Student Privacy · FERPA
DOJ's Role in FERPA Enforcement: What USED's Interagency Agreements Do (and Don't) Change
A June 2026 interagency agreement gives DOJ’s Civil Rights Division a role in enforcing FERPA “in coordination with” USED. Here is what the agreement changes, what it doesn’t, and three student-privacy questions it raises.
Over the past year, USED announced several Inter-Agency Agreements (IAAs) that move the day-to-day administration of several programs to other agencies. On June 15, 2026, the U.S. Department of Education (USED) and the U.S. Department of Justice (DOJ) signed an IAA assigning DOJ’s Civil Rights Division a role in enforcing the Family Educational Rights and Privacy Act (FERPA) “in coordination with” USED. The collaboration itself is not new: USED and DOJ have staffed a joint Title IX Special Investigations Team since April 2025, which includes SPPO staff.
What is new is how quickly USED and DOJ have turned their attention to pursuing enforcement penalties following the agreement. Within weeks of its signing, Assistant Attorney General Harmeet Dhillon, whose Civil Rights Division will carry out DOJ’s part of the agreement, said the partnership “ensures maximum enforcement” of FERPA. USED announced that the final week of July alone brought “an Administration-wide crackdown on school districts that are secretly ‘transitioning’ students and hiding it from parents,” “new investigations in Washington and Colorado,” and an investigation in Minnesota. Existing matters have taken on a new tenor as well: DOJ filed a lawsuit against Kansas City, Kansas Public Schools alleging FERPA and PPRA violations, and Ann Arbor Public Schools had until August 10 to respond.
Below, we highlight three novel student privacy questions raised by USED’s moves to shift program administration outside the Department, including a closer look at what role it appears DOJ will play in FERPA enforcement and a high-level overview of the recent actions:
"IAAs are a common tool used by government agencies to share services, collaborate, and ensure efficient service delivery. They have been used by both large and small agencies in Democrat and Republican administrations alike. They are so common, the government has standardized forms to make it easier for agencies to utilize IAAs. Many agencies, including ED, have entire handbooks for this purpose.
IAAs serve many purposes, but they are often used for administering grant programs. For example, in 2022, the Biden Administration’s Department of Justice, Federal Bureau of Prisons signed an IAA designating DOL to administer grants under the First Step Act."
How will student privacy enforcement change?
We now have examples of joint DOJ and USED enforcement:
Kansas:
In April 2026, USED found that Kansas City, Kansas Public Schools maintained policies that violate FERPA. Citing the district’s “ongoing refusal to come into voluntary compliance,” USED announced on June 30, 2026 that SPPO and DOJ’s Civil Rights Division “will take appropriate enforcement measures, including applicable judicial proceedings and potential loss of federal funding.” On September 1, 2026, DOJ and the U.S. Attorney for the District of Kansas filed a “first-of-its-kind” lawsuit against KCKPS alleging FERPA and PPRA violations.1
For information on how FERPA enforcement has historically worked, see our infographic of the investigation process and our January explainer of what happens after a finding. As we noted in January, no FERPA matter had ever gone past a written notice of findings, so the lawsuit against KCKPS is uncharted territory.
Maryland and Michigan:
On July 27, 2026, USED announced that SPPO is partnering with DOJ to take enforcement action against Anne Arundel County Public Schools (AACPS), “including applicable judicial proceedings and potential loss of federal funding,” after determining the district improperly classifies information about a student’s gender identity as confidential medical information that cannot be shared with parents. The letter detailing the FERPA allegations against AACPS was sent by DOJ’s Civil Rights Division and posted by an Assistant Attorney General. According to press reports, AACPS said it first learned of the federal conclusions through the public announcement and would respond through the appropriate process once it receives official correspondence.2
The USED announcement stated that SPPO determined Ann Arbor Public Schools’ policy “likely violates FERPA,” and gave the district until August 10 to demonstrate why USED and DOJ should not move forward with enforcement. We have not yet seen a formal response from the district. As far as PIPC is aware, neither district had a previously announced FERPA investigation (USED announced a Title IX investigation into Ann Arbor Public Schools on June 18, 2026 concerning athletic participation, but that announcement did not mention FERPA).3
Structural Considerations
These actions sit alongside a structural question. The FERPA statute explicitly requires the office tasked with FERPA enforcement to be “within the Department” of Education.4 As a result, efforts to outsource FERPA enforcement to another agency without a statutory amendment (such as to DOJ under the Student Privacy Protection Partnership) could face significant pushback and legal challenges.5 That being said, language in the Student Privacy Protection Partnership Fact Sheet suggests that USED will retain ultimate enforcement authority,6 which may be sufficient to meet FERPA’s requirement that enforcement stay within USED. The legality of the partnership may depend less on DOJ’s participation than on whether USED remains the agency that exercises ultimate enforcement authority.
The Student Privacy Protection Partnership is one of fourteen partnerships USED has announced with six other departments over the past year:
| USED Partnering with the Department of: | To Establish The: (Fact sheets7 for each partnership linked below) |
|---|---|
| Justice | |
| Labor | |
| Interior | |
| Health and Human Services | |
| State | |
| Treasury |
When will FERPA protections still apply?
