What FERPA Requires for Student Recordings
The Family Educational Rights and Privacy Act, enacted in 1974, protects the privacy of student education records. FERPA applies to all educational institutions that receive funding from the United States Department of Education, which includes virtually every public school district and most colleges and universities in the country. The law gives parents and eligible students the right to access education records, the right to request corrections to those records, and the right to control the disclosure of personally identifiable information from those records.
Under FERPA, education records are defined broadly as records that are directly related to a student and maintained by an educational agency or institution, or by a party acting for the agency or institution. This definition encompasses far more than traditional paper transcripts and report cards. It includes video recordings of student performances, assessments, and disciplinary incidents. It covers audio recordings of IEP meetings, student interviews, and counseling sessions. It extends to lecture recordings that capture student participation, questions, and discussions.
The critical FERPA requirement for file conversion is that personally identifiable information from education records may not be disclosed to third parties without prior written consent from the parent or eligible student, subject to limited exceptions. When a school employee uploads a video containing student information to a cloud-based conversion service, they are disclosing that information to a third party. Unless the service qualifies under the school official exception or another FERPA exception, this disclosure violates the law.
The school official exception allows disclosure to contractors and other parties to whom the institution has outsourced functions, but only if the party is performing a service that the institution would otherwise use employees to perform, the party is under the direct control of the institution, and the party is subject to FERPA requirements governing the use and redisclosure of education records. Online file conversion services generally do not meet these conditions. They are not under the direct control of the institution, and they are not subject to FERPA requirements regarding the handling of education records.
Violations of FERPA can result in the loss of federal funding, which is the most severe sanction available. While the Department of Education's Family Policy Compliance Office typically works with institutions to resolve complaints through voluntary compliance, the theoretical loss of federal funding represents an existential threat to any educational institution. Beyond federal enforcement, FERPA violations can generate negative publicity, erode community trust, and expose the institution to state-level data privacy enforcement actions.
Types of Student Videos That Need Conversion
The range of video and audio content that educational institutions produce and manage has expanded enormously with the growth of digital learning, remote education, and campus technology. Each type of recording carries specific FERPA considerations that affect how it should be handled during format conversion.
Lecture capture recordings are among the most common video assets at colleges and universities. Systems like Panopto, Kaltura, Echo360, and YuJa record classroom sessions, including student questions and participation, and store them for on-demand viewing. When these recordings need to be migrated between platforms, archived in different formats, or extracted for specific purposes, format conversion is necessary. Because lecture captures often show student faces, record student voices, and capture student names spoken by the instructor, they contain personally identifiable information protected by FERPA.
IEP meeting recordings are particularly sensitive. Individualized Education Program meetings involve discussions of a student's disabilities, academic performance, behavioral challenges, and the specific accommodations and services the school will provide. These recordings are education records under FERPA and are also protected by the Individuals with Disabilities Education Act. Audio recordings of IEP meetings may need conversion for storage, transcription, or sharing with team members, and the sensitivity of the content demands the highest level of privacy protection.
Student assessment videos, including recorded presentations, performance assessments in music, theater, and physical education, and video portfolios submitted as coursework, are education records that institutions must protect. When these files need conversion for grading system compatibility, archival storage, or portfolio review, the conversion process must not expose the content to unauthorized parties.
Campus security and safety footage from surveillance cameras, classroom cameras, and other monitoring systems may capture student activity and become part of a student's education record if the footage is used in a disciplinary proceeding or is directly related to a specific student. Schools that need to convert surveillance footage for review, sharing with law enforcement under appropriate exceptions, or long-term storage must ensure the conversion process maintains the security of the content.
Student counseling and behavioral intervention recordings, where they exist, are among the most sensitive records a school maintains. Recordings of counseling sessions, threat assessment interviews, and behavioral intervention meetings contain deeply personal information about students and their families. These files require the most rigorous privacy protections during any handling process, including format conversion.
