SAT Score Confidentiality
The Family Educational Rights and Privacy Act (FERPA) is a 1974 federal law that offers some protections for student data, including SAT scores. FERPA applies to all schools that receive federal funding, and it gives students and parents certain rights over educational records. Under FERPA, schools must permit students and parents to view the educational records that they maintain, and the circumstances under which student information may be released without student consent are limited. Some organizations and individuals may receive student data because they are seen to have good reasons for accessing that information. These include schools with "legitimate educational interest," institutions to which a student transfers, "specified officials for audit or evaluation purposes" (for example, professors may discuss student grades with each other), "appropriate parties in connection with financial aid to a student," "organizations conducting certain studies for or on behalf of the school," organizations in charge of school accreditation, compliance with judicial order, "appropriate officials in cases of health and safety emergencies," and state and local juvenile justice authorities. FERPA allows schools to disclose "directory" information (name, address, telephone number, date of birth, dates attended, and honors and awards) without student consent, but schools must first allow students and parents a certain amount of time to request that this information remain private. SAT scores are defined as education records under FERPA, and are thus offered the law's protections. Unauthorized release of data can be punished by a five-year ban on access to education records for the offending institutions or individuals. More information about FERPA is available from the Family Policy Compliance Office (FPCO) at the U.S. Department of Education.
The College Board itself is not a school, and this fact has raised questions about its receiving and disclosing of student information under FERPA. A 2015 FPCO decision, for example, affirmed that the College Board is neither a school district nor the representative of a school district and is therefore not entitled to receive student information without student consent. However, the members of the College Board are educational institutions, and this generally means that FERPA protections apply to the College Board's activities. The College Board has developed its own policies with respect to privacy of student data, and these policies are intended to comply with FERPA. College Board privacy practices revolve around the stated principle of "collect[ing] personal information only to administer tests and deliver educational opportunities to students." Students and parents are given some discretion over how much information to provide, but they must comply with registration policies as well as any required financial aid disclosures. The College Board says that they "only share student information for educational purposes," and they also assert that they do not sell student data. Students may voluntarily provide their scores or other academic records as part of the College Board's Student Search Service, which allows colleges to use this information for recruiting. The College Board will consider requests for aggregate data (without identifying student information) for reasons such as the conducting of research or providing assistance to policymakers. Individually identifiable student information will usually not be released without the consent of the student, but exceptions may be granted for state departments of education who specify how they will use the data.
Although FERPA protections apply to federally-funded schools and some other entities that are devoted to education, most states do not regulate college testing organizations. Among the exceptions are California and New York, both of which have passed laws that explicitly forbid testing entities from releasing test scores without student consent, and California test-takers must be provided with an easily understandable written description of the testing entity's promises with respect to student privacy. Additionally, a Connecticut privacy law that took effect in 2005 prohibits any individual, business, or other entity from publicly releasing anyone's Social Security number.
Student SAT scores are generally confidential aside from a narrow range of exceptions, and the institutions to which individual SAT scores are sent are therefore largely matters of student choice. The College Board offers two options for the sending of scores: internet delivery, and paper score reports. Students also have considerable control over what information is sent to their prospective colleges, but individual institutions have their own requirements in terms of score reporting. Students are advised to become familiar with the relevant policies of all colleges and universities that they are considering.