{"site":{"name":"Koji","description":"AI-native customer research platform that helps teams conduct, analyze, and synthesize customer interviews at scale.","url":"https://www.koji.so","contentTypes":["blog","documentation"],"lastUpdated":"2026-07-28T13:23:32.216Z"},"content":[{"type":"documentation","id":"a37e2849-7ddb-485d-9ccd-c7af0305daa0","slug":"ferpa-compliant-user-research","title":"FERPA-Compliant User Research: Interviewing Students, Parents, and Educators","url":"https://www.koji.so/docs/ferpa-compliant-user-research","summary":"FERPA governs education records held by schools receiving US Department of Education funds; it does not automatically cover feedback a student gives a vendor directly. Vendors access record data through the school official exception (34 CFR 99.31(a)(1)), which requires direct district control, strict purpose limitation, and no redisclosure. PPRA is the law that most often catches research: it governs surveys touching eight protected areas including mental or psychological problems and illegal or self-incriminating behaviour, requiring prior written parental consent for ED-funded surveys and notice plus opt-out otherwise. COPPA applies in parallel for under-13s, and roughly forty state student-privacy statutes bind vendors directly. Classify each study by three questions: education records, PPRA areas, under-13 participants. Koji reduces burden through asynchronous link-based AI interviews, six structured question types that bound what students can disclose, no human moderator, and easy access to teacher and parent populations that carry no FERPA or PPRA burden.","content":"## The short answer\n\n**FERPA governs education records held by a school. It does not automatically govern feedback a student gives you directly.** That single distinction decides most edtech research questions — and most teams get it backwards, assuming FERPA blocks everything or that it does not apply to them at all.\n\nIf you are an edtech company interviewing students, three laws matter and they trigger differently:\n\n- **FERPA** (20 U.S.C. 1232g; 34 CFR Part 99) applies when you touch **education records** — grades, enrolment, disciplinary files — held by a school receiving US Department of Education funds. Access usually flows through the **school official exception**, not through consent.\n- **PPRA** (20 U.S.C. 1232h) applies when you **survey students** on any of eight protected topics. This is the one that actually catches research, and almost nobody plans for it.\n- **COPPA** applies to any child under 13 online, school or no school. It runs in parallel and does not care whether FERPA applies.\n\nGet the trigger analysis right and student research becomes routine. Get it wrong and you either block valuable research unnecessarily or run a study your district partner has to shut down.\n\n## What FERPA actually covers\n\nFERPA requires schools and educational agencies receiving ED funds to obtain **written consent** from the parent — or from the \"eligible student,\" meaning one who is 18 or attending a postsecondary institution — before disclosing personally identifiable information from education records.\n\nTwo limits matter enormously for researchers:\n\n1. **FERPA binds the school, not you.** It is a funding condition on educational institutions. As a vendor you inherit obligations contractually, through the school official exception and your data agreement — not directly by statute.\n2. **It covers education records specifically.** An education record is information directly related to a student and maintained by the institution. A student's answers in a product-feedback interview you conducted are not an education record simply because the student attends a school.\n\nSo a study where you interview students about your app's onboarding — no grades, no enrolment data, no roster pulled from the school's SIS — often sits **outside FERPA entirely** while still sitting squarely inside PPRA and COPPA.\n\n### The school official exception\n\nWhen you do need roster or record data — to sample properly, to segment by grade level, to reach a specific cohort — the practical route is 34 CFR 99.31(a)(1). A vendor can be treated as a \"school official with a legitimate educational interest\" when the district has determined that you:\n\n- perform an institutional service or function the district would otherwise do itself;\n- are **under the direct control** of the district with respect to use and maintenance of the data;\n- use the information **only** for the purpose for which the disclosure was made; and\n- do **not redisclose** the information without authorisation.\n\nThe clause that ends most research ambitions is the third. \"Only for the purpose for which the disclosure was made\" means roster data handed over to run a district-commissioned evaluation cannot be quietly reused to recruit for your own product research. If you want both, get both in the agreement up front.\n\nThe district must also have specified the criteria for legitimate educational interest in its **annual FERPA notification**. Ask to see it. If your use case is not describable within that notice, the exception is not available to you.