Avoid FERPA Trip Mistakes: 3 Exceptions Every U.S. School Admin Needs

FERPA restricts sharing students’ education records on trips unless a specific exception or written consent applies. Three exceptions matter most for travel planning: directory information, the school-official exception, and the health or safety emergency exception. Administrators who limit shared data, secure the right consent, and document every disclosure stay compliant without slowing down trip logistics.

TL;DR:

• Schools can share student information on trips using designated directory information or the school-official exception, but only if proper notice and agreements are in place.
• Disclosures during emergencies are permitted when there is a significant threat, provided the situation is documented and limited to necessary information.
• Photos and videos become education records when maintained by the school for official purposes, requiring explicit opt-out options and clear policies.
• Vendors and third parties can only access student data under written agreements that limit use, specify retention, and prohibit secondary purposes like marketing.
• Collect parental consent for disclosures outside FERPA exceptions, and maintain detailed records of every data sharing and disclosure during the trip.

Table of Contents

• Quick trip-ready FERPA checklist for 2026
• What FERPA covers and when it applies to school trips
• Key FERPA exceptions used during trips, with trip-specific examples
• Photos and videos on trips: practical rules and examples
• Working with travel vendors and third parties under FERPA
• Consent and permission forms: what to collect and how to handle eligible students
• Recordkeeping and required notifications for trip disclosures
• Practical templates, checklists, and resources for trip coordinators
• Donovan’s perspective: balancing privacy and logistics on trips
• How Group Travel Network supports FERPA-aware trip planning
• FAQ
• Sources

Quick trip-ready FERPA checklist for 2026

Before you book a bus or sign a vendor contract, run through the basics. Most FERPA problems on school trips come from skipped paperwork, not bad intentions.

• Designate directory information and publish the opt-out notice before sharing any student names, photos, or rosters with vendors or the public.
• Share only the minimum personally identifiable information (PII) travel vendors need, and back it with a written agreement.
• Collect signed parental consent for any disclosure that falls outside an exception, especially medical details and photo use.
• Build an emergency disclosure protocol in advance and log every health or safety disclosure made during the trip.
• Set a clear photo and video policy with an opt-out field on every permission form.

Pro Tip: Build your disclosure log as a shared spreadsheet before the trip starts, not after a parent asks what was shared.

What FERPA covers and when it applies to school trips

The Family Educational Rights and Privacy Act, codified at 20 U.S.C. § 1232g and implemented through 34 CFR Part 99, is a federal law that applies to any educational agency or institution receiving funds under a program administered by the U.S. Department of Education. That covers virtually every public K-12 school and most postsecondary institutions in the United States, which means FERPA travels with your students the moment they leave campus on a school-sponsored trip.

FERPA gives parents the right to inspect and control disclosure of their child’s education records until the student turns 18 or enrolls in a postsecondary institution, at which point those rights transfer to the student as an “eligible student.” Schools must issue an annual notification explaining these rights, including how to request record access and how to opt out of directory information disclosures.

The statute generally requires written consent before a school discloses personally identifiable information from education records to a third party, unless an exception applies. That requirement does not pause for a field trip. Many trip-related materials qualify as education records: signed medical forms, behavior or discipline notes tied to chaperone decisions, emergency contact sheets, and photos or videos the school keeps and uses for an official purpose. A permission slip filed in a student’s folder, a rooming list distributed to chaperones, or a medical alert shared with a bus company can all fall under FERPA’s definition depending on how the school maintains and uses it. Understanding that scope early saves administrators from treating trip logistics as separate from student records compliance, when in practice they overlap constantly.

Key FERPA exceptions used during trips, with trip-specific examples

Three exceptions do most of the work when schools need to share student information for travel without collecting fresh consent for every disclosure.

1. Directory information. Schools can disclose items they have formally designated as directory information, such as names, grade levels, or participation in extracurricular activities, as long as they have given public notice and allowed parents or eligible students to opt out. This covers things like a printed roster for a performance program or a publicly posted group photo, but only for data elements the school actually designated and only for students who have not opted out.
2. School-official exception. A school may share education records with a contractor, consultant, or volunteer acting as a school official without consent, but PTAC guidance sets four conditions: the party performs an institutional service, meets the criteria in the school’s annual notice, remains under the school’s direct control regarding PII use, and uses the data only for the authorized purpose. A chartered bus company given a rooming list, or a contracted chaperone given a student’s allergy information, generally needs to fit this framework and a written agreement spelling out those limits.
3. Health or safety emergency. Schools may disclose PII without consent when there is an articulable and significant threat to the health or safety of a student or others, and the information is necessary to protect them, according to Department of Education emergency guidance. This exception is meant for actual, impending, or imminent emergencies, not routine convenience, and the school must document the specific threat and who received the information.

