Online proctoring can be FERPA compliant when the vendor acts as a "school official" under the institution's control, uses student data only for exam integrity, and follows clear limits on access, retention and disclosure. Compliance depends on the contract and the vendor's practices, not on the technology alone. Accessibility and identity verification rules also apply, and a good vendor helps you meet all three.
Editor's note: this post is general information, not legal advice. Have your counsel review final wording.
The Family Educational Rights and Privacy Act (FERPA) protects student education records. Proctoring recordings, ID images and exam reports tied to a student can count as education records.
FERPA lets schools share records with outside vendors without student consent when the vendor:
- Performs a service the school would otherwise do itself.
- Has a legitimate educational interest in the data.
- Is under the school's direct control for how the data is used and kept.
- Does not re-disclose the data except as the school allows.
In practice, that means your proctoring contract should spell out data ownership, permitted uses, retention periods, deletion on request, and security controls.
The Higher Education Opportunity Act (HEOA) requires accredited institutions that offer distance education to verify that the student who registers is the same student who participates and receives credit. Federal rules list proctored exams as one acceptable method.
Online proctoring with photo ID checks and face capture gives institutions a clear, documented way to meet this requirement for every remote exam.
| Data type | Why it's collected | What to ask your vendor |
| Webcam video | Confirm the student is present and alone | How long is it kept? Who can view it? |
| Audio | Detect voices or assistance | Can it be turned off for certain exams? |
| Screen activity | Detect unauthorized sites or apps | Is it limited to the exam session? |
| Photo ID and face image | Verify identity (HEOA) | Is biometric data stored? Is it shared? |
| Exam reports and flags | Support instructor review | Who owns the reports? |
*Some states regulate biometric data, such as Illinois's Biometric Information Privacy Act (BIPA). Ask whether your vendor creates biometric templates and how it handles consent.
Room scans became a privacy flashpoint after a 2022 federal district court ruling (Ogletree v. Cleveland State University) found that a public university's mandatory room scan violated a student's Fourth Amendment rights. Many institutions now make room scans optional, limit them to high-stakes exams, or skip them. You may want to consider choosing a vendor that lets you configure this per exam.
Public institutions face growing pressure to meet WCAG 2.1 AA accessibility standards under the Department of Justice's 2024 ADA Title II rule.
For proctoring, accessibility includes:
- Extended time and breaks set per student as accommodations.
- Screen reader and assistive technology compatibility.
- Adjustable flag settings so disability-related movements or behaviors are not flagged or reported as a high-priority.
- Clear, plain-language instructions before and during the exam.
- 24/7/365 Human support for students who run into problems.
- Signed agreement naming the vendor a school official under FERPA.
- Written data retention period and deletion process.
- Data used only for exam integrity, never sold or used for advertising.
- Encryption in transit and at rest.
- Configurable room scans, audio and flag rules.
- Accessibility statement or VPAT.
- Clear student-facing privacy notice.
ProctorFree supports FERPA and HEOA requirements for institutions using remote exams with planning, focus, and policies around our retention period, encryption, where data is stored, who can access recordings, and more.
Frequently asked questions
Question: Is online proctoring FERPA compliant?
Answer: Compliance depends on a contract that names the vendor a school official or data processor and limits how student data is used, stored and shared.
Question: Does online proctoring meet HEOA identity verification requirements?
Answer: Yes. Proctored exams are a recognized method for verifying that the enrolled student is the one taking the exam.
Question: How long do proctoring vendors keep exam recordings?
Answer: It varies by vendor and contract. Institutions should set a specific retention period and require deletion afterward.
Question: Can students with disabilities use online proctoring?
Answer: Yes, when the system supports accommodations such as extended time, breaks, assistive technology and adjusted flag settings.
Questions? Speak to a proctoring expert by clicking the button below.