\n\n### Directory information\n\nSome data — name, grade level, dates of attendance, email address, participation in activities — can be designated **directory information** and disclosed without consent, provided the school gives public notice of what it designates and a reasonable period to opt out. Directory information is a legitimate recruiting channel for research, but it is narrower than people assume and every district designates a different subset. Never assume; ask for the district's current designation in writing.\n\n## PPRA: the law that actually catches research\n\nThis is the section to read twice. PPRA governs the administration of any **survey, analysis, or evaluation** to students that concerns one or more of eight protected areas:\n\n| # | Protected area |\n|---|---|\n| 1 | Political affiliations or beliefs of the student or parent |\n| 2 | Mental or psychological problems of the student or family |\n| 3 | Sex behaviour or attitudes |\n| 4 | Illegal, anti-social, self-incriminating, or demeaning behaviour |\n| 5 | Critical appraisals of others with whom the student has a close family relationship |\n| 6 | Legally recognised privileged relationships (lawyers, physicians, ministers) |\n| 7 | Religious practices, affiliations, or beliefs of the student or parent |\n| 8 | Income, other than as required to determine programme eligibility |\n\n**If the survey is funded by the US Department of Education and touches any of the eight, prior written parental consent is required** — active consent, meaning a signed form returned before the student participates. For surveys not funded by ED, districts must generally provide notice and an **opt-out** opportunity instead.\n\nResearchers walk into area 2 and area 4 constantly without noticing. \"How do you feel when you fall behind your classmates?\" is a wellbeing question. \"Have you ever shared your login with another student?\" invites a self-incriminating answer about policy violation. Neither reads like a protected-area survey when you draft it; both are.\n\n**Practical rule: run your question list against the eight areas before fielding, not after.** It takes ten minutes and it is the single highest-value compliance step in student research.\n\n### State law sits on top\n\nRoughly forty states have enacted student-privacy statutes since 2014, California's SOPIPA being the model many followed. These commonly prohibit targeted advertising to students, selling student data, and building non-educational profiles — and they bind the **vendor directly**, unlike FERPA. Check the states your districts operate in; a FERPA-clean study can still violate a state statute.\n\n## A compliant workflow for edtech research\n\n**1. Classify the study.** Answer three questions in writing: Am I touching education records? Am I asking about any of the eight PPRA areas? Is any participant under 13? Those three answers determine everything downstream.\n\n**2. Pick your access route.** Direct recruitment with parental consent, district-mediated recruitment under the school official exception, or directory-information outreach. Do not mix routes in one study without documenting each.\n\n**3. Get consent and assent right.** Parental consent is the legal permission; **assent** is the child's own willing agreement, and you need both. Assent language must be age-appropriate — a 9-year-old cannot meaningfully agree to a paragraph written for adults.\n\n**4. Screen your questions against PPRA.** Rewrite anything landing in a protected area, or escalate to active consent.\n\n**5. Minimise at the point of collection.** Do not collect the student's full name if a pseudonymous ID answers your research question. Do not collect school name if grade band suffices.\n\n**6. Interview educators and parents too.** They sit outside FERPA and PPRA entirely and often hold the answers you need. Teacher and administrator interviews are the fastest legitimate path to insight in K-12 — and the buying committee lives there anyway.\n\n**7. Set retention before you start.** Short, artefact-specific retention is both a compliance mitigation and an operational simplification.\n\n## Where Koji fits\n\nStudent research is bottlenecked by consent logistics and scheduling, not by willingness to participate. Koji removes most of that friction while keeping the compliance surface small.\n\n**Asynchronous, link-based interviews.** Participants join an [AI-moderated interview](/docs/how-ai-interviewers-work) by text or voice through a shared link, at a time a parent can supervise. No scheduling, no moderator calendar, no classroom time surrendered. For parent-mediated research with minors, the supervised-at-home pattern is far easier to run than a live session.\n\n**Structured questions keep you inside the lines.** Koji supports six question types — open_ended, scale, single_choice, multiple_choice, ranking, and yes_no. In student research this matters more than in any other vertical: a `scale` or `single_choice` question collects a bounded value, so a nine-year-old cannot volunteer a family disclosure into a free-text box you then have to handle. Reserve `open_ended` for topics where you genuinely need narrative, and let the AI probe within scope. See the [structured questions guide](/docs/structured-questions-guide).