FERPA coordinates with adjacent + overlapping privacy regimes. (1) COPPA (Children Online Privacy Protection Act, 15 USC 6501-6506 + 16 CFR Part 312) - FTC-administered; applies to online services collecting PII from children under 13; school + ed-tech vendor coordination via the 2014 FTC COPPA + FERPA Joint Statement allowing schools to consent on behalf of parents for educational-use ed-tech (parental notice still required + sole-purpose-of-education-only); (2) PPRA (Protection of Pupil Rights Amendment, 20 USC 1232h + 34 CFR Part 98) - applies to K-12 institutions receiving Department of Education funds + governs surveys + analyses + evaluations of students containing certain protected categories (political affiliations + mental health + sexual behaviour + illegal behaviour + critical appraisals of family relationships + religious practices + family income); (3) STATE STUDENT PRIVACY LAWS - California SOPIPA (Cal. Bus. & Prof. Code 22584-89) + Connecticut Student Data Privacy Act + New York Education Law 2-d + ~20 other states with student data privacy laws often more stringent than FERPA + with state-AG enforcement + private right of action in some states; (4) SECTORAL PRIVACY LAWS - HIPAA (45 CFR Parts 160 + 164) for student health information (special FERPA-HIPAA dual coverage rules under the 2008 Joint Guidance); GLBA (15 USC 6801-6809) for student financial information at postsecondary institutions; Title IX (20 USC 1681-1688) for sex-discrimination + sexual-misconduct records; Clery Act (20 USC 1092(f)) for campus crime statistics; ADA + Section 504 for disability records. NB: FERPA preempts inconsistent state laws that authorize disclosure FERPA prohibits but does NOT preempt MORE-PROTECTIVE state laws.
This control maps to 26 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 26 it maps to, and the evidence behind each claim, over MCP and REST.