These exceptions are narrow by design. A trip coordinator who wants to post a highlight reel to social media, or a vendor who wants a full student roster for marketing, needs something beyond the school-official or directory exceptions, usually written consent.

Photos and videos on trips: practical rules and examples

A photo or video becomes an education record when it is directly related to a student and maintained by the school or by someone acting on the school’s behalf, according to the Department of Education’s photo and video guidance. Context decides the outcome more than the camera does. A professionally shot performance photo that the school keeps in its files and posts to its website is treated differently than a parent’s casual snapshot from the audience.

Photos taken by parents at a public event, like a marching band performance or a graduation ceremony, are not education records unless the school adopts and maintains them for an official purpose, per guidance on when photos become education records. If a parent hands over footage and the school keeps it to document a disciplinary incident, it can become an education record at that point.

For practical policy, schools running trips should:

• Designate official trip photos as directory information where appropriate, with a clear opt-out on the permission form.
• Separate incidental crowd shots from curated, school-maintained images used in newsletters or recruitment materials.
• Set a redaction or access process so a parent who objects to a specific photo has a straightforward way to request removal.

A band director posting a highlight video after a competition should check the opt-out list first, not after the video is already live.

Working with travel vendors and third parties under FERPA

Travel vendors, charter companies, hotels, and contracted chaperones often need some student information to do their jobs, but FERPA treats that sharing as a disclosure unless it fits the school-official exception. The PTAC vendor guidance lays out what that requires in practice: the vendor performs a genuine institutional service, operates under the school’s direct control for how it uses the data, and is limited to the authorized purpose.

That means a written agreement matters as much as the exception itself. Contracts with travel vendors should include:

• A specific list of data elements shared, limited to what the vendor actually needs, such as a name and emergency contact rather than a full student file.
• A prohibition on re-disclosure or secondary use of student data for marketing or any other purpose.
• Security and destruction requirements specifying how long the vendor retains data and how it disposes of it after the trip.
• Notice requirements if the vendor’s data handling policies change during the contract term.
• An audit or review right so the school can confirm the vendor is following the agreement.

Posting contract terms or a plain-language summary of what data a vendor receives, and for how long, builds trust with parents and simplifies internal compliance reviews when a question comes up later. Schools evaluating travel vendors for an upcoming trip should ask about data retention policies before signing, not after.

Consent and permission forms: what to collect and how to handle eligible students

Written consent is the fallback whenever a disclosure does not fit one of FERPA’s exceptions, and trip permission forms are usually where that consent lives. A well-built form does double duty: it authorizes the trip itself and it documents what the school can share, with whom, and why.

• Collect only the PII a trip actually requires: full name, emergency contacts, relevant medical information, and any accommodation needs.
• Include explicit photo and video opt-out language, separate from the general trip consent, so a parent can decline one without declining the other.
• Route sensitive medical information to a limited group of staff and chaperones rather than attaching it to a general roster.
• Specify how long the school retains the form and who can access it after the trip ends.

For students who are 18 or attending a postsecondary institution, FERPA rights transfer directly to the student, meaning the eligible student, not the parent, controls consent and record access. A narrow exception allows schools to disclose records to parents of a dependent student as defined under the Internal Revenue Code, but schools should verify dependent status before relying on it rather than assuming it applies. Building forms that clearly separate parental consent from eligible-student consent, using a compliant minor travel consent form as a starting structure, prevents confusion when a senior class trip includes both 17- and 18-year-old students. Schools can also review guidance on electronic consent for school trips when moving these forms online.

Recordkeeping and required notifications for trip disclosures

FERPA requires schools to maintain a record of each request for access to, and each disclosure from, a student’s education records, with specific requirements depending on the exception used. For trip-related disclosures, that log should note what was shared, with whom, the legitimate interest or exception relied on, and the date.