\n\n**No human moderator, fewer people exposed to raw disclosures.** Traditional student research puts a moderator, a notetaker, and often observers in the room with a child. Koji's AI runs the session and produces aggregate analysis, which shrinks both the privacy surface and the safeguarding burden.\n\n**Speed that matches the academic calendar.** Edtech research has brutal timing — you get a window before term starts, or the weeks around renewal, and nothing in between. A traditional study with district approval, scheduling, and manual analysis does not fit those windows. Studies that run asynchronously and [report automatically](/docs/how-to-automate-user-research) do, which is often the difference between evidence-based roadmap decisions and guessing until next semester.\n\n**Reach the adults at scale.** Teacher, administrator, and parent research carries none of the FERPA or PPRA burden, and Koji's model — hundreds of conversational interviews in parallel rather than a dozen scheduled calls — fits that population particularly well. See [AI research for edtech](/docs/ai-research-for-edtech) for the wider vertical playbook.\n\n## Common mistakes\n\n1. **Assuming FERPA applies to everything.** Direct product feedback from a student is usually not an education record. Do the classification.\n2. **Assuming FERPA applies to nothing because you are a vendor.** The moment roster or record data reaches you, the school official exception and its purpose limitation bind you contractually.\n3. **Missing PPRA entirely.** It is the likeliest trigger in real research and the least known.\n4. **Reusing district-provided data for a second purpose.** Explicitly prohibited by the exception.\n5. **Collecting consent but not assent.** Both are required when working with minors.\n6. **Ignoring state student-privacy statutes**, which bind vendors directly where FERPA does not.\n\n## Related Resources\n\n- [User Research With Children and Teens](/docs/user-research-with-children-teens) — COPPA, parental consent, and assent in depth\n- [AI Research for EdTech](/docs/ai-research-for-edtech) — the vertical playbook for education products\n- [Student Satisfaction Survey Guide](/docs/student-satisfaction-survey-guide) — question sets for the education sector\n- [Structured Questions Guide](/docs/structured-questions-guide) — the six question types and why they minimise collection\n- [Research Consent Form Templates](/docs/research-consent-form-templates) — consent and assent language you can adapt\n- [HIPAA-Compliant AI User Research](/docs/hipaa-compliant-ai-user-research) — the parallel playbook for healthcare\n- [DPIA for User Research](/docs/dpia-user-research) — risk assessment when EU participants are involved\n- [Research Data Retention and Deletion](/docs/research-data-retention-deletion) — setting the retention schedule your agreement promises","category":"Research Operations","lastModified":"2026-07-27T03:15:48.908353+00:00","metaTitle":"FERPA-Compliant User Research: Student Interviews Guide (2026)","metaDescription":"How FERPA, PPRA, and state student-privacy laws apply to edtech research. The school official exception, the eight PPRA protected areas, consent vs assent, and a compliant workflow.","keywords":["ferpa compliant user research","ferpa edtech research","student research privacy","ppra protected areas survey","school official exception","interviewing students research","edtech user research compliance","student data privacy vendor","parental consent student survey","ferpa vs coppa"],"aiSummary":"FERPA governs education records held by schools receiving US Department of Education funds; it does not automatically cover feedback a student gives a vendor directly. Vendors access record data through the school official exception (34 CFR 99.31(a)(1)), which requires direct district control, strict purpose limitation, and no redisclosure. PPRA is the law that most often catches research: it governs surveys touching eight protected areas including mental or psychological problems and illegal or self-incriminating behaviour, requiring prior written parental consent for ED-funded surveys and notice plus opt-out otherwise. COPPA applies in parallel for under-13s, and roughly forty state student-privacy statutes bind vendors directly. Classify each study by three questions: education records, PPRA areas, under-13 participants. Koji reduces burden through asynchronous link-based AI interviews, six structured question types that bound what students can disclose, no human moderator, and easy access to teacher and parent populations that carry no FERPA or PPRA burden.","aiPrerequisites":["Basic understanding of US student privacy terminology","A defined edtech research question"],"aiLearningOutcomes":["Determine whether FERPA, PPRA, COPPA, or state law applies to your study","Use the school official exception correctly and respect its purpose limitation","Screen interview questions against the eight PPRA protected areas","Distinguish parental consent from child assent","Design student research that minimises collected data"],"aiDifficulty":"intermediate","aiEstimatedTime":"12 min read"}],"pagination":{"total":1,"returned":1,"offset":0}}