FERPA regulates the school’s disclosure, not the platform
Start with the direction of the obligation, because it explains everything downstream. FERPA constrains what an educational agency or institution may disclose. It does not directly regulate a commercial vendor, and it creates no private right of action against one — Gonzaga University v. Doe, 536 U.S. 273 (2002). A vendor’s exposure is contractual, plus the practical consequence that 34 CFR 99.33(e) can bar the school from disclosing to that party for five years.
So the question is never “may the platform hold a transcript?” It is “on what lawful basis did the school hand it over?”
The school-official exception has four cumulative conditions
34 CFR 99.31(a)(1)(i)(B) — the regulation itself, which is stronger authority than the Department’s FAQ — provides that an outsourced third party may be considered a school official only if it:
- “Performs an institutional service or function for which the agency or institution would otherwise use employees”;
- “Is under the direct control of the agency or institution with respect to the use and maintenance of education records”; and
- “Is subject to the requirements of 99.33(a) governing the use and redisclosure” of personally identifiable information;
- plus, via 34 CFR 99.31(a)(1)(i)(A) and 99.7, being designated in the school’s annual FERPA notification as a school official with a legitimate educational interest.
These are conjunctive. Prong 1 is necessary but nowhere near sufficient, and prong 2 is where commercial products typically fail: an independent survey of vendor privacy policies by the Center for Democracy & Technology found that terms giving the vendor unilateral rights to delete or amend data mean schools may not be in direct control of the data as the regulation requires.
The converse is real, and we will not overstate the rule
A district can validly designate a commercial vendor as a school official — this is how transcript-sending services operate — if it contracts for the function, designates the vendor in its annual notification, and retains direct control. So the correct statement is not “no recruiting platform can ever receive a transcript.” It is: not without district procurement, designation, and a contract that genuinely cedes direct control to the district. A platform the family signed up for on its own has none of those things.
Records a vendor holds on a school’s behalf are still education records
The Department’s Privacy Technical Assistance Center is direct about it: the covered records “include, but are not limited to, transcripts, class lists, student course schedules, health records, student financial information, and student disciplinary records… any of these records maintained by a third party acting on behalf of a school or district are also considered education records.” And: “When PII from education records is disclosed to the provider, FERPA still governs its use, and the school or district is responsible for its protection.”
That is backed by regulation, not only guidance: 34 CFR 99.3 defines education records as records directly related to a student and maintained by an educational agency or institution “or by a party acting for the agency or institution.” A platform ingesting transcripts under the school-official exception is not holding mere copies — it is holding regulated records, and it has made the school responsible for what it does with them.
One condition on that, which is also the escape hatch: this attaches only to records ingested under the school-official exception. A transcript a student or parent uploads themselves, or that a school releases under signed consent to a party that is not acting for the school, is not an education record in the platform’s hands. That distinction is the whole architecture.
Eligible students can consent for themselves
FERPA rights transfer from the parent to the student at age 18 or upon enrollment in a postsecondary institution — the “eligible student” definition at 34 CFR 99.3. A senior who has turned 18 may therefore consent to a release personally. For the rest of a high school roster, the parent or guardian holds the right.
The conservative practice
Stated as what it is — a design conclusion synthesized from the findings above, not a separately verified legal holding:
- Keep transcripts, GPA, test scores, and eligibility status off the platform entirely, or
- accept them only as a student- or parent-initiated upload, with the platform never positioned as a school official, and
- never route academic records school-to-platform under a claimed school-official designation the district did not actually make.
The payoff is not merely compliance theater. Keeping the school out of the transfer keeps the records outside the 34 CFR 99.3 “party acting for the agency” definition, which means the direct-control problem never has to be solved at all. Families deliver academics through official channels — to the coach, to the clearinghouse, to the admissions office — the way they did before recruiting platforms existed.
What is still unsettled
- Directory information. It was proposed to us that the directory-information exception (34 CFR 99.31(a)(11), 99.37) supplies a lawful path for athletic profile data such as name, sport, and grade level. That claim split during verification and is not established here, so we do not rely on it. It plainly does not cover transcripts or GPA in any event.
- Monetization. Whether monetizing FERPA-covered student data — lead sale, recruiting upsells, ad targeting to parents — violates federal or state law also split in verification and needs independent research before anyone relies on either answer.
- What direct control looks like on paper. Which contract terms would actually satisfy 34 CFR 99.31(a)(1)(i)(B) for a commercial platform is an open question we did not resolve.
- The COPPA boundary. The FTC declined to finalize proposed ed-tech and school-authorization amendments to the COPPA Rule, deferring to a possible Department of Education FERPA rulemaking that has not been finalized. There is no COPPA-side school-consent safe harbor today.
Related
- COPPA and youth sports recruiting platforms: what actually triggers it.
- What a youth athlete platform should collect — and what it shouldn’t.
Before you rely on this
This page describes publicly available law and agency guidance as we read it on the verification date shown above. It is not legal advice, and it is not a compliance certification. Several of the items below sit on interlocutory postures that can flip without notice. Confirm anything you act on with your own counsel, and with your state high school athletic association where eligibility is involved.