Sources

Primary law and official guidance first, institutional practice second, and nothing quoted from memory as fact.

• 34 CFR Part 99, FERPA regulations - the federal regulation carrying out the Family Educational Rights and Privacy Act.
• US Department of Education, Student Privacy Policy Office - FERPA guidance, FAQs and model notices.
• US Department of Education, FERPA general guidance - the Department's FERPA pages for schools and colleges.
• 16 CFR Part 312, COPPA Rule - the Children's Online Privacy Protection Rule.
• Federal Trade Commission, COPPA guidance - the FTC's COPPA pages for operators and parents.
• 20 USC 1232h, PPRA - the Protection of Pupil Rights Amendment, statutory text.
• US Department of Education - the Department's guidance, Dear Colleague letters and enforcement information.
• National Center for Education Statistics - federal education data practice and reporting context.
• AICPA, SOC reporting - background on vendor assurance reporting used in contract discussions.
• NIST Computer Security Resource Center - control frameworks cited for security safeguards, used as method, not as law.