{
 "slug": "ferpa-consent-receipt",
 "topic_id": "TOPIC-173",
 "cluster": "Higher Education, Research & Credential Identity",
 "tier": "Tier C",
 "title": "FERPA disclosure authorization: the consent record that cannot be tested",
 "summary": "FERPA generally requires written consent specifying the records, purpose and recipient. In practice consent is a scanned form or a portal toggle, and a disputed disclosure is defended with a database row.",
 "lede": "Consent is the only thing standing between an education record and a third party, and it is stored as an attribute. The student who wants to know what they agreed to, and the officer who has to defend the disclosure, are reading the same unhelpful row.",
 "date": "2023-09-30",
 "category": "Vertical",
 "author_id": "elias-vanterpool-osei",
 "tags": [
  "FERPA",
  "education records",
  "consent",
  "privacy",
  "registrar",
  "student rights"
 ],
 "image_title": "FERPA Consent Receipt",
 "schema": "Article",
 "key_takeaways": [
  "FERPA consent must be signed and dated and must specify the records, the purpose and the party to whom disclosure may be made. Most implementations capture far less.",
  "Consent maps cleanly onto a delegation primitive: recipient, scope, purpose, expiry, revocation.",
  "This record is graded C because complaint-level data is not granular enough to size the problem, and the article says so rather than estimating."
 ],
 "body": [
  {
   "type": "h2",
   "text": "A conversation at the front counter"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "What consent must specify, and what the record holds",
   "caption": "The regulation is specific. The artefact is a toggle.",
   "nodes": [
    {
     "label": "Records to be disclosed",
     "note": "often ‘academic record’",
     "bad": true
    },
    {
     "label": "Purpose of disclosure",
     "note": "often blank",
     "bad": true
    },
    {
     "label": "Party receiving",
     "note": "sometimes a category",
     "bad": true
    },
    {
     "label": "Signed by the student",
     "note": "a scan or a toggle",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "A parent stands at the registrar's counter and wants to know why the university told an insurance company about their child's withdrawal. The student, present, says they never agreed to that."
  },
  {
   "type": "p",
   "html": "The officer pulls the record. There is a consent on file, signed eighteen months earlier, during the onboarding for a study-abroad programme. It is a scanned PDF with a signature and a purpose statement broad enough to cover almost anything."
  },
  {
   "type": "p",
   "html": "Everyone in the conversation is telling the truth. The consent exists, and the student does not remember agreeing to this, and nobody can determine what they were shown when they signed."
  },
  {
   "type": "h2",
   "text": "What the regulation requires"
  },
  {
   "type": "p",
   "html": "Under FERPA and its implementing regulations at 34 CFR Part 99, disclosure of personally identifiable information from education records generally requires written consent that is signed and dated and that specifies the records to be disclosed, the purpose of the disclosure, and the party or class of parties to whom disclosure may be made."
  },
  {
   "type": "p",
   "html": "Three specificities: records, purpose, recipient. Most consent forms in circulation satisfy the letter with language broad enough to be uninformative — <em>academic records</em>, <em>for programme administration</em>, <em>to affiliated third parties</em>."
  },
  {
   "type": "h2",
   "text": "Consent is a delegation"
  },
  {
   "type": "p",
   "html": "Once the three specificities are listed, the structure is recognisable. Consent is a grant of authority over a defined scope, to a defined party, for a defined purpose, revocable by the grantor."
  },
  {
   "type": "table",
   "head": [
    "FERPA element",
    "Delegation equivalent",
    "Currently captured as"
   ],
   "rows": [
    [
     "Records to be disclosed",
     "Scope",
     "Free text, usually broad"
    ],
    [
     "Purpose of the disclosure",
     "Constraint",
     "Free text"
    ],
    [
     "Party to whom disclosure may be made",
     "Delegate",
     "Free text or class"
    ],
    [
     "Signed and dated",
     "Issuance",
     "Scan or portal toggle"
    ],
    [
     "Revocation",
     "Revocation",
     "Not implemented in most systems"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The last row is the one that produces the front-counter conversations. Most student information systems have no revocation mechanism for a consent already on file; a student who changes their mind sends an email."
  },
  {
   "type": "h2",
   "text": "What a consent receipt would carry"
  },
  {
   "type": "p",
   "html": "The same fields, rendered to the student at the moment of signing and bound to their signature:"
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"education_record_disclosure_consent\",\n  \"render\": [\n    \"Records: [specific categories, enumerated]\",\n    \"Recipient: [named party or precisely defined class]\",\n    \"Purpose: [specific purpose]\",\n    \"Valid until: [date]\",\n    \"Revocable at any time by: [stated mechanism]\"\n  ],\n  \"student\": \"[credential assertion]\"\n}"
  },
  {
   "type": "p",
   "html": "The student holds a copy. So does the institution. A later dispute resolves against an artefact showing exactly what was rendered and agreed."
  },
  {
   "type": "h2",
   "text": "The scope boundary"
  },
  {
   "type": "p",
   "html": "An important limit: many FERPA disclosures occur under exceptions that do not require consent at all — school officials with legitimate educational interest, other schools where the student seeks enrolment, accrediting organisations, health and safety emergencies, directory information where the student has not opted out."
  },
  {
   "type": "p",
   "html": "This proposal touches none of those. It applies only to consent-based disclosures, which are a minority of total disclosures and a majority of disputes."
