Some advocates have argued that FERPA’s exceptions undercut the law’s protections by allowing for indiscriminate sharing of student data without consent, but this perception is often inaccurate. FERPA requires additional safeguards to be employed when an exception to its consent requirement is used to disclose student PII to third parties. While each exception is different, they typically mandate that information shared under an exception:  Can only be used for a specific educational purpose; Can only be shared with the people who need it, and then those people cannot reshare it; and Must be under the direct control of the school– meaning that school staff must be able to access, delete, and share the information, and the person receiving the data cannot act without permission from the school. Often, this control is provided through a contract. To learn about all of FERPA’s exceptions and data that is exempt from FERPA, see the charts below.