⚖️ Compliance & Data Privacy

Does FERPA Apply to Your Preschool or Daycare?

Four kinds of early childhood program, four different answers. How to tell which child-records law actually governs your center — and the records habits that keep you safe either way.

By Eshan de Silva · October 25, 2026 · 8 min read

It usually arrives as an email that sounds more official than it is. A parent in a custody dispute wants "the complete FERPA file." A kindergarten registrar asks you to send records under FERPA. A software vendor puts "FERPA compliant" on its pricing page. And somewhere in there a director types the real question into Google at 10pm: does FERPA even apply to us?

For most preschools and childcare centers the answer is no — and the reason is more useful than people expect. FERPA is not a general privacy law for anyone who teaches young children; it is a condition attached to a specific pot of federal money. Once you know which bucket your program sits in, you know which rulebook you are working from.

FERPA follows Department of Education money

The Family Educational Rights and Privacy Act attaches to institutions that take a particular kind of federal funding. The U.S. Department of Education's own guidance on which agencies and institutions FERPA applies to puts it plainly: the law covers entities that receive funds from programs administered by the U.S. Department of Education, which in practice means public schools, school districts (what the law calls local educational agencies), and colleges and universities. Private elementary and secondary schools generally do not receive that funding, and so are generally not subject to FERPA at all.

Notice what is not in that test: the age of the children, whether you call yourself a school or a center, or how detailed your developmental records are. A tuition-funded preschool with beautiful learning portfolios is outside FERPA. A district-run pre-K classroom down the street with far less paperwork is inside it.

Find your bucket

Nearly every early childhood program falls into one of four situations. Work out which is yours before you write a single policy.

• 1. Private, tuition-funded center or preschool. The great majority of licensed centers, and FERPA almost certainly does not apply. Your obligations come from California licensing rules, state confidentiality and breach-notification law, COPPA, your app vendor contracts, and the enrollment agreement families signed.
• 2. Head Start or Early Head Start. Head Start is funded through the U.S. Department of Health and Human Services, not the Department of Education, so FERPA is not your rulebook — but you have a detailed one of your own, described in the next section.
• 3. A classroom operated by a public school district. District pre-K and transitional kindergarten sit inside a local educational agency that receives Department of Education funds, so records created there are education records under FERPA — and in California also pupil records under the Education Code (section 49060 and following).
• 4. A blend. A private program with a subsidized classroom, a shared site, or a contract with a Head Start grantee. These cause the most trouble, because two sets of records with two sets of rules end up in the same cabinet and the same software.

If you are in bucket four, the most valuable hour you will spend this quarter is drawing the line: which records belong to which program, who holds the master copy, who may see it, and what the grantee or district requires in writing. One shared folder both programs can browse is a problem you will not notice until someone asks.

What Head Start programs actually have to do

Head Start's privacy rules live in 45 CFR Part 1303, Subpart C, and they are stricter than most people assume. The operational shape:

• Written consent before disclosure, and the consent has to be specific. Before sharing personally identifiable information from a child record, the program needs the parent's signed and dated written consent naming what will be disclosed, why, and to whom. Parents must be told consent is voluntary and revocable — though revoking it does not undo a disclosure already made.
• Transfers get notice, not silence. When records are forwarded to a program or school where the child is enrolling or transferring, the program must notify the parent and give them a chance to challenge and refuse the disclosure first.
• A short list of exceptions. Records may be shared without consent only in defined situations — program officials and contractors delivering Head Start services under oversight, audits and evaluations, approved studies, health or safety emergencies, court orders and subpoenas (with a reasonable effort to notify the parent first), child welfare caseworkers, and suspected child maltreatment.
• Paperwork with a heartbeat. Written agreements covering disclosures must be reviewed annually and updated as needed, parents must get a written notice of their rights every year, and every disclosure is limited to the information actually necessary for its purpose.

That last point is the one that quietly fails. "Minimum necessary" means you do not email the whole child file because someone asked one question, and you do not give a contractor standing access to every record because it was simpler to set up that way.

"FERPA doesn't apply" is not the same as "no rules apply"

This is the trap. A director reads that private centers are outside FERPA, feels relieved, and stops reading. For a private California center the real constraints are:

• Licensing. Each child's record must be complete, current, confidential, and available to the parent and to licensing staff. The CDSS Child Care Licensing Division is who actually shows up, and a records problem is a licensing problem.
• California breach notification. If unencrypted personal information about families is exposed, you generally have to tell them. Our guide to notifying parents after a daycare data breach walks through what that notice has to say.
• COPPA. Once an app collects information from children under 13, federal rules enforced by the FTC are in scope — and your center is usually the one handling consent. See COPPA compliance for childcare apps.
• Your own promises. Whatever your handbook and enrollment agreement say about confidentiality is enforceable against you. Many centers promise more than their systems deliver.

The companion question — whether HIPAA covers your immunization and medication files — has a similar shape and a similar answer, unpacked in does HIPAA apply to daycares in California.

The records request that really shows up

In the real world the FERPA question arrives as one of three moments, and one page solves all three. A kindergarten asks for a child's file. A parent going through a separation asks for everything you hold, and the other parent calls an hour later to object. A licensing analyst asks to see three records and you are not sure the digital and paper copies agree.

None of those needs a lawyer on speed dial. They need you to have decided in advance who may request records, who fulfills the request, how fast, what gets released, what stays internal, and where the release log lives — date, child, what was shared, with whom, under what authority. Head Start programs need something close to this anyway; everyone else just sleeps better.

Five controls that satisfy whichever law applies

Here is the practical gift: the technical work barely changes between buckets. Get these five right and you are in good shape whether FERPA, Head Start rules, or California licensing is the authority.

• Know where child records live. Not "in the system" — actually enumerate it: the childcare app, the shared drive, the enrollment inbox, the director's laptop, the tablet in the toddler room, the filing cabinet, the old laptop in the closet. You cannot protect or produce what you never inventoried. SenAsset keeps that device list inside Microsoft Teams, so "which tablet had the enrollment files?" always has an answer.
• Give people the least access that lets them do their job. Teachers need the safety essentials for their own classroom; administrators need full files. Almost nobody needs everything about every child, and most childcare platforms support that split once someone configures it.
• Keep the consent trail with the record. Signed photo permissions, app consents, release authorizations — stored next to the child's file, not in someone's inbox. A consent you cannot find is a consent you do not have.
• Encrypt devices and require multi-factor authentication. Full-disk encryption on every laptop and tablet; MFA on email, the childcare app, and cloud storage. This is the highest-value hour in the list, and California's breach-notification duty turns on whether exposed data was encrypted.
• Retain deliberately, then destroy. Decide how long each record type is kept, keep it available that long, then shred or securely wipe it. Records you no longer need are pure liability.

If your records are still mostly paper, our paperless guide for California daycares is the right next read. And if configuring role-based access, encryption, and MFA across a center full of devices is not a job anyone on staff has time for, that is exactly what EDCON's managed IT services for childcare centers handle for programs in Los Angeles, Oxnard, Ventura, and Azusa.

The bottom line

FERPA is a funding condition, not a general law about young children. If your program is privately funded it almost certainly does not apply, and your attention belongs on licensing, breach notification, COPPA, and the promises in your own handbook. If you are Head Start, your rules are in 45 CFR Part 1303 Subpart C and are more demanding than FERPA in places. If a district operates your classroom, FERPA and California pupil-records law both apply. And if you are a combination, write the boundary down this week. In every case the work on the ground is identical: know where the records are, limit who can reach them, keep consents with the files, encrypt everything, and be able to produce a clean copy when someone asks.

Common questions from childcare directors