Published: Aug. 23, 2017
The protection of student privacy is everyone's responsibility. The Family Education Rights and Privacy Act (FERPA) of 1974 and the University of Colorado Boulder have set forth guidelines related to the disclosure of and access to student education records maintained by the university.
FERPA protections go into effect for new, incoming Fall 2017 students on Monday, Aug. 28, 2017.
Education Records
Any record that directly relates to a student and is maintained by the institution (regardless of storage medium) is classified as an education record. Education records include two types of information:
  • Directory information may generally be disclosed to a third party without the written consent of the student, as long as the student hasn't established full privacy. This information includes items such as student name, campus email address, majors and minors, and participation in officially recognized activities or sports (see Directory Information for a complete list).

Note: Effective Fall 2017, student address and phone number are no longer considered directory information at the University of Colorado. As such, documented student consent must be provided to disclose this information to anyone who doesn't have a legitimate educational interest.

  • Nondirectory information is personally identifiable information that may not be disclosed to anyone, including parents, without student consent. School officials, including faculty and staff, may not access nondirectory information unless they have a legitimate educational interest. This includes sensitive information, such as SSNs, grades and financial information.
Letters of Recommendation
Any disclosure of nondirectory student information (e.g., class performance, grades, abilities, background) to a third party in letters of recommendation or reference calls requires prior documented consent from the student. For full details and a student release form, see Student Recommendations: Written and Oral.
Student Privacy Options & University Business Practices
  • Security Passphrase: The required method for verifying the identity of a student who cannot present photo ID or who is contacting the university by phone is to ask the student to correctly state their established security passphrase. For more information, see Security Passphrase Business Practices.
  • FERPA Consent to Release: This online consent form is available through MyCUInfo. To confirm that a student has authorized release of their protected information to a third party, see Verifying FERPA Consent to Release.
  • CU Guest Access: This option allows students to grant read-only online education-record access to a third party. If a student has established CU Guest Access for a third party, but not FERPA Consent to Release, you cannot release any FERPA-protected information to the third party. See Privacy Settings FAQs.
  • Full Privacy: A student may restrict the release of their directory information by submitting a nondisclosure form for full privacy. Students who have restricted release of their directory information are identified in Campus Solutions with a red "PRIVATE" message. If asked for information about a student who has a full-privacy indicator on their record, school officials must tell the requestor, "I have no information about this person."
Don't hesitate to contact our office with questions or requests for training in your department. Additional FERPA information is available on the Office of the Registrar and U.S. Department of Education websites.
Office of the Registrar
University of Colorado Boulder
20 UCB
Boulder, CO 80309
Phone: 303-492-6970
Fax: 303-492-8748
Follow us @CUBoulder