The Man Behind the Curtain: College Admissions and FERPA RequestsAspiring college students spend enormous amounts of time trying to unlock the magic formula that leads to those magic words: Congratulations, you’ve been accepted! But, for many students, the focus on admissions does not stop once they matriculate.

Starting in 2015, schools such as Harvard, Yale, Penn, and Stanford saw a dramatic uptick in students requesting to view their admissions records under the Family Educational Rights and Privacy Act (FERPA). Pursuant to FERPA, a student may request, and an educational institution must disclose, any of that student’s “educational records.” Attempting to discern the black box of elite college admissions, students requested to see their admissions records by the hundreds. Colleges and universities were not only inundated by these requests but also had to figure out what, exactly, do we have to disclose?

When is disclosure required?

Under FERPA, a student’s admission record only becomes an “educational record” that requires disclosure if the student matriculates at the university. Students who are not accepted to the university, or who are accepted and do not enroll, are not covered by FERPA. This means that students hoping to get a glimpse into why they were rejected by their top school will be unable to gain access to those records. However, if a student matriculates and then later requests access to their admission records, the college or university must comply within 45 days.

Some universities have gone so far as to change their retention policies, deleting all admission records once they have “served their purpose” in order to avoid the headache of complying with hundreds of FERPA admissions requests every month and to avoid the potential of releasing their admissions formula to the public. While the deletion of records no longer needed or required is generally good policy for privacy and data security reasons, it is not necessary to stay FERPA compliant. Instead, schools should have a well-written policy regarding retention of admission records as a part of an overall privacy strategy. However, if schools choose to retain admission records, students may access those records vis-à-vis FERPA requests.

What needs to be disclosed?

Understandably, professors and teachers are nervous about the idea of their private comments regarding a student’s suitability for admission being revealed to that student. Some administrators have even wondered if they could redact these records so as not to disclose teacher names. Thus, a question that has emerged from these situations is do schools have to disclose the names of educators who have made recommendations or otherwise “scored” the students’ applications?

As is normally the case in the legal world, it depends. However, we’ve provided some guidance below to help you navigate some of these questions.

Letters of Recommendation

There are the typical letters of recommendation from teachers and professors that accompany any application (undergrad or beyond) to a university program. Students are given the option during the application process to waive their rights to view these recommendations – and most do. This means that any recommendation or letter that accompanied that student’s application will not be disclosed under a later FERPA request. However, if the student does not waive that right, those recommendations would be disclosed so long as they are maintained as part of the “educational records” on file.

Application Scores and Notes

More importantly for universities and colleges, there are often notes from prospective professors and educators who regularly evaluate applications. This means that a student’s favorite English professor may have, unbeknownst to her, indicated on her admissions application that her “test scores are low” or that her writing is “average.” Understandably, teachers are worried about students requesting and viewing these types of notes. This has led to questions about whether a school can “redact” a teacher’s identity in this scenario. The short answer is probably not. FERPA does not explicitly touch on this point but it does provide for redaction in certain scenarios. Those scenarios are mostly limited to instances where the “educational records” included aggregate student information. In that situation, a school must redact the information of other students included in the record before disclosing it to the requesting student. It can be inferred from FERPA’s reasoning here that a redaction, if any, should be made to protect the privacy rights of the student, not the faculty. As tempting as it may be to redact teacher names, it is likely not FERPA compliant.


If a school is nervous about the amount and type of admissions information that could be accessed by students making FERPA requests, that school should make sure it is intentional about its admission records retention policy. Which records are retained? For how long? For what use? If retaining teacher “scores” is important or desirable, the school should be prepared to disclose those scores and the names of the teachers making them in the event of a FERPA request. If those scores aren’t valuable for the school’s records, or the school is worried about releasing its admissions “formula,” the school should consider deleting them altogether as a part of its retention policy. One note of warning, though: If a school chooses to delete or not retain these types of records, it must do so across the board. Deleting records in response to FERPA requests would be a clear violation of the law. Subscribe to Bradley’s privacy blog Online and On Point for additional updates and alerts regarding privacy law developments.