Remote learning recordings from the pandemic era and ongoing virtual learning programs capture students in their home environments, potentially revealing personal information about their living situations, family members, and circumstances. Many schools are still archiving and organizing these recordings, and format conversion is a common step in that process.
Why Cloud Converters Fail the FERPA Test
Cloud-based file conversion services fail to meet FERPA requirements in several fundamental ways that make them inappropriate for handling student education records.
The most basic problem is that uploading a file containing student information to a cloud service constitutes a disclosure to a third party. Under FERPA, this disclosure requires either prior written consent from the parent or eligible student, or the applicability of a specific exception. The school official exception, which is the most commonly invoked, requires that the service provider be under the direct control of the institution and be subject to FERPA requirements. Free online conversion services and most commercial conversion tools do not meet these criteria. They operate independently, their terms of service do not incorporate FERPA obligations, and the institution has no direct control over how the uploaded data is handled.
Data retention practices at cloud conversion services are incompatible with FERPA's requirements. Many services retain uploaded files on their servers for troubleshooting, analytics, or product improvement purposes. Even services that claim to delete files immediately after processing may retain server logs, backups, or metadata that could identify students. Under FERPA, the institution is responsible for ensuring that its service providers do not maintain education records beyond what is necessary for the purpose for which the records were disclosed.
The lack of audit and access controls at cloud conversion services creates another compliance gap. FERPA requires institutions to maintain reasonable methods to ensure that school officials only access education records in which they have a legitimate educational interest. When a file is uploaded to a cloud service, the institution cannot verify who at the service provider has accessed the file, whether it has been copied, or whether it has been shared with other parties.
State student data privacy laws, which have proliferated across the country, add additional requirements beyond FERPA. Laws such as the Student Online Personal Protection Act in California, the Student Digital Privacy Act in various states, and comprehensive state data breach notification laws impose obligations on both schools and third-party service providers. Many of these laws require specific contractual provisions, data security assessments, and breach notification procedures that cloud conversion services do not support.
ConvertFree addresses all of these concerns by keeping files on the user's device. There is no upload, no third-party disclosure, no data retention on external servers, and no access by service provider employees. The conversion runs locally using WebAssembly, and the file remains under the school's control from start to finish.
Practical Workflows for Schools and Universities
Implementing FERPA-compliant file conversion workflows varies depending on the type of institution, the volume of files, and the technology infrastructure available. Here are practical approaches for different educational settings.
For K-12 school districts, the typical workflow involves classroom teachers, special education coordinators, and administrative staff who occasionally need to convert video or audio files. The most common scenarios include converting IEP meeting recordings from the format produced by the recording device to a format compatible with the district's document management system, converting student presentation videos for grade book systems, and converting surveillance footage for review by administrators or school resource officers.
A practical K-12 workflow begins with the staff member opening ConvertFree in their browser on a district-managed device. They select the source file, choose the target format, typically MP4 for video or MP3 for audio, and process the conversion. The converted file is then saved to the district's secure storage system or attached to the relevant student record. Because the file never leaves the device during conversion, the process is compliant without requiring any special procedures or approvals.
For colleges and universities, the workflow is often more complex due to the larger scale of video operations and the involvement of multiple departments. The most common scenarios include converting lecture recordings for migration between learning management systems, converting student-submitted video assignments for compatibility with grading platforms, converting research interview recordings for analysis, and converting recorded presentations from conferences and colloquia.
University IT departments can incorporate ConvertFree into their approved tools catalog and provide guidance to faculty and staff on when to use it. For lecture capture systems, the IT team can establish standard procedures for converting recordings that need to move between platforms. For student services, counseling centers can use the tool to convert session recordings without involving IT staff or third-party services, maintaining the confidentiality that counseling relationships require.
For both K-12 and higher education, training should emphasize two key points. First, any recording that contains identifiable student information should be treated as an education record under FERPA. Second, education records should never be uploaded to cloud services that are not covered by an appropriate data sharing agreement. Browser-based conversion is the recommended alternative because it requires no data sharing agreement, no vendor assessment, and no IT infrastructure.
