For Researchers: Electronic Consent to Obtain FERPA-Protected Student Records

The Federal Educational Rights and Privacy Act (FERPA) and its supporting federal regulations govern how and when information may be released from student records to third parties, including researchers. The law and regulations outline how university students may consent to the release of protected information, including provisions that must be met if consent is obtained through electronic means.

When obtaining electronic consent from students for the release of FERPA-protected student records, it is essential that the consent process meet the requirements of FERPA. These requirements may not necessarily be the same as Institutional Review Board (IRB) requirements for obtaining informed consent from students for a research study, especially studies that are otherwise limited to online surveys and/or may be determined by the IRB to be minimal risk.

As a campus researcher, it is incumbent on you to obtain consent that is IRB approved and FERPA compliant. If the consent language and consent process do not meet the requirements of FERPA, FERPA-protected data from the student record generally cannot be released to researchers. We strongly encourage you to consult with our staff early when planning studies that will include a request for information from the FERPA-protected student record. We work closely with our colleagues in the campus IRBs and are happy to help you up front so that your consent forms, consent procedures, and IRB protocols will enable you to obtain the desired data.

Obtaining Written Student Consent

Subpart D of the FERPA regulations focuses on the question “May an Educational Agency or Institution Disclose Personally Identifiable Information From Education Records?” Under this heading, Section 99.30 addresses the question “Under what conditions is prior consent required to disclose information?”

Section 99.30(a) states that “The … eligible student shall provide a signed and dated written consent before an educational agency or institution discloses personally identifiable information from the student’s education records….”

Section 99.30(b) states that “The written consent must: (1) Specify the records that may be disclosed; (2) State the purpose of the disclosure; and (3) Identify the party or class of parties to whom the disclosure may be made.”

Finally, Section 99.30(d) states that “’Signed and written consent’ under this part may include a record and signature in an electronic form that – (1) Identifies and authenticates a particular person as the source of the electronic consent; and (2) Indicates such a person’s approval of the information contained in the electronic consent.”

Thus, “written” consent under FERPA may be obtained electronically, but it must meet each of the following requirements.

This is an accordion element with a series of buttons that open and close related content panels.

1. Include all the required elements of 99.30(b), including statements of the records to be disclosed, for what purpose, and to whom;

Here is one example of the kind of language that is acceptable:

“If you agree to participate, we will also link your survey results with some information from your student record. Specifically, we will obtain from the Office of the Registrar information about your current academic level (e.g., junior, senior), your current major(s), and your cumulative GPA to date. This information will only be available to study researchers; we will not release it to anyone else.”

2. Be collected in a manner that authenticates and is traceable back to the individual student; and

The simplest way to accomplish this is to send a unique survey link to each student’s campus (i.e., @wisc.edu) email address. Campus email requires a password known only to the student and system administrators.

In addition, survey tools such as Qualtrics can send each participant a traceable URL to direct them to the survey online.

Note that a single generic URL that is sent to all study participants and is not tied to a specific individual is not acceptable as it is not in a form that “identifies and authenticates a particular person as the source of the electronic consent.”

3. Be collected in a manner that indicates the student’s consent.

One way to accomplish this is to include a statement and procedures such as the following:

“By entering my name, date, and campus ID number and clicking the ‘continue’ button, I am indicating that I agree to participate in the study as described above, including the release of the specified information from my student record to study researchers by the Office of the Registrar.”

For more information, please contact the Office of Registrar. Initial inquiries can be addressed to data@registrar.wisc.edu.