Students deserve privacy and protections in school over their personal property such as lockers, backpacks, and cell phones. Students deserve privacy over their social media presence, personal messages, lifestyle choices and identity both within and outside of school. Unfortunately, schools often institute overbearing, authoritarian policies to monitor and punish students for personal aspects of their lives, such as social media history. Recent state laws have also been forcing schools to inform parents of students’ gender identity, alternate names, and sexual orientation that they exhibit during school hours, further harming student privacy. In some of the most severe instances, religious schools have exhibited overbearing policies to control and punish students for personal relationships, menstrual cycles, sexuality and personal relationships. These violations of student privacy are unacceptable, and NYRA advocates to abolish all overbearing and strict school policies and state laws that directly assault the privacy of students.
Along with this, students deserve privacy over their personal data, information and academic records. Having the ability to be in charge of your own personal academic information and understand how schools handle student data is an important part of personal development as a young individual. This includes understanding your rights to access your records, control who sees your information, and manage your digital footprint in school systems.
However, in many parts of the United States, many young individuals often face confusion or limitations regarding privacy rules and access to their own information. These restrictions and confusions can cause delays in developing independence and personal growth. As a student, it is important to understand the guidelines of student privacy policies so that students can use their rights and protections correctly when faced with issues involving personal or academic information.
NYRA advocates for fair student privacy policies that give students more control over their personal data while keeping basic protections and support in place. In the following webpage, we explain the rules and regulations around student privacy and date, along with violations of student privacy from monitoring, control and punishing school policies and state laws.
Table of Contents
- Federal Laws on Student Privacy
- State Laws on Student Privacy
- Parental Notification Laws on Gender Identity and Student Privacy
- Negative Impacts of Parental Notification Laws
- Types of Student Privacy Policies
- Affect on Students
- Disturbing Stories of Student Privacy Violations
- Breaches of Student Data
- Conclusion
Federal Laws on Student Privacy
Federal laws mostly ensure that schools handle student information fairly and safely. This includes the Family Educational Rights and Privacy Act (FERPA), which gives students the right to access and request changes in their academic records 20 U.S.C. § 1232g. The Health Insurance Portability and Accountability Act (HIPAA), which protects health information in school medical services 45 C.F.R. pts. 160, 164. The Protection of Pupil Rights Amendment (PPRA), which gives students rights over surveys, marketing, and personal data collection 34 C.F.R. pt. 98.
FERPA also allows schools to label certain details as “directory information.” This includes: student’s name, address, telephone number, participation in activities, and awards. This can be shared publicly unless a parent or guardian denies it to be. Once a student turns 18 years of age, these rights will transfer directly to the student.
Read more about Protecting the Privacy of Student Records
In addition, the U.S. Department of Education works to protect student privacy. It enforces laws including FERPA and PPRA and gives schools guidance on how to keep student information safe. The Fourth Amendment also applies to schools. This means that there must be a valid reason to search the property of a student, so evidence is required.
Apart from this, states and schools decide most of the rules for how students’ records and data are stored and accessed. Courts have been known to support this approach as long as the basic privacy rights of students are maintained.
State Laws on Student Privacy
State laws play the biggest role in deciding how student privacy is enforced in schools. For starters, most states set rules for who has access to the academic records, disciplinary records, and health related information.
Some states allow older students to access their records or control who can see certain information. Others still require parental approval for most decisions. If students or parents feel their privacy has been violated, state laws may provide a way to deal with it. This can include filing complaints with school districts, state education departments, or taking legal action in serious cases.
Read more about Family Educational Rights and Privacy
Furthermore, some states have new laws that require schools to inform parents about a student’s gender identity, sexuality, preferred name, or pronoun change. These laws have caused problems related to student privacy and safety, especially for the LGBTQ+ students who may not feel safe sharing such information at home. According to the UCLA Williams Institute, policies forcing schools to out transgender students to parents can increase family rejection and mental health risks. Other states have passed laws that protect a student’s ability to keep this information private inside the academic environment.
Parents or guardians usually make most legal decisions for minors. While parent involvement is important, older teens are often capable of making thoughtful choices about how they want their own information to be dealt with. Allowing students to manage their own records and personal data while providing support can help them gain stronger responsibility and understanding of privacy protections.
