Directory information is a per-student flag your code has to honour
In short
Directory information is the part of a student's record an institution has designated as releasable without consent — commonly name, enrolment status and dates of attendance. Any student or parent may opt out. So it is not a policy paragraph but a mutable per-student flag with an effective date, read at render time by every surface that emits student data.
Key takeaways
- The designated list belongs to the institution, not the regulation. It is per-tenant configuration you store and version.
- The opt-out is mutable, dated and often partial. A boolean on the student row expresses none of the three.
- Filter on the read path. Filter at import time and every cache, index and export drifts silently out of date.
- An export outlives the flag that produced it: a yearbook file cut in February governs a book that circulates for years.
Directory information is the subset of a student's education record an institution has designated as releasable without prior consent — typically name, enrolment status, dates of attendance and participation in activities. Any student or parent may opt out, and the opt-out is the part products get wrong.
This is an engineering reading of a legal category, not legal advice. The list, the notice and the opt-out window belong to the institution and its counsel, and they change — confirm the designation against the school's published annual notice. BuildspaceLabs holds no privacy certifications.
The list is designated, which makes it configuration
FERPA lets a school decide which elements it treats as directory information and publish that decision annually. There is no fixed list, so two districts running the identical product designate differently. Hard-code the fields and you have hard-coded one customer's policy.
- Store the designation per tenant, versioned. You will be asked which version was in force on the day something was published.
- Refuse authentication identifiers. Anything that alone opens a door into records does not belong in a list releasable without consent.
- Treat photographs as their own element. Products that fold faces and names under one toggle are the ones that get complaints.
- A vendor rendering these surfaces stands in the school's shoes — the footing the school official exception provides.
Directory information stays inside the education record. It is not data that has left the boundary, only data with a different disclosure rule, keeping the classification in where the education record starts and stops.
The flag, and the fields it needs
Most implementations reach for a boolean on the student row. It cannot express a partial opt-out, cannot say what was true last March, and cannot be reconciled with a signed form in a drawer.
| Field | Example | Why it exists |
|---|---|---|
| student_id | 4471902 | The roster sync's identifier, not a display name |
| scope | name, photo, honours | Opt-outs are often partial: a name in a programme, no face online |
| status | opted_out | Three states. 'Never asked' should block publication |
| effective_from | 2026-09-14 | Shows earlier renders were not wrong retroactively |
| effective_to | null | Opt-outs get withdrawn; an interval answers any date |
| source | signed form, portal toggle | A toggle with no provenance is not evidence |
Every outbound surface reads it at render time
The failure is rarely the flag. It is that the flag is read once, when data enters some other system, and never again. Import-time filtering filters a snapshot, and from that instant the copy is stale.
| Outbound surface | How the opt-out gets lost | Render-time rule |
|---|---|---|
| Public directory page | Cached at the CDN edge before the change | Purge by student key on write; TTL in minutes |
| Campus app people search | Index rebuilt nightly from an unfiltered dump | Put the flag in the index; filter at query time |
| Mail merge and newsletters | A CSV pulled a fortnight before the send | Re-resolve recipients at send time |
| Yearbook and programme exports | One export, typeset months later | Stamp generated_at and an expiry; refuse expired files |
| Class lists in a third-party tool | Rostered once, then owned elsewhere | Push suppression on change; verify it landed |
| Photo galleries | Images tagged with students who later opted out | Unpublish on flag change rather than untag |
The check that finds the surfaces you forgot
- Enumerate everywhere student-identifying data leaves: pages, search indexes, exports, webhooks, push payloads, third-party rosters, print jobs. The forgotten ones are print and whatever marketing owns.
- For each, record the gap between when the data is read and when a human sees it. Any gap longer than your propagation target is a violation waiting for the right student.
- Take every student whose flag changed in the last 30 days and search those surfaces by name and identifier. Do it by hand once; the misses tell you what to automate.
- Move the filter into the read path and set a propagation target with a number in it: live surfaces within 15 minutes, regenerated exports within 24 hours, alerting on a miss.
Read-path filtering costs more in the first sprint and less in every one after, because a new surface inherits it — a constraint we push into the data model early during MVP and product builds.
Where this sits next to consent
Directory information is a disclosure rule, not a consent mechanism, and the two get conflated around younger pupils and photographs. Where a product is aimed at children rather than merely used by them, publication interacts with declaring an app for children, and collection beyond the designated list needs verifiable parental consent. The silo sits under student data privacy, engineered, inside our education and edtech work.
Frequently asked questions
Short answers to the follow-ups this page tends to raise.
What is directory information under FERPA?
It is the category of education record an institution has designated as releasable without prior consent, published in an annual notice to families. Common designations include name, enrolment status, dates of attendance and participation in activities. The list is the school's to set, so verify it against that school's current notice.
Can a school publish a student's name and photograph on its website?
Only if both elements sit in that school's designated list and the student has not opted out. Photographs are frequently designated separately or left out, because families treat a face on a public page differently from a name in a programme.
What happens if a parent opts out halfway through the year?
The opt-out applies from its effective date forward, so live surfaces stop showing the student and later exports exclude them. Material already printed is not retroactively unlawful, but you need dated records of which flag was in force when it was produced.
Does the opt-out apply to a class list shared with a third-party tool?
Yes, and this is where most systems break. Another vendor now holds a copy your flag no longer governs, so the obligation is met twice: push a suppression on change, and hold that vendor to acting on it contractually.
- FERPA
- student data
- consent
- privacy engineering
The work behind this page
Builds from our portfolio that this page draws on.
AskVault
An AI internal knowledge-search platform that answers employee questions from your own docs — grounded in citations, with knowledge gaps surfaced and deflection tracked.
Productivity AINotewell
An AI meeting assistant that records and transcribes every meeting, extracts the decisions and action items, assigns owners and due dates, and tracks follow-through until it's done.
Productivity AIRead next
- Where the education record starts and stops, in the schemaThe education record is not a system boundary you can draw around one database. It is a property of fields, which is why transcripts, prompt logs, error payloads and backups keep landing inside it.definition
- The school official exception, and what it obliges a vendor to buildA vendor holding student records stands inside the school's own permission, not outside FERPA. Each condition of that permission converts into something you build and evidence.definition
- A student data privacy agreement, read as an engineering specificationSchools bind vendors with a standard agreement plus an exhibit naming every data element collected. Five of its clauses are build work, and the exhibit is a schema diff in disguise.definition
- Verifiable parental consent, and when the school can give it insteadUnder COPPA, consent must be obtained by a method reasonably likely to prove it came from a parent. Schools can stand in for parents in narrow classroom cases, and the deliverable is a consent record.definition
Working on something in this space?
Tell us where you are in a sentence or two. We'll tell you honestly whether we're the right team, and what a sensible first slice of the work looks like.
Start the conversation