FERPA Compliant LMS: What It Means and How to Vet One

A FERPA compliant LMS is one that lets your school meet its own obligations under the Family Educational Rights and Privacy Act. No federal agency certifies or approves LMS products. Compliance rests on how the vendor is contracted, what it may do with student data, who can see that data, and how it is protected. This guide shows what to require, what to put in the contract, and what to ask before you sign.

Leaderlyapp

Build Leadership Skills Through Learning

Leaderly AI supports continuous learning with personalized microlessons and practical exercises to help employees develop impactful leadership habits.

Visit Leaderly AI

TL;DR

FERPA does not certify products. The school stays responsible, so "FERPA compliant" is a claim you verify, not a badge you accept.
A vendor usually qualifies as a "school official": it performs a function the school would otherwise do itself, under the school's direct control, and uses data only for the purposes the school authorizes.
Look for role-based access, a security plan, breach notification, periodic privacy audits and a documented data-destruction plan with a timeline.
Read the terms of service. Broad data licenses, unilateral term changes and advertising uses are red flags.
Run any AI feature through institutional review before student records touch it.

What FERPA protects, and why an LMS is in scope
Who must comply: the school, not the software
Why "FERPA certified" is a red flag
The school official exception, in plain terms
What a FERPA-conscious LMS should provide
Contract terms that decide compliance
A practical vetting process
AI features raise new questions
Our perspective
Leadership development for campuses, with your privacy review first
Common mistakes to avoid
FAQ
Sources

What FERPA protects, and why an LMS is in scope

FERPA is a federal law, 20 U.S.C. § 1232g. It gives parents access to their children's education records, the right to seek amendment, and some control over disclosure of personally identifiable information. Those rights transfer to the student once they become eligible, typically at college age.

An LMS holds exactly the kind of material the law covers. Education records are records directly related to a student and maintained by an institution or by a party acting for it. Grades, transcripts and class lists count, in any media form. Discussion posts, graded submissions, gradebook entries and instructor comments inside an LMS fit that definition when they are tied to an identifiable student.

Personally identifiable information is broader than a name. It covers direct identifiers such as a name or student ID, indirect identifiers such as a date of birth, and any other information that, alone or combined, lets a reasonable person in the school community identify a student with reasonable certainty. That matters for analytics. A dashboard that shows "the one student in this section who logged in at 3 a.m." can identify someone even with the name removed.

Three ways student information can identify someone

Who must comply: the school, not the software

FERPA applies to educational agencies and institutions that receive funds from programs administered by the U.S. Department of Education. That means public schools, school districts and most colleges and universities. The obligation sits with them.

A vendor is not directly regulated in the same way, but it is bound through the relationship. When a school gives an LMS provider access to education records, the school must be able to show the provider is acting within FERPA's rules. If the vendor mishandles the data, the school answers for it.

Enforcement matters here. The Department's Student Privacy Policy Office investigates violations, and unresolved noncompliance can lead to withheld federal funds. There is no private right of action, so a student cannot sue under FERPA itself. The practical risk is institutional: funding, findings letters and reputational damage.

Why "FERPA certified" is a red flag

You will see "FERPA compliant" on many vendor pages. Treat it as a starting claim. The Department tells teachers and institutions to check with school or district administration and IT staff before using an online tool, because applications can introduce privacy and security vulnerabilities. Approval is a local governance decision, not a federal stamp.

Some institutions formalize this. Detroit Mercy, for example, requires vendors to submit security and accessibility documentation and pass institutional review before LMS integration. That is a sound model: the vendor supplies evidence, and the institution decides.

The school official exception, in plain terms

Most LMS arrangements rely on the "school official" exception, which lets a school share education records with a service provider without individual consent. The Department's guidance for third-party providers says a provider must perform a function the school would otherwise use its own employees to perform, have a legitimate educational interest, be under the school's direct control regarding data use, and not re-disclose personal information except as authorized.

Translated into a checklist for an LMS:

Function. Hosting courses, tracking progress and delivering content are things a school could do with its own staff and servers. Fine.
Legitimate educational interest. The vendor sees only the data needed to run the service.
Direct control. The contract says the school owns the data and decides how it is used, retained and deleted.
No re-disclosure. The vendor does not pass records to others without school permission.

The same guidance says targeted advertising to students or parents will likely violate privacy laws, and that use must be limited to the purposes the school authorizes in the contract.

What a FERPA-conscious LMS should provide

FERPA does not publish a technical standard for LMS software. The Department's best-practice guidance, though, is consistent about what a responsible provider has in place. Here is how it translates into features and documents you can ask to see.

Safeguards to expect

Area	What to look for	Why it matters
Security plan	A written, current security plan	Best practice includes a formal plan, periodic privacy audits and documented breach procedures
Breach response	Defined steps and notice to the school	The school must be able to act quickly and notify people
Access control	Role-based permissions, with instructors seeing only their sections	Limits who can see identifiable records
Audit trail	Logs of who viewed or changed grades and records	Lets you investigate and prove oversight
Data destruction	A plan with a timeline and method; certification of destruction	Recommended as a best practice in the Department's vendor guidance
Hosting	Reasonable security for cloud-hosted records	FERPA does not prohibit cloud hosting; compare providers' security, monitoring and incident response
Identity	Single sign-on and automated provisioning and deprovisioning	Fewer shared passwords and orphaned accounts

On the identity row, failures in attribute mapping, logout and provisioning are where access problems often start. Our walkthrough of LMS single sign-on failures and fixes covers what IT teams should test.

