FERPA Compliance

FERPA (Family Educational Rights and Privacy Act)

FERPA applies to any educational institution that receives federal funding, which includes the vast majority of colleges and universities in the United States. Under the law, education records, which include grades, transcripts, and any data tied to a student's academic performance, must be kept confidential and cannot be shared with third parties without the student's written consent, with certain defined exceptions.

For online proctoring and remote assessment, FERPA has direct implications. Webcam recordings, behavioral flags, identity documents, and performance data collected during a proctored exam may constitute education records, depending on how they are stored and linked to a student's file. Technology providers that access this data on behalf of an institution are treated as "school officials" under FERPA and must use the data solely for the purpose for which it was disclosed.

In practice, compliance requires clear data agreements between institutions and their proctoring providers, specifying what is collected, how long it is retained, who can access it, and under what circumstances it may be shared. Students must also be informed about the monitoring that takes place and the data it generates.

FERPA sits alongside other privacy frameworks, such as GDPR for European candidates, in shaping how responsible assessment programs handle personal data. Institutions operating internationally may need to satisfy multiple frameworks simultaneously, making it essential to work with proctoring partners whose data practices are designed to accommodate varied regulatory requirements. Understanding FERPA is therefore a foundational step for any U.S.-based institution deploying online proctoring at scale.