FERPA regulates “educational agencies and institutions” (EAIs), which the statute defines as: “any public or private agency or institution which is the recipient of funds under any applicable program.” (emphasis added)
FERPA does not define “applicable program.” Instead, the definition in General Education Provisions Act (GEPA) applies here, which defines “applicable program” as:
“any program for which the Secretary or the Department has administrative responsibility as provided by law or by delegation of authority pursuant to law. The term includes each program for which the Secretary or the Department has administrative responsibility under the Department of Education Organization Act [20 U.S.C. 3401 et seq.] or under Federal law effective after the effective date of that Act.” (20 U.S.C. §1221(c)(1), emphasis added)
There are two important pieces to consider here:
“Applicable program” turns on administrative responsibility.
The definition does not hinge on whether USED staff or another agency is doing the day-to-day work or serving as the point of contact for routine tasks. Each IAA will need to be evaluated on a case-by-case basis to determine how duties will be divided between USED and partner agencies. So long as USED maintains sufficient oversight and administrative responsibility over program operations, a reasonable argument can be made that programs co-managed under IAAs should still be considered “applicable programs” for purposes of FERPA analysis.
For example, there is a strong argument that USED retains sufficient oversight and administrative authority over programs subject to the USED and DOL Postsecondary Education Partnership. This IAA includes explicit language that “The Employment and Training Administration (ETA) within the Department of Labor commits to carry out [listed] activities in coordination with and subject to the supervision of the Department of Education” (emphasis added). Interestingly, while this “subject to the supervision of” language appears in the USED-DOL Postsecondary Education Partnership agreement, it is not in the three USED-DOJ agreements (each commits DOJ to carry out its activities “in coordination with” USED). While unconfirmed, this may simply have been done to reflect that DOJ litigates under its own authority. In the USED-DOJ IAAs, the agreements specifically list eighteen things USED retains authority for, including: management and leadership of the Office of Postsecondary Education, clearance of grant program announcements and competition technical review plans, development of program notices for the Federal Register, review of grantee performance and fiscal reports, budget formulation, monitoring internal controls and risk assessments, “[r]esolution of matters requiring the exercise of final and conclusive authority that has been assigned by statute to the Secretary of Education,” and a residual clause covering “[a]ll remaining activities ED is statutorily required to perform that are not otherwise identified in Section 3.B.”
What makes a program an “applicable program” subject to FERPA is not whether another agency has assumed some operational responsibilities, but instead whether USED retains administrative responsibility.
Receiving funding under one applicable program triggers FERPA coverage for all education records.
It makes no difference whether schools receive funding under 1 or 100 applicable programs, FERPA applies to EAIs receiving federal funding under any applicable program. Once an EAI is covered under FERPA, FERPA protections reach all education records the EAI holds (not only the records tied to particular funding streams).
Schools, districts, and colleges typically receive funding under several “applicable programs,” so their FERPA coverage does not depend upon any one of them. That being said, if an organization only receives federal education funding for one program, the status of that single program will be the deciding factor for if the entity as a whole is subject to FERPA coverage. For example, consider a community-based nonprofit that receives federal education funding to run only one of its many programs. If the program it receives federal education funding for is an “applicable program,” the community-based nonprofit is considered an EAI that is regulated under FERPA. If this program is no longer considered an “applicable program,” the organization would no longer be covered under FERPA, and parents and eligible students would lose FERPA rights and protections in the records the nonprofit holds about them. No one would have to decide that, announce it, or notify a single family of this change.
Will USED share student data with other agencies?
Under FERPA, no one other than parents and eligible students can access student personally identifiable information (PII) from education records unless:
- They have consent from parents or eligible students; or
- An exception to FERPA’s consent requirement applies and all required safeguards are in place.
The same rule applies to federal agencies, including USED. Since obtaining consent would be nearly impossible at scale, in practice the Department is limited to accessing and sharing PII in ways that fit within an existing FERPA exception.8 No FERPA exception currently allows USED to share student PII with other federal agencies solely on the basis that the Department has entered into IAAs to co-manage programs.9 Note that USED cannot unilaterally create a new FERPA exception to facilitate such transfers because, as USED has acknowledged in 2011,10 expanding the list of who can receive PII without consent under FERPA would require an act of Congress. Short of that, the only lever is interpretation, and any reinterpretation would still have to stay within the statute’s limits.
What to watch next
PIPC will be watching to see if and how the scope and duties established under the IAAs are amended. For example, two addendums were added to the IAA between USED and DOL that established a new Postsecondary Education Partnership in January and March 2026. Whether the USED and DOJ agreements are revised as implementation questions arise remains to be seen.
We will also be paying attention to the landmark FERPA and PPRA lawsuit against Kansas City, Kansas Public Schools, as well as awaiting Ann Arbor Public Schools' response to SPPO's determination (the deadline has passed, but in our research we have not yet found the district's response).
FERPA requirements and protections have not changed, and (as far as we know) technical assistance requests will still go to SPPO. We will share additional updates and student privacy insights as these questions unfold.