Hey, welcome to VoraPrep Audio. Glad you could tune in.
Today we're talking about a mix of privacy laws that can feel a little disconnected, but the exam loves to weave them together in a single scenario. Think about a school district. They have student records, right? But they also send text alerts to parents, and maybe they use some third-party educational app for kids. Suddenly, you're juggling three or four different federal laws at once. That's what we're going to untangle today.
So let’s start with the classic school scenario. The big law here is FERPA, the Family Educational Rights and Privacy Act. Think of FERPA as the guardian of a student’s official school file. It protects what’s called an “education record.” That’s pretty much anything the school keeps that’s directly related to a student. Grades, disciplinary notes, you name it.
The whole point of FERPA is to give parents, and eventually students themselves, control over that information. Once a student turns 18 or starts college, they become an "eligible student," and those rights transfer to them. What rights? The right to see their records, the right to ask for corrections, and most importantly, the right to say who gets to see their records. The default is: the school can’t share that info without consent.
But. There are always exceptions, and you need to know them. The big one for the exam is the "school official" exception. A school can share records with its own teachers, of course, but it can also share them with a third-party company—like an online learning platform—if that company is performing a service the school would otherwise do itself. The key is that the company has to be under the school's direct control and have a legitimate educational interest. It's not a free-for-all for any vendor who works with a school. Another one is "directory information"—stuff like a student's name or address. Schools can release that, but they have to give parents a chance to opt out first.
Okay, so that’s FERPA for students in a school context. But what about kids online, just on their own?
That’s where COPPA comes in. The Children's Online Privacy Protection Act. This is all about protecting the personal information of kids under 13. If you run a website, an app, a game—anything online that is "directed to children under 13"—you have to follow COPPA. And this is a big exam trap: it also applies if you run a general audience site but you have *actual knowledge* that you're collecting data from kids under 13. You can't just play dumb.
So what does COPPA demand? The absolute core of it is verifiable parental consent. Before you collect, use, or share any personal info from a young child, you have to get permission from their parent. And it has to be a real, verifiable permission, not just a kid clicking "I agree." You also have to post a clear privacy policy and give parents the right to see and delete their child's data. The Federal Trade Commission, or FTC, is the main enforcer here, and they take it very seriously.
Now let’s shift from education and kids to how companies can contact *us*. All those marketing calls, texts, and emails.
First up, for calls and texts, you’ve got the TCPA, the Telephone Consumer Protection Act. This law is basically trying to stop your phone from blowing up with unwanted robocalls and robotexts. It puts major restrictions on using an autodialer or a prerecorded voice. The rule is simple: for most of these calls to your cell phone, they need your “prior express consent.”
And if it's a marketing call, the standard is even higher. They generally need "prior express *written* consent." That's a huge distinction. Informational call, like a flight delay alert? Express consent might be enough. But a call trying to sell you something? They need that written permission. The TCPA also requires companies to keep their own internal do-not-call list and respect the National DNC Registry. This one’s enforced by the Federal Communications Commission, the FCC, and—importantly—people can also sue directly, which is why the penalties can add up fast.
So that’s calls and texts. What about email? For that, we have the CAN-SPAM Act. It’s a mouthful: Controlling the Assault of Non-Solicited Pornography and Marketing Act. This law doesn't ban commercial email, it just sets the rules for it.
Think of it as the "unsubscribe button" law. Every commercial email has to give you a clear and easy way to opt out, and the company has 10 business days to honor your request. Simple. But there’s more. The email can't have a deceptive subject line or false header info. It has to be clearly identified as an ad. And—this one’s easy to forget—it must include the sender's valid physical postal address. The FTC is the primary enforcer here too.
Alright, just two more. These are a little more specific.
Have you ever thought about how private your Netflix viewing history is? That's where the VPPA comes in, the Video Privacy Protection Act. This is an older law, passed back when everyone was renting movies from Blockbuster. It says that "video tape service providers" can't disclose your PII about what you've rented or bought without your informed, written consent.
Now, an exam isn't going to ask you about VHS tapes. They'll test you on how the VPPA applies today. Courts have extended it to cover streaming services, online platforms, and apps that track your video viewing habits. So if a company wants to share your binge-watching history, they need your explicit permission.
And finally, the big one that covers all sorts of digital communication: ECPA, the Electronic Communications Privacy Act. This is actually a bundle of a few laws, but it breaks down into two main parts you need to know.
First is the Wiretap Act. This protects communications in real-time. It prohibits anyone from intercepting your live phone calls, video chats, or emails as they're in transit without a warrant. Think of it as protecting a sealed letter *while it's in the mail*.
The second part is the Stored Communications Act, or SCA. This protects communications that are in storage. Think of emails sitting on a server, files in the cloud, or direct messages in your social media account. The SCA prevents the government from just grabbing that data without following proper legal procedures—like getting a warrant or a special court order. It also stops private parties from hacking into those stored accounts. So, Wiretap Act for live interception, SCA for stored data. That’s the key distinction.
Okay, so when you're looking at a question, how do you sort through all this? It's a simple process. First, just ask: who is this about, and what's happening? Is it a student? A child under 13? A consumer getting a text?
Then, what kind of data is it? An education record? Online data from a kid? A commercial email? Video history? Based on that, you can pinpoint the right law. If it's a school's gradebook, you're thinking FERPA. If it's a game for seven-year-olds, you're thinking COPPA. An automated marketing text? TCPA. A promotional email? CAN-SPAM. And so on. Once you have the right law, you just have to apply its specific rule about consent or opt-out.
Let's try one. A school district uses a third-party app to manage student health records and grades. The vendor, who is acting for the school, has a data breach. Under FERPA, did the school need to get parental consent just to let the vendor access that data in the first place?
Pause and think.
The answer is no, probably not. As long as that vendor qualifies under the "school official" exception—meaning they have a legitimate educational interest and are under the school's control—the school can share the data without specific consent for that disclosure. The school is still responsible for that data, of course, but the initial sharing is allowed. That's a classic exam question, testing an exception.
Here’s another one. A social media site for adults finds out a bunch of its users are actually 11 and 12 years old. The site collects their location data. What does COPPA require them to do *immediately*?
The second they have that "actual knowledge," they fall under COPPA. Their immediate duty is to get verifiable parental consent. If they can't get it, they must delete all the personal information they have for those kids. They can't just block the accounts; they have to get rid of the data.
So to recap, just remember the core idea for each one. FERPA is about a student's education records. COPPA is about getting parental consent for kids under 13 online. TCPA is about getting your consent for robocalls and texts. CAN-SPAM is about your right to opt-out of commercial emails. VPPA protects your video viewing history. And ECPA protects your electronic communications, both in transit and in storage.
Keeping those straight is half the battle. If you want to run through more practice questions and really lock this down, we have a ton of them in the VoraPrep app. It's got lessons, thousands of questions, and even an AI tutor to help you work through tricky spots. You can try it out for free at Vora Prep dot com.
This stuff can feel like alphabet soup, but once you connect each law to a real-world situation—a report card, a kid's game, an unwanted text—it starts to click. You've got this.
Keep up the great work, and I'll catch you on the next one.