FERPA regulations, limits on redisclosure (34 CFR 99.33(a))
An edtech vendor that received student records from a school may use them only for the purpose they were given for and may not pass them on without consent. It cannot license that data onward for AI training without that consent.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(1) An educational agency or institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student. (2) The officers, employees, and agents of a party that receives information under paragraph (a)(1) of this section may use the information, but only for the purposes for which the disclosure was made.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide