FERPA—the Family Educational Rights and Privacy Act—is a federal law that protects the privacy of student education records. FERPA compliance is primarily managed by the University Registrar, but the IRB and FERPA overlap when identifiable student records (e.g., class assignments, exams, course rosters, etc.) are used for research purposes.
Below are some examples of common scenarios where IRB and FERPA might intersect, as well as additional Cornell FERPA and student data resources. As always, please reach out to the IRB staff (irbhp@cornell.edu) if you have any questions about your human participant research. You can also learn more about the use of student data on the Registrar’s website, or contact their office at univreg@cornell.edu.
Note: where written consent is mentioned below, this pertains to the FERPA requirement of written consent from a student giving permission for use of their FERPA-protected records. This is different than IRB requirements for written consent. Learn more about the FERPA written consent requirement on the Cornell University Registrar's FERPA FAQs site.
Student Data Use Scenarios:
1. Use of identifiable student grades or test/quiz scores for research purposes
FERPA protected. Written consent is required.
2. Use of identifiable student writing (e.g., Canvas posts, class writing exercises, correspondence about a course) for research purposes
FERPA protected. Written consent is required.
3. Use of de-identified student grades or other student records for research purposes, if obtained from someone who has legitimate access to those data
Not FERPA protected; no FERPA concerns regarding use of data.
IRB Note: Depending on the details and context, this project may still constitute human participant research, and require IRB approval or exemption.
4. Students in a specific class are required to participate in an activity (e.g., complete a survey, participate in a focus group, etc.) as part of the class requirements, and the outcomes/responses will also be used for research purposes
FERPA protected. Written consent is required in order to use the activity outcomes/responses for research purposes.
5. Students in a specific class are invited to participate in optional activities only meant for research purposes (e.g., a survey, a focus group), not to be used for class assignments/grades
Not FERPA protected.
IRB Note: IRB review is still needed for this research.
6. Observation of students’ behavior in the classroom for research purposes
a. The researcher is only watching students and taking notes.
Not FERPA protected, but caution regarding capturing identifiable student characteristics.
b. The researcher wants to record (video or audio) or photograph the students
FERPA protected. Written consent is required.
7. Use of identifiable student records for research purposes after the student has graduated
FERPA protected. Written consent is required.
8. Student course evaluations that will only be used to improve instruction, with no intention to generalize or publish findings
Exempt from FERPA: While considered an educational record, the use of teaching evaluations to improve pedagogy is considered a legitimate educational interest by a University official and is a supported activity under FERPA. Therefore, no additional written consent is required. Caution should be used if results could eventually be broadened to additional external research opportunities.
IRB Note: this activity is not considered “research”, so no IRB review would be needed.
9. Student evaluations of instructors
Not FERPA protected.
10. Use of a class roster to contact and invite students from a specific class to participate in a research project
FERPA protected. In order to avoid the written consent requirement, this could be handled by having the research recruitment email/invitation sent by the class instructor (who has a legitimate educational interest in accessing that FERPA protected information).
Cornell FERPA/Student Data Resources
Learn more about FERPA and how you can access and use student data for research:
- FERPA FAQs
- Use of student data (information and access)
- Annual Privacy Notification under FERPA (found on the Cornell Courses of Study webpage, and highlights information from Cornell Policy 4.5 Access to Student Information)
- University Registrar office contact: univreg@cornell.edu, (607) 255-4232