• Skip to content

f3_law_logo

Client Alert

US Department of Education Finds CDE Violated FERPA by Enforcing Laws Prohibiting Gender Identity Disclosure

Jan 30, 20263 minute read

On January 28, 2026, the United States Department of Education (“DOE”) issued a press release informing the public of its Student Privacy Policy Office’s (“SPPO”) finding that the California Department of Education (“CDE”) violated the  Family Educational Rights and Privacy Act (“FERPA”).  According to SPPO, CDE violated FERPA by enforcing California laws that block school staff from informing parents of a student’s decisions regarding changes to their gender identity.

This finding is the result of an investigation that has been ongoing since March of 2025, which focused on California’s Support Academic Futures and Educators for Today’s Youth (“SAFETY”) Act.  The SAFETY Act prohibits school districts from enacting or enforcing policies that require employees to reveal information about students’ sexual orientation, gender identity, or gender expression to any other person without the pupil’s consent, unless otherwise required by state or federal law.  Supporters of the Act call revealing this information without student consent “forced outing,” or forcing a student to “come out of the closet” with regard to their sexual orientation or gender identity.  According to SPPO, by enforcing this law, CDE was violating parents’ rights to access their child’s education records under FERPA.  The press release also identified undisclosed “gender support plans” as a FERPA violation. 

This finding is consistent with the current administration’s ongoing effort to invalidate the SAFETY Act.  It also follows a recent District Court injunction in Mirabelli v. Olson which prohibited the enforcement of several California laws, regulations, and guidance documents to prevent school employees from informing parents of children’s gender identity and presentation at school.  The injunction has been blocked by the Ninth Circuit, and the Supreme Court has been asked to weigh in on the issue.

The DOE SPPO investigation highlights the tension between student’s right to privacy amidst apprehension that some parents may punish children for being LGBTQ, and concerns about parents’ rights to information involving their children and that schools are undermining their role as parents to impart values about matters such as gender and sexuality.

SPPO provided a list of actions for CDE to take to resolve the issue:

  • Issuing a notice to all superintendents and administrators informing them that “gender support plans” or other related documentation that is directly related to a student are considered education records under FERPA and are subject to parental inspection upon request;
  • Publicizing that there is no “unofficial records” exception to FERPA and further notifying superintendents and administrators that AB 1955, as well as any other California laws, regulations, or policies, should not be interpreted to undermine or contradict federal law, and that violations of FERPA risk loss of federal financial assistance;
  • Providing written assurance to SPPO that CDE will allow [Local Education Agencies (“LEAs”)] to enforce FERPA regarding “gender identity” and pro-parental notification approaches in a manner that aligns with the needs of the districts to ensure compliance;
  • The CDE must also have the LEAs certify they understand and are in compliance with FERPA; and
  • Adding FERPA training content that is approved by SPPO to the California Education Code (EC) Section 218.3(b)(1)’s LGBTQ cultural competency training for teachers and other certificated employees.

These actions apply to CDE, not to individual districts.

We urge California school districts to speak with their legal counsel regarding whether and how the finding impacts their current practices.  F3 will issue updates on this finding, the State of California’s response, and the issue of parental notification regarding gender identity in general as the situation evolves.

If you have questions about this Client Alert, please contact one of the authors listed below or the F3 attorney with whom you normally consult.

This F3 Client Alert is a summary only and not legal advice. We recommend that you consult with legal counsel to determine how this legal development may apply to your specific facts and circumstances.