Some states and school districts have stricter policies regarding student information that can limit independence. For example, students may need parental approval to access their grades, disciplinary records, or health records. In some areas, even students who are close to 18 years of age have limited control over their own information. FERPA notes, “Parents or eligible students have the right to inspect and review student’s education records maintained by the school and to request corrections if they believe records are inaccurate or misleading” (Public Health Law).
Strict privacy rules can also include limitations on who can see health records or online activity on school WiFi or apps. Students may not be able to correct mistakes in their records or request restricted access without adult permission.
These stricter rules are often set in place in hopes to protect students; however, this can instead lower a student’s confidence for future opportunities, making students feel the need to depend on others when dealing with personal information. When students are not trusted with responsibility, they can miss out on major learning opportunities.
Privacy policies should protect students while also recognizing the importance of practicing making informed decisions and independence in dealing with personal information.
Parental Notification Laws on Gender Identity and Student Privacy
Having privacy over personal identity information is also an extremely important part of student privacy. This includes a student’s preferred name, gender identity, sexuality, and pronouns. Due to feelings of not being able to comfortably share this information at home, some students like to tell their academic environments to be able to feel more comfortable in the space.
However, some states have now passed laws that require schools to inform parents if a student requests to use a different name or pronoun than what is provided on the official record. These laws oftentimes are claimed to further parental knowledge of their children, but not all students may feel safe or comfortable sharing this information at home.
Below is a comprehensive list of all states that have laws requiring parental notification related to personal identity changes:
Alabama: Alabama laws state that school employees cannot encourage a student to hide their preferred gender identity from their parents if it is different from their biological gender identity listed on their records S.B. 184. In Alabama, only 29% of LGBTQ+ youth claim that their home is a safe environment for them to come out. This suggests that many fear negative reactions if they share preferred identity information.
Arkansas: In Arkansas, a school employee must have written permission from a parent or guardian before using a student’s preferred name or pronoun that does not match their biological gender identity listed on their records H.B. 1468. In Arkansas, 39% of LGBTQ+ youth claim that their home is an accepting environment.
Florida: Florida law states that school employees are not required to use a student’s preferred gender identity if it does not match with their biological gender identity H.B.1069. In Florida, 33% of LGBTQ+ youth claim that their home is an accepting environment.
Idaho: Idaho laws prevent schools from stopping employees from telling parents or guardians about a student’s mental, emotional, or physical health H.B. 163. In addition, school employees cannot use a student’s preferred name or pronoun if it does not match with their biological gender identity listed on their records H.B. 538. In Idaho, 42% of LGBTQ+ youth claim that their home is an accepting environment.
Indiana: Indiana law requires schools to notify the student’s parents or guardian in writing if a student requests to change any gender identity related information that differs from school records. Before approving the change, schools need written parental consent H.B. 1608. In Indiana, 40% of LGBTQ+ youth claim that their home is an accepting environment.
Iowa: Iowa law states that schools cannot give parents false information about their student’s gender identity or plans to transition to a gender different from what is on their official record S.F. 496. In Iowa, 40% of LGBTQ+ youth claim that their home is an accepting environment.
Kentucky: Kentucky law states that school employees or students are not required to use pronouns that do not match a student’s biological gender identity. In addition, schools cannot keep student information secret from the student’s parents or guardian S.B. 150. In Kentucky, 38% of LGBTQ+ youth claim that their home is an accepting environment.
Louisiana: Louisiana states that public school employees must use the same name on a student’s birth certificate and pronouns must match the student’s biological gender identity unless written parental permission is provided S.B. 81. In Louisiana, 38% of LGBTQ+ youth claim that their home is an accepting environment.
Montana: Montana law states that calling a student by their legal name or biological gender identity is not discrimination H.B. 361. In addition, another law requires written parental consent before using pronouns that do not match a student’s biological gender identity S.B. 518. In Montana, 46% of LGBTQ+ youth claim that their home is an accepting environment.
North Carolina: North Carolina law requires schools to tell parents or guardians if a student requests a different name or pronoun for school records or staff to use S.B. 49. In North Carolina, 33% of LGBTQ+ youth claim that their home is an accepting environment.
North Dakota: North Dakota law states that schools cannot create policies about a student’s transgender status without parental consent and cannot hide information about the student’s transgender status from parents H.B. 1522. In North Dakota, 42% of LGBTQ+ youth claim that their home is an accepting environment.
