FERPA coordinates with adjacent + overlapping privacy regimes. (1) COPPA (Children Online Privacy Protection Act, 15 USC 6501-6506 + 16 CFR Part 312) - FTC-administered; applies to online services collecting PII from children under 13; school + ed-tech vendor coordination via the 2014 FTC COPPA + FERPA Joint Statement allowing schools to consent on behalf of parents for educational-use ed-tech (parental notice still required + sole-purpose-of-education-only); (2) PPRA (Protection of Pupil Rights Amendment, 20 USC 1232h + 34 CFR Part 98) - applies to K-12 institutions receiving Department of Education funds + governs surveys + analyses + evaluations of students containing certain protected categories (political affiliations + mental health + sexual behaviour + illegal behaviour + critical appraisals of family relationships + religious practices + family income); (3) STATE STUDENT PRIVACY LAWS - California SOPIPA (Cal. Bus. & Prof. Code 22584-89) + Connecticut Student Data Privacy Act + New York Education Law 2-d + ~20 other states with student data privacy laws often more stringent than FERPA + with state-AG enforcement + private right of action in some states; (4) SECTORAL PRIVACY LAWS - HIPAA (45 CFR Parts 160 + 164) for student health information (special FERPA-HIPAA dual coverage rules under the 2008 Joint Guidance); GLBA (15 USC 6801-6809) for student financial information at postsecondary institutions; Title IX (20 USC 1681-1688) for sex-discrimination + sexual-misconduct records; Clery Act (20 USC 1092(f)) for campus crime statistics; ADA + Section 504 for disability records. NB: FERPA preempts inconsistent state laws that authorize disclosure FERPA prohibits but does NOT preempt MORE-PROTECTIVE state laws.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.