Share this page

Professionals

  • Media item displaying: Howard J. Fulfrost

    Howard J. Fulfrost

    Partner

    Los AngelesSeattleDes Moines
    323.330.6303 323.330.6303
    hfulfrost@f3law.com

  • Media item displaying: Alicia “Ali” Arman Brown

    Alicia “Ali” Arman Brown

    Associate

    Oakland
    510.550.8227 510.550.8227
    aarmanbrown@f3law.com

View All US Department of Education Finds CDE Violated FERPA by Enforcing Laws Prohibiting Gender Identity Disclosure Professionals

Related Services

  • Governance & Leadership

Related Clients

  • Public Education K-12
  • Community Colleges
Fagen Friedman & Fulfrost LLP
Get the latest F3 Insights and Invitations
Sign-up Now
Contact Us
  • © 2026 Fagen Friedman & Fulfrost LLP
  • Disclaimer
  • Privacy Policy
  • Sitemap
Site by
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
Do not sell my personal information.
Cookie SettingsAccept
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
__cf_bm30 minutesThe cookie contains information related to the calculation of Cloudflare’s proprietary bot score and, when Anomaly Detection is enabled on Bot Management, a session identifier
algoliasearch-client-js1 yearNecessary in order to optimize the web site's search-bar function . The cookie ensures accurate and fast search results.
AWSELB1 yearUsed to distribute traffic to the website on several servers in order to optimise response times.
AWSELBCORS1 yearRegisters which server-cluster is serving the visitor. This is used in context with load balancing, in order to optimize user experience.
CONSENT1 yearUsed to detect if the visitor has accepted the marketing category in the cookie banner. This cookie is necessary for GDPR-compliance of the website.
cookielawinfo-checkbox-advertisement1 yearUsed to detect if the visitor has accepted the marketing category in the cookie banner. This cookie is necessary for GDPR-compliance of the website.
cookielawinfo-checkbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
JSESSIONID1 yearPreserves users states across page requests.
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
CookieDurationDescription
_ga1 yearRegisters a unique ID that is used to generate statistical data on how the visitor uses the web site.
_ga_#1 yearUsed by Google Analytics to collect data on the number of times a user has visited the web site as well as dates for the first and most recent visit.
_gat1 yearUsed by Google Analytics to throttle request rate.
_gid1 yearRegisters a unique ID that is used to generate statistical data on how the visitor uses the web site.
collect1 yearUsed to send data to Google Analytics about the visitor's device and behavior. Tracks the visitor across devices and marketing channels.
NRBA_SESSION1 yearCollects data on the user’s navigation and behavior on the website. This is used to compile statistical reports and heatmaps for the website owner.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
CookieDurationDescription
LAST_RESULT_ENTRY_KEY1 yearUsed to track user’s interaction with embedded content.
LogsDatabaseV2:V#||LogsRequestsStore1 yearUnclassified
nextId1 yearUsed to track user’s interaction with embedded content.
remote_sid1 yearNecessary for the implementation and functionality of YouTube video-content on the website.
requests1 yearUsed to track user’s interaction with embedded content.
TESTCOOKIESENABLED1 yearUsed to track user’s interaction with embedded content.
VISITOR_INFO1_LIVE1 yearUnclassified
VISITOR_PRIVACY_METADATA1 yearUnclassified
YSC1 yearUnclassified
yt-remote-cast-available1 yearStores the user's video player preferences using embedded YouTube video
yt-remote-cast-installed1 yearStores the user's video player preferences using embedded YouTube video
yt-remote-connected-devices1 yearStores the user's video player preferences using embedded YouTube video
yt-remote-device-id1 yearStores the user's video player preferences using embedded YouTube video
yt-remote-fast-check-period1 yearStores the user's video player preferences using embedded YouTube video
yt-remote-session-app1 yearStores the user's video player preferences using embedded YouTube video
yt-remote-session-name1 yearStores the user's video player preferences using embedded YouTube video
YtIdbMeta#databases1 yearUsed to track user’s interaction with embedded content.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
CookieDurationDescription
BNI_new_persistence1 yearUnclassified
SAVE & ACCEPT
  • Professionals
  • Services
  • Insights & News
    • Announcements
    • Client Alert
    • News
    • Symposium Materials
    • Tips & Tools
    • Viewpoints
  • Events
    • Special Education Symposium
    • Student Services Legal Symposium
  • Our Firm
    • Leadership
    • Locations
  • Careers
    • Our People
    • Job Opportunities
  • Our Culture
  • Civics
  • Contact Us