Ohio: Ohio law requires schools to notify parents or guardians if a student requests to identify with a gender different from their biological gender identity H.B. 8. In Ohio, 37% of LGBTQ+ youth claim that their home is an accepting environment.
South Carolina: South Carolina law prohibits school employees from hiding a student’s preferred gender identity information from the student’s parent or guardian if it is different from what is on their official record H. 4624. In South Carolina, 34% of LGBTQ+ youth claim that their home is an accepting environment.
Tennessee: Tennessee law states that schools are not legally responsible if employees use pronouns that match a student’s biological gender identity. This also is to prevent giving parents misleading information about a student’s gender identity S.B. 466. In Tennessee, 35% of LGBTQ+ youth claim that their home is an accepting environment.
Utah: Utah law states that schools cannot make policies that hide a student’s records from parents S.B. 100. In Utah, 41% of LGBTQ+ youth claim that their home is an accepting environment.
Virginia: Virginia’s model policies state that schools must always keep parents or guardians informed about their child’s health, social, and psychological development. In addition, the policies require using the student’s biological name and pronouns that match their records (Model Policies). In Virginia, 38% of LGBTQ+ youth claim that their home is an accepting environment.
Read more about States With Specific Requirements on Parental Notification
Read more about LGBTQ Students State-by-State
Negative Impacts of Parental Notification Laws
State laws that force schools to tell a student’s parents or guardians about the student’s gender identity, preferred name, pronouns, or sexuality can have a heavy impact on the student’s safety and mental health. Many LGBTQ+ students already struggle with sharing their true feelings regarding their personal identity, so laws that require automatic parental notification can make things more stressful for them.
According to the National Youth Risk Behavior Survey, out of the 3% of students who identify as transgender in U.S. public schools, 72% experienced persistent feelings of depressive symptoms. This includes constant sadness, low mood, and cognitive difficulties. If the fear of being forced to talk about their identity before they are ready is added onto this, it creates an even higher negative effect on daily life.
Furthermore, surveys show that over 57.4% of LGBTQ+ youth have experienced at least one form of parental rejection after sharing their preferred gender or sexual orientation (Human Rights Campaign). These students report higher levels of emotional distress compared to other students.
In homes that do not support their child’s personal identity preferences, parents may discriminate against their own child by enforcing traditional beliefs, neglecting them, or using physical and mental abuse. In Alabama, a state with parental notification laws, 45% of LGBQT+ youth reported experiences of threat or harm due to sexual orientation or gender identity, and 74% experienced discrimination (The Trevor Project). This discrimination is often from other students, family members, educators, or in public spaces. With already extremely high rates of discrimination taking place, forcing parental notification laws will only higher the risk of behaviors that can eventually lead to dangerous conduct.
According to a report by the Human Rights Campaign, about 65.5% of LGBTQ+ youth are either out to some family members or not out at all. This is due to the fear of negative reactions, rejection, or not being accepted.
This shows that when states force laws onto schools that automatically notify parents or guardians about a student’s preferred name, gender identity, sexuality, or pronouns, many LGBTQ+ youth face extreme fears of lack of support at home, which puts risk on the individual’s wellbeing.
Types of Student Privacy Policies
Academic Records Privacy: Rules about who can see grades, transcripts, and disciplinary records. In some states, students have the right to access and request changes to their records. This is to give students a bit more freedom when it comes to their academics. However, some states require parents to provide the student with access to the records before they are able to see any information 20 U.S.C. § 1232g.
Health & Counseling Privacy: Guidelines for access to health records, mental health notes, and medication information. Only school staff granted permission from the students’ parents or guardian are able to view these records. This is to ensure sensitive information is protected while also allowing medical services at schools to help if any emergency takes place 45 C.F.R. pts. 160, 164.
Digital Privacy: Rules for online learning platforms, emails, and school technology usage. Students must know what is being monitored and how data is used. This is to provide safety to students and their personal information in a time where technology is used heavily 20 U.S.C. § 1232g; 34 C.F.R. pt. 98.
Security Policies: Guidelines for online monitoring, usage of cameras, and data collection in schools. Policies are put in place for safety, but student privacy is required to be taken into consideration. In addition, students must know what is being monitored and why.
