I rarely hear of students signing FERPA release forms when asking for letters of recommendation. Yet letters of recommendation commonly talk about student's performance in a class, projects they did in a class, their GPA/courseload, etc. Mentioning such things imply that a student took a given class (which I understand to be something protected by FERPA).
Are letter writers just assuming students asking for letters are implicitly waiving their FERPA rights?
You’re supposed to ask each student to explicitly waive their FERPA rights via a written form before writing a letter. For example, see this explainer. This is highly impractical, and my impression is that 99% of faculty ignore this and just write letters that don’t follow FERPA anyway. It’s a very annoying and unsatisfying situation.
As an initial disclaimer, I am a professor, not a lawyer, so my position here certainly should not be relied on as legal advice. FERPA is a law in the United States with potentially harsh penalties (generally falling on the University) for violations. I have formed these opinions reading articles on the Department of Education website, directives from my university, and questions on this stack.
There is little or nothing I could write in an undergraduate or masters-level letter of recommendation absent a FERPA waiver. All of my interactions with these students are somehow related to their academic record. I could confirm directory information about a student, but as a faculty member, I am not the responsible party for confirming that information. Further, since I only teach a couple of undergraduate courses, even confirming I know a student would likely reveal protected information on their academic record.
The case is slightly different for PhD students who are entering the job market. Lack of a FERPA waiver would certainly restrict what I write. However, these letters usually contain objective evaluations of the student's research, which in my field will be at least public working papers by the time I write the letter. I feel that I could discuss my impressions of these papers without disclosing details of that student's academic record. I may (I am not sure) also be able to comment on details of their employment for me as a research assistant or teaching assistant. Again, these points are moot in my case because I require a waiver as a prerequisite to providing recommendations.
I will add that I am likely an exception in that I require any student I write a recommendation for provide a completed FERPA waiver prior to my writing the letter. I further include a notice at the end of each letter that I have provided the information in the letter under a waiver of FERPA rights. Anyone writing a letter for someone they knew as a student in a US university should be doing these things, but I am under the impression many don't.