Data mining and de-identification

Vendors often say they use "anonymized" data to improve the product. The Department's guidance is careful here. Data mining may be acceptable when done for purposes agreed with the school and used to improve educational services, while mining for targeted advertising should be prohibited. De-identification is not a guarantee either, since re-identification can be hard to prevent. Ask vendors to commit not to re-identify data and to require the same of anyone who later holds it.

Contract terms that decide compliance

The contract is where "direct control" becomes real. Guidance on online educational services says agreements should address security and data stewardship, collection, use, retention, disclosure, destruction and access, and specify how the school keeps direct control.

When you read the paper, check these in order:

Ownership. The school keeps ownership of student data. Be wary of terms granting the provider an exclusive and irrevocable license to that data.
Purpose limits. Data is used only for the services described in the agreement.
Changes to terms. The Department's guidance says unilateral changes make it hard for a school to demonstrate direct control. Requiring notice of changes is more common than requiring consent, so at minimum insist on advance notice and a right to terminate.
Subcontractors. Anyone the vendor passes data to is bound by the same limits.
Breach notice. Timeline and who is told.
Deletion. What is destroyed, how fast, and whether you receive written certification.

A real enforcement example shows why this reading is worth the time. In a November 2, 2017 letter to Agora Cyber Charter School, the Department found a FERPA violation where online-service terms required acceptance of broad rights to use and distribute information that could include education-record data. That effectively forced a waiver of FERPA protections. Clauses on data use, service changes and disclosure, like the ones discussed in this kind of service-terms document, deserve a line-by-line read from counsel, not a skim.

Plan the exit before you enter

Contracts should include a destruction plan for when the service ends. Write down who deletes what, in what time, and what proof you receive. Planning secure disposal and its documentation early avoids the common situation where a former vendor still holds years of records nobody asked it to delete.

A practical vetting process

Use the same steps whether you are a university, a district or a nonprofit running a training program for students or youth.

Inventory. List every online service already in use, paid or free. Guidance recommends that schools inventory online services to see what student information is shared and set approval processes for both paid contracts and free click-wrap tools.
Send a security questionnaire. Ask for the security plan summary, audit practices, breach procedure and hosting details.
Map data flows. Which fields move from your student information system into the LMS? Trim anything not needed.
Review the agreement and terms of service against the list above.
Test roles. Create a sample instructor, student and admin and confirm each sees only what they should.
Pilot with limited data before a full rollout. Our guide on running a 60-day pilot and asking demo questions fits this stage.
Train staff. Most FERPA incidents involve people, not code. Pair rollout with a change-management plan.

AI features raise new questions

Many LMS products now generate summaries, recommendations or feedback. Those features do not sit outside FERPA. The University of Wisconsin–Madison Registrar notes that an AI-generated record can become an education record when it is shared or uploaded into a shared system, and that tools should go through institutional review before FERPA-protected data is used with them.

For any AI feature, ask the vendor in writing:

Is student data used to train models, and if so, whose models and under what limits?
Where are prompts and outputs stored, and for how long?
Can you turn the feature off for specific courses or populations?
Does the vendor commit not to use student information for advertising?

Our perspective

We build a mobile-first leadership development platform, and we see this question from the buyer's side more often than you might expect. Higher education teams ask us about it when they bring leadership development to students, faculty and staff, and the best ones begin with the contract rather than the feature list.

Our view is simple. Do not accept a compliance badge in place of evidence. Ask what data the platform collects, who controls it, how it is used to personalize learning, and what happens at the end of the agreement. Personalization is useful only when the institution can see and govern what drives it. Leadership content, self-assessments and microlessons are low-risk when the data stays in a defined scope, and your privacy office should confirm that scope before launch.

We also believe data-privacy literacy belongs in the curriculum, not just the contract. If you are building skills in this area for staff, our guide to choosing a data privacy course for U.S. careers is a good place to start.

— Drew

Leadership development for campuses, with your privacy review first

If your institution wants continuous leadership development for students, faculty and staff, Leaderly AI for Higher Education delivers personalized microlessons, assessments and analytics from a mobile-first platform. Pricing is arranged with each organization, so ask our team for a quote and share your vetting checklist at the start. We expect to answer your security and data questions in writing.

Leaderlyapp

If you are comparing options for a nonprofit or corporate program instead, see our pages for nonprofits and business.

Common mistakes to avoid

Treating a vendor's marketing page as evidence. Ask for documents.
Letting instructors adopt free tools alone. Click-wrap terms are still contracts that bind the school.
Syncing every student field by default. Send only what the course needs.
Ignoring offboarding. Accounts, backups and exports should all have a deletion plan.
Forgetting state law. Some states add student-privacy duties on top of FERPA, so involve counsel familiar with your state.

FAQ

Is there an official list of FERPA compliant LMS products?

No. The Department of Education does not approve or certify LMS products. Each school or district decides locally, usually through a review by its privacy, legal and IT teams. Treat any "certified" claim as something to verify through documents and contract terms.

Does FERPA apply to a corporate training LMS?

Generally, FERPA applies to educational institutions that receive Department of Education funds, not to private employers. A company's training platform falls under FERPA only if it handles education records on behalf of such an institution. Employers may still face other privacy laws, so check with counsel.

Can an LMS vendor use student data to improve its product?

Only within purposes the school has agreed to, and generally to improve educational services. Federal guidance says mining for targeted advertising should be prohibited. Put the permitted uses, and a ban on re-identification, into the contract.

Can a cloud-based LMS be FERPA compliant?

Yes. FERPA does not prohibit cloud hosting of education records. The school should compare providers' security measures, monitoring and incident response, and keep direct control through the contract.

What should happen to student data when we end the contract?

The agreement should set a destruction timeline and method, and ideally require written certification of destruction. Agree on this before you sign, not at termination.