Search Policies: Rules involving when schools are able to search lockers, backpacks, cell phones, or other student owned property. Schools are required to have a legitimate cause before conducting a search. Due to this, it is important for students to understand what rights they have so they are not unknowingly taken advantage of.
Social Media & Off-Campus Speech Policies: Guidelines about when schools can discipline students for harmful posts made on personal social media accounts. Schools are able to take action if posts have an unsafe impact during school hours.
Affect on Students
Student privacy policies have a huge effect on an individual’s confidence, responsibility, and ability to understand the importance of privacy. Supportive rules help students feel more safe and respected, while overly strict or confusing policies can make students feel trapped.
Policies that allow students to make decisions about who sees their records, how they use technology, and how their personal information is displayed can help students practice responsibility and respect for rules without feeling controlled. The Student Privacy Compass states that because all student personal information belongs to the student, it should therefore be kept private. This shows the importance of allowing students to manage their own data.
When students feel respected and trusted, they are more likely to take their academic lives more seriously which leads to a more productive future. This can provide them with skills and confidence that will help them succeed both in school and after.
Disturbing Stories of Student Privacy Violations
Schools both in the US, and other parts of the world, have been documented violating student privacy in increasingly creepy and overbearing ways. Read the following stories of these violations of student privacy to learn more
Lower Merion School District, PA – School Webcam Spying Case (2010): Lower Merion School District faced national scrutiny after it was revealed that school-issued laptops contained software capable of remotely activating webcams and capturing images of students at home. Lawsuits followed, and the district ultimately settled. The privacy violation concerns here were particularly stark: activating a camera inside a student’s home intrudes into the most protected private space. Even if intended for device recovery, covert image capture raised constitutional concerns and alarmed families because it extended school monitoring beyond campus into bedrooms and living rooms. This violated student privacy rights and broke the Fourth Amendment by watching individuals in private spaces. Schools should never be able to spy on students in their own homes.
Lady Aisha Academy: In 2019, the UK school inspectorate reported that staff at Lady Aisha Academy had questioned female students about their menstrual cycles in relation to non-attendance at prayer. The inspection criticized the practice, stating it did not adequately promote pupil welfare. This violation of privacy centers on compelled disclosure of intimate medical information to school staff, particularly when that information is tied to religious compliance and broadly accessible within the school environment. Menstrual status is sensitive health data, and requiring students to disclose it in order to justify behavior exposes deeply personal information without clear safeguards, potentially creating embarrassment, stigma, and coercion. School staff and teachers should never be allowed to coerce students into giving out personal information about their health and reproductive cycles.
Houston Christian High School: In a lawsuit filed by parents, Houston Christian High School was accused of fostering a system where students were encouraged or rewarded for reporting on classmates, and of administrators asking intrusive sexual questions of a student during an investigation. While these claims were allegations in litigation rather than final findings, they raised serious privacy concerns. Encouraging peer surveillance can undermine students’ expectation of confidentiality in personal relationships and communications, while questioning minors about sexual matters without clear boundaries or parental involvement can intrude into highly sensitive personal territory. Students deserve privacy over their personal relationships and sexual history; schools have no right to coerce this information out of them.
Tennessee Christian Preparatory School: A student sued Tennessee Christian Preparatory School after alleging she was barred from graduation and threatened regarding her diploma following a social media post coming out as gay. The dispute raised privacy issues because it involved the school monitoring or acting upon a student’s off-campus social media expression about her identity. When schools discipline students for personal disclosures made outside school grounds, it blurs the line between institutional authority and private life, particularly when the information relates to sexual orientation, a deeply personal aspect of identity. Schools should never be able to give students consequences over social media posts- especially those relating to their personal identity and sexual orientation.
Minnewaska Area Schools: In Minnesota, a student sued after school officials allegedly demanded access to her Facebook account credentials during a disciplinary matter. The case resulted in a settlement and policy changes. Demanding passwords gives school authorities access not just to public posts but to private messages, friend lists, and restricted content. This crosses a major privacy boundary because it compels students to surrender control over their private communications and digital social lives, often without a warrant or clear legal authority. Schools should never demand control over a student’s private social media. Students deserve complete and total privacy of their personal social media accounts, and schools should never be able to control those things.
