and, in some cases even young students, to a torrent of advertising.

"Directory information may sound innocuous, but it can include sensitive information about each student that is quite detailed," said Pam Dixon, executive director of the World Privacy Forum. "And after the school releases this data, it is considered to be public information and you've lost control of it. I don't think most parents know this."

Under the Family Educational Rights and Privacy Act of 1974 (FERPA), a student's directory information includes home address, email address, telephone number, date and place of birth, height and weight, the clubs or sports teams they've joined - even a photograph.

FERPA was written before the creation of the Internet, when a student's personal information was stored in a file cabinet and privacy was not such a big issue. Today, the data is just what a stalker, abuser or identity thief needs.

"This directory information, that many years ago Congress decided wasn't that private, has become enormously private," Dixon told NBC News. "A photo of a child, along with their email and home address, is a recipe for disaster in the wrong hands. And that's exactly the kind of thing we need to keep from happening."

The right to opt-out

Any school that receives tax dollars, from preschool all the way up to college, must provide parents with a FERPA opt-out form each year. But a lot of parents miss the form or don't take the time to fill it out, privacy experts tell NBC News.

FERPA gives parents the right to see what "directory information" the school has about their children. They also have the right to block or limit access to that information.

"It's a critical law that's not well understood by many schools and not on the radar screen of many parents, who could and should make smart decisions," said Jules Polonetsky at the Future of Privacy Forum. "A lot of parents miss that FERPA form or don't take the time to fill it out. Get informed because you do have rights. Find that FERPA notice. Read it and decide what options are right for your child."

The companies that use and sell data about school kids say they strongly support a parent's right to limit their access to it.

The Direct Marketing Association, an industry trade group, believes all parents should have the opportunity to exempt their children from the disclosure of directory information.

"Clear notice and choice for consumers about their data is a fundamental requirement of the data-driven marketing industry's self-regulation program, written and enforced by DMA and its membership. Student directory information is no exception," Senny Boone, DMA's general counsel, wrote in an email to NBC News. "And we encourage every parent to be informed about their choices and to make the decision that is best for their families."

You must opt out each year

Keep in mind: The FERPA form needs to be filled out every year.

The window for opting out is short - sometimes just a few weeks after the start of school. The time frame can vary from district to district. So, if you didn't get the form or can't find it, contact the school right away.

Once that window closes, you cannot stop the release of your children's personal information until the next school year.

This is especially important for domestic violence survivors who are hiding from their abuser. Information that's released without their knowledge could jeopardize their safety.

"When there are situations where the survivor has left with the child and has custody of the child and they're living elsewhere, they want to know that their abuser doesn't know where they are living," said Kaofeng Lee, deputy director of the Safety Net Project at the National Network to End Domestic Violence. "If this information is available, the abuser could get access to where this child is going to school which will pinpoint exactly where the family is now living and make it possible to find them."

Many schools get poor grades for privacy protection

Digital privacy is a relatively new issue for schools, which may explain why some don't do a very good job of guarding student's personal information.

Privacy advocates tell NBC News they are disappointed that so many schools "bury the FERPA form" in their back-to-school booklets or only post it on the web where it can be easily missed.

Ann Maggio Thanawalla is having a running battle about privacy with her local school district in Southern California. She told NBC News it doesn't provide a FERPA opt-out form.

"Parents are completely in the dark about what's going on and I think it's intentional," she said. "I've always believed until recently, that this information stayed within the district and was not shared with anyone, but that's not the case. And there are all kinds of opportunities for this information to get out there and no one knows how it's being used or secured."

The World Privacy Forum's (WPF) Pam Dixon studied FERPA forms from districts across the country and found that many are worded in ways that "discourage parents" from opting-out of information sharing.

She gives high marks to districts that give parents a range of options from "no sharing" of directory information without my prior written permission, to allowing it to be given to institutions of higher learning or military recruiters. (The WPF created a sample opt out form for schools to use.)

Should Congress update the law?

Congress will soon begin a review of FERPA to see what further privacy protections are needed to protect students and their families in the digital age.

But school districts don't have to wait for Congress to act. Current law gives school boards the ability to limit data sharing on their own. For example, the Akron public school district in Ohio won't share any information for marketing purposes. Parents can then limit that even further.

"I would like to see many fewer schools sharing their information for marketing purposes that have nothing do to with education," Dixon said.

Parents can learn more about directory information sharing and FERPA:

What Parents Need to Know About School Directory Information


Student Privacy Resource Center (FERPA/SHERPA)