Campus Security Footage and Special Considerations
Campus security footage occupies a unique position under FERPA and requires special attention when conversion is needed. The general rule is that surveillance footage is not an education record simply because students appear in it. However, the footage becomes an education record if it is directly related to a student and maintained by the institution. This typically occurs when footage is pulled for a disciplinary investigation, included in a student's conduct file, or used as evidence in a proceeding related to a specific student.
Once surveillance footage becomes part of a student's education record, it is subject to FERPA protections, including restrictions on disclosure and the student's or parent's right to access the record. This transition from general surveillance footage to education record can happen at any point, which means institutions should treat all surveillance footage with the same level of care to avoid inadvertent FERPA violations.
Security camera systems produce video in a wide variety of formats depending on the manufacturer and model. Older systems may use proprietary formats that require specific software to view. Newer systems typically produce MP4 or H.264 streams, but some use H.265, MJPEG, or other formats. When footage needs to be reviewed on devices that do not support the camera's native format, shared with law enforcement, or preserved for legal proceedings, conversion is necessary.
The sensitivity of security footage extends beyond FERPA. Campus security recordings may capture incidents involving violence, medical emergencies, drug or alcohol use, or other situations that students and families expect to remain confidential. In the context of Title IX investigations, security footage may capture incidents of sexual harassment or assault that are subject to strict confidentiality requirements under federal law.
School resource officers and campus police departments that need to share footage with external law enforcement agencies must ensure that the conversion and sharing process complies with FERPA's law enforcement exception. This exception allows disclosure of education records to law enforcement without consent in specific circumstances, but the institution must still protect the records from unnecessary exposure during the conversion process.
Using ConvertFree for security footage conversion ensures that the video remains on the security team's device throughout the process. This is particularly important when footage is being prepared for a disciplinary hearing, a Title IX proceeding, or a law enforcement request, situations where maintaining strict chain of custody and confidentiality is critical.
Future-Proofing Student Data Privacy
The landscape of student data privacy is evolving rapidly, and educational institutions should adopt practices today that will remain compliant as regulations tighten. Several trends are shaping the future of student data privacy and have implications for file conversion practices.
State legislatures continue to pass new student data privacy laws at a rapid pace. As of 2025, nearly every state has enacted some form of student data privacy legislation beyond what FERPA requires. Many of these laws impose specific requirements on third-party service providers, including data minimization, security assessments, and breach notification obligations. As these laws become more stringent, the compliance burden of using cloud-based tools for files containing student data will only increase. Browser-based conversion tools that process data locally sidestep these requirements entirely.
The Federal Trade Commission has increased its enforcement activity around children's privacy under the Children's Online Privacy Protection Act, or COPPA. While COPPA primarily applies to commercial websites and services that collect data from children under 13, its intersection with FERPA creates additional obligations for K-12 schools that use online services. The FTC has signaled its intent to hold schools and their service providers to higher standards, making the use of unknown cloud services for student files increasingly risky.
Parent and community expectations around student data privacy are rising. High-profile data breaches at educational technology companies have made parents more aware of how student data is collected, processed, and shared. Schools that can demonstrate they use privacy-first tools that keep student data on district-managed devices are better positioned to maintain community trust.
The growth of AI and machine learning has introduced new concerns about how data uploaded to cloud services may be used. Some online services use uploaded content to train AI models, which could mean that student recordings uploaded for conversion could be incorporated into training datasets without the school's knowledge or consent. Browser-based tools that process data locally cannot use the data for any purpose because they never receive it.
By adopting browser-based conversion tools like ConvertFree now, educational institutions establish a practice that is compliant with current law, consistent with evolving state requirements, aligned with increasing community expectations, and protected against future regulatory changes. The simplicity of the approach, files stay on the device, makes compliance easy to explain to parents, auditors, and regulators alike.