Pennsylvania cell phone search settlement: In Pennsylvania, a school district paid a settlement after confiscating and searching a student’s cell phone. Cell phones contain extensive personal data, texts, photos, location history, and account access, making them one of the most sensitive repositories of private information. Courts have increasingly recognized that searching a phone is far more intrusive than searching a backpack. The severe privacy issue arises when schools exceed reasonable suspicion limits and conduct broad digital searches without narrowly tailored justification. Students deserve control over their personal property, and shouldn’t have to fear that their devices- with deeply personal information- may be searched by school staff or teachers.
Ogletree v. Cleveland State University: During the COVID-19 pandemic, Cleveland State University required students to perform a 360-degree “room scan” with their webcams before taking remote exams. A federal court found this requirement unconstitutional under the Fourth Amendment in that public university context. The privacy concern was that forcing students to visually expose their homes to school officials constituted an unreasonable search. A student’s home is traditionally afforded the highest level of constitutional protection, and compelled visual inspection intrudes into private living spaces unrelated to academic integrity. A student’s room is none of the school’s business, and no student, regardless of their remote learning status, should be forced to give this out information in order to take exams.
Lawrence Public Schools / Gaggle AI monitoring: Students filed suit alleging harm from the use of “Gaggle,” an AI tool that scans school-issued accounts and documents for concerning language. While schools argue such tools protect student safety, critics say they create an environment of constant surveillance. The privacy issue arises from automated, ongoing monitoring of emails, chats, and documents that students may perceive as semi-private communications. Even if limited to school-managed accounts, the breadth of scanning can chill expression and make students feel that personal thoughts or creative writing are subject to institutional review. Student documents or messages should never be monitored and scanned by a school without a student’s consent.
Huntsville, Alabama – Social Media Monitoring Issue (2013): Schools required students to give access to their personal social media accounts during investigations. This violated rules regarding students’ digital privacy and off-campus freedom of speech. Students deserve a right to privacy over their social media, and should never be required to disclose this information to schools.
Los Angeles Unified School District, CA – School iPad Scandal (2014): The school provided students with iPads that included a monitoring software to track and block content, but the software was not fully tested. This violated digital privacy and put student data at risk, with information being collected without consent.
Students deserve privacy over their personal information, and this information should not be collected by schools without their consent. Unfortunately, schools often do this, which violates student privacy rights, and leads to devastating consequences, especially in the cases of data breaches.
Breaches of Student Data
Schools oftentimes use third party websites to organize work, and provide lessons to their students. However, these websites usually collect data on students, which can unfortunately be breached, or even sold.
On January 7th, 2025, schools and districts were notified of a Powerschool SIS security breach that exposed student, parent and teacher personal information. The extent depended on the district but usually included first, middle, and last names, home address, medical alerts, email, phone and potentially social security numbers. The breach reportedly affected over 60 million students and almost 10 million teachers. Along with this, there have been 1,619 known K-12 school data breaches in the US from 2016-2022 that hit individual schools or districts. From 2005-2024, including colleges, there were 3,713 breaches, exposing over 36 million records.
In some situations, these third party websites even sell student data. Before Powerschool was breached explicitly, a lawsuit was filed accusing Powerschool of selling student data with only the unclear, coerced consent of parents. Similar data-selling lawsuits have been filed against companies like Google, IXL Learning, Instructure (best known for their Canvas learning platform) and Edmodo.
The part about this that reflects the violation of youth rights, is that the parents are the ones to consent to the selling of student data… not the actual students themselves. Similarly, whenever data breaches occur, the parents and schools are the ones who are notified, not the students who just had their data leaked.
Read more about Powerschool vs Student Privacy
Conclusion
Student privacy policies are mostly decided by states and schools. Restrictions in an academic environment can slow independence and prevent students from gaining important skills. Giving students the ability to be in charge of their own personal student data while also providing protections and support is the most effective approach when dealing with student privacy.
Through advocating for fair and clear student policies, NYRA hopes to give young people more control over their personal data and belongings as students while keeping basic protections and support opportunities in place.
The National Youth Rights Association
If you’re interested in Youth Rights, consider volunteering with us. We are always looking for new members and would love to have you on board. If you have a personal story about either a violation of student privacy, or a violation of youth rights, consider sending us an email at nyra@youthrights.org, and we’d love to help get your story out to the world.