Annual notifications to parents and eligible students must explain their FERPA rights, including the right to inspect records, request amendment, and opt out of directory information disclosures, and schools should reference this notice whenever a trip-specific disclosure relies on the directory information exception. When a disclosure happens under the health or safety emergency exception, the Department of Education’s emergency guidance specifies that schools must record the articulable and significant threat that justified the disclosure and identify the parties who received the information. That documentation protects the school if a parent later questions why information was shared without prior consent, and it is far easier to produce in the moment than to reconstruct months afterward.

Practical templates, checklists, and resources for trip coordinators

Turning FERPA requirements into daily practice is easier with a short, repeatable set of documents rather than a new policy written for every trip.

• Use a standard student medical form checklist so medical PII collection stays consistent across every trip.
• Run chaperone background checks well ahead of departure and document the results alongside any FERPA-relevant data access each chaperone will have.
• Keep a one-page vendor data-sharing summary listing exactly which fields a bus company, hotel, or tour operator receives.
• Pair every permission form with a plain-language photo and video opt-out section.

Secure document handling matters beyond the trip itself. Guidance on how diploma holders protect documents offers a useful parallel for schools thinking through how to store and secure sensitive student paperwork once a trip wraps up.

Donovan’s perspective: balancing privacy and logistics on trips

Most FERPA friction on school trips comes from over-collecting, not under-protecting. Administrators often gather a student’s full medical history, full address, and extended family contacts when a trip only needs an emergency number and a known allergy. The fix is not more paperwork, it is narrower paperwork: ask only for what a specific trip genuinely requires, and be ready to explain why you asked for it.

Transparency does more work than strict rules. A one-paragraph explanation of what data a vendor receives and why, paired with a real opt-out option, resolves more parent concerns than a dense legal notice ever will. The schools that avoid disputes are the ones that write down their reasoning at the time, not the ones with the thickest policy binder. A short, dated note explaining why a health disclosure was necessary is worth more than a perfect policy nobody can produce on request.

— Donovan

How Group Travel Network supports FERPA-aware trip planning

Running a compliant trip while also managing buses, hotels, and a performance schedule is a lot for one administrator to track. A dedicated trip coordinator can work alongside your staff to manage vendor contracts, coordinate logistics, and keep paperwork organized, which helps reduce gaps between FERPA obligations and actual trip operations.

Centralizing vendor relationships through one organizer also simplifies the oversight FERPA’s school-official exception calls for: fewer separate vendor agreements to track, and one point of contact who understands what data each partner actually needs. Whether you are planning a performance tour, an educational trip, or a senior class trip, Group Travel Network’s coordinators can help you keep medical forms, chaperone records, and vendor contracts consistent from the first planning call to the final day of travel. Reach out to discuss your next trip and see how a dedicated coordinator fits into your existing compliance process.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What information isn’t protected by FERPA?

FERPA protects education records, not every piece of information a school holds about a student. Directory information properly designated and disclosed under an opt-out notice is not restricted the same way, and observations a school official makes personally, without consulting a record, generally fall outside FERPA’s scope.

What are some common examples of FERPA violations on trips?

Common mistakes include sharing a full student roster with a vendor that does not need it, posting identifiable trip photos without checking the opt-out list, or handing medical details to chaperones without a documented need. Each of these skips the written agreement or consent FERPA requires outside its exceptions.

What exceptions exist under FERPA for school trips?

The three most relevant exceptions are directory information, the school-official exception for vendors and contracted staff, and the health or safety emergency exception, each detailed in Department of Education guidance. Each exception has specific conditions that must be met before a school can disclose information without separate written consent.

Is FERPA a state or federal law?

FERPA is a federal law, codified at 20 U.S.C. § 1232g, and it applies to any educational agency or institution that receives funding through a U.S. Department of Education program. States and individual schools can add their own privacy requirements, but FERPA sets the federal floor nationwide.

Does FERPA apply to international school trips?

Yes. FERPA applies based on the school’s status as a funding recipient, not the trip’s location, so the same consent, exception, and recordkeeping rules apply whether the group travels domestically or on an international trip.

Recommended

• Student Medical Forms For School Trips: Checklist And Templates
• Electronic Consent For School Trips: 2026 Compliance Guide
• Field Trip Organization Tips: A School Administrator’s Guide