  },
  {
   "type": "h2",
   "text": "Why this is graded conservatively"
  },
  {
   "type": "p",
   "html": "FERPA complaint data is published in aggregate and does not break out consent-scope disputes. Institutions do not publish their own. So the frequency and cost of the problem described here are asserted from practitioner experience rather than measured, and this record sits in the experimental frontier set accordingly."
  },
  {
   "type": "p",
   "html": "An institution wanting to know whether this matters to them can measure it cheaply: count consent-related enquiries and complaints handled by the registrar and privacy office in the last year, and how many required reconstructing what a student was shown."
  },
  {
   "type": "h2",
   "text": "Where the disclosure record fails"
  },
  {
   "type": "table",
   "caption": "Four required elements against the usual artefact",
   "head": [
    "Element",
    "Typical record"
   ],
   "rows": [
    [
     "Records specified",
     "A broad category"
    ],
    [
     "Purpose specified",
     "Frequently absent"
    ],
    [
     "Recipient specified",
     "Sometimes a class rather than a party"
    ],
    [
     "Signed by the student",
     "A scan, a toggle, or an e-signature certificate showing an email was opened"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“We keep the signed form.”</strong> A form proves a form was signed. Connecting it to the disclosure that later happened, to that recipient, is the step nobody instruments."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Directory information does not need consent.”</strong> Correct, and it is a different category with its own opt-out mechanics. The gap is in the non-directory disclosures where consent is required and thin."
  }
 ],
 "faq": [
  {
   "q": "Does FERPA require electronic consent to be cryptographically signed?",
   "a": "No. It requires signed and dated written consent, and the Department has recognised electronic consent where the signature identifies and authenticates the individual. The proposal here exceeds that."
  },
  {
   "q": "What about consents already on file?",
   "a": "They remain valid under their own terms. This applies going forward; retroactive reconstruction is not possible."
  },
  {
   "q": "Does this help with directory information opt-outs?",
   "a": "Indirectly. The same structure could record an opt-out with its scope and date, which is currently another under-documented preference."
  },
  {
   "q": "Why is this filed as frontier rather than core?",
   "a": "Because the size of the problem is not publicly measurable. The mechanism is sound; the business case has to be made from an institution's own complaint volume."
  },
  {
   "q": "What must FERPA consent specify?",
   "a": "The records to be disclosed, the purpose, and the party receiving them — signed and dated by the student."
  },
  {
   "q": "Why is a portal toggle weak?",
   "a": "It records that a control was set, not what was specified, and it does not link to the disclosure that later occurred."
  },
  {
   "q": "Should consent expire?",
   "a": "For practical purposes yes. Consent given in a first year silently covering later disclosures is the pattern that produces complaints."
  }
 ],
 "sources": [
  {
   "t": "34 CFR Part 99 — Family Educational Rights and Privacy",
   "u": "https://www.ecfr.gov/current/title-34/subtitle-A/part-99"
  },
  {
   "t": "Student information system documentation on consent and directory information handling."
  }
 ],
 "related": [
  {
   "slug": "consequence-tiered-student-record",
   "title": "The refund destination field",
   "category": "Vertical"
  },
  {
   "slug": "release-authorization-receipt",
   "title": "Public records requests and redaction authority",
   "category": "Compliance"
  },
  {
   "slug": "bound-engagement",
   "title": "Client intake as an AML control",
   "category": "Compliance"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/FERPA%20Consent%20Receipt/1200_630/blog.jpg",
 "wordcount": 895,
 "url": "/blog/ferpa-consent-receipt.html",
 "reading_time": "4 min read",
 "seo_title": "FERPA disclosure authorization that cannot be tested",
 "meta_description": "FERPA consent is usually a scanned form or a portal toggle. Neither proves which student authorised which disclosure, to whom, or when.",
 "hub": {
  "slug": "topics/credential-identity",
  "title": "Education and credential identity"
 },
 "answer": "Usually not. FERPA requires written consent specifying the records, the purpose and the recipient. In practice consent is a scanned form or a portal toggle, and neither ties a specific student to a specific disclosure, to a specific party, at a specific time.",
 "answer_q": "Can you prove a student consented to a specific FERPA disclosure?",
 "glossary": [
  {
   "term": "Directory information",
   "def": "Categories an institution may disclose without consent unless the student opts out."
  },
  {
   "term": "Written consent",
   "def": "FERPA's requirement, specifying the records, purpose and recipient, and signed and dated by the student."
  },
  {
   "term": "Disclosure event",
   "def": "The act of releasing records to a third party, which should be linkable to the consent that authorised it."
  }
 ],
 "checklist": {
  "title": "Making consent testable",
  "id": "consent",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Render the four required elements at consent.",
    "text": "Records, purpose, recipient, duration."
   },
   {
    "name": "Bind the student's signature to that text.",
    "text": "Not to a form template."
   },
   {
    "name": "Link the disclosure event to the consent receipt.",
    "text": "So the record answers which consent authorised which release."
   },
   {
    "name": "Expire and re-affirm.",
    "text": "Consent given in a first year should not silently cover a fourth."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising person to the exact record or disbursement being authorised, and produces a receipt an auditor, a regulator or a receiving institution can verify without contacting the issuer.",
  "href": "../docs.html",
  "label": "See issuance receipts"
 }
}