Yes, you can collect permission slips and enrollment forms electronically. FERPA expressly contemplates it, and the operational case is obvious — no lost slips in backpacks, no last-minute scramble before a trip, no retyping emergency contacts.
The harder question is one most guides skip: who is legally entitled to sign? For a child, that isn’t always the adult who filled in the form, and getting it wrong is the failure mode that actually causes problems.
Key takeaways
FERPA permits electronic consent where it identifies and authenticates the signer and shows approval — 34 CFR §99.30(d).
The amended COPPA Rule has been fully enforceable since April 2026, with separate consent now required for third-party disclosure.
In most states a parent cannot waive a child’s right to sue. Permission slips document consent; they don’t bar claims.
Custody arrangements determine who can sign. Build the roles into your records, not into staff memory.
Private schools and tutoring centers are often outside FERPA but still bound by state law and contract.
Student record retention runs long, and for some records very long.
Who can legally sign?
This is the section worth reading twice.
FERPA’s default is that both parents have rights. Absent a court order, state statute or legally binding document specifically revoking them, a school may presume that either parent — custodial or not — may exercise FERPA rights. Many schools assume the opposite and wrongly deny a non-custodial parent access.
But signing authority is different from access rights. A custody order may assign educational decision-making to one parent, both jointly, or allocate specific decisions. A permission slip for an out-of-state trip is a decision; a request for a copy of a report card is access. Different questions, potentially different answers.
Map the roles explicitly. Four distinct categories that staff routinely blur:
Role | What they can do |
|---|---|
Legal guardian / parent with decision-making authority | Sign consents, enrollment, medical authorizations |
Parent with access but not decision-making | Receive records; may not be able to authorize |
Authorized pickup | Collect the child; no signing authority |
Emergency contact | Be contacted; no authority at all |
An emergency contact is not a person who can consent to a field trip. A grandparent on the pickup list is not automatically a guardian. Foster placements, kinship care and guardianship orders each carry their own scope.
Practical build: capture decision-making authority as a structured field at enrollment, request relevant court orders where parents indicate separate households, and route consent requests to the authorized signer rather than to whoever answers email first.
Where both parents must sign, that’s a two-signer flow — see sequential vs parallel signing. Parallel routing is usually right, since neither signature depends on the other.
Rights transfer at 18, or when a student enrolls in postsecondary education at any age. At that point the student, not the parent, holds FERPA rights — which matters for tutoring centers serving high school seniors and for dual-enrollment programs. [LEGAL REVIEW]
FERPA and electronic consent
FERPA permits it. Where FERPA requires signed and dated written consent for disclosure of education records, the regulations at 34 CFR §99.30(d) provide that consent may be given electronically, provided the method identifies and authenticates the person giving it and indicates their approval.
That’s a clear statutory basis — and it sets your requirements. An electronic consent that can’t show who signed and that they approved doesn’t meet it. This is exactly what an audit trail does: how audit trails work.
Who’s covered: FERPA applies to educational agencies and institutions receiving US Department of Education funding. Most public districts are covered. Most private K-12 schools are not, because they don’t receive that funding. Tutoring centers generally aren’t either — though a center contracted by a district may be bound as a school official under the legitimate educational interest exception, with the district’s obligations flowing through the contract.
Not being FERPA-covered doesn’t mean unregulated. State student privacy laws, licensing requirements and your own enrollment contract still apply, and several states have student data privacy statutes broader than FERPA. [LEGAL REVIEW]
Directory information has its own mechanics: annual notification and an opt-out window. If you’re collecting opt-outs digitally, that’s a form with a deadline attached, which suits automated reminders well.
COPPA: now fully enforceable in amended form
If your enrollment or permission system collects information online from children under 13, COPPA applies — and the rule changed recently enough that most published guidance is stale.
The FTC’s amended COPPA Rule was published at 90 FR 16918 on 22 April 2025, took effect 23 June 2025, and carried a general compliance date of 22 April 2026. It has been fully enforceable since April 2026. privacylawnetworkworldwincoder
What changed that matters here:
Separate verifiable parental consent is now required before disclosing a child’s personal information to third parties, alongside written information security programs, data retention limits, and an expanded definition of personal information covering biometrics and government identifiers. The rule requires a separate consent event, not a second checkbox inside the first. globalcompliancemapprivacylawnetwork
New consent methods were added, including knowledge-based authentication and text message verification where used solely to facilitate consent. usercentrics
The school consent pathway. FTC guidance has long recognised that schools can provide consent on parents’ behalf for ed tech used solely for educational purposes. That pathway is narrow — it doesn’t cover commercial use, and the expanded third-party disclosure requirement tightens it further. If your vendor shares data beyond the educational purpose, the school consent route may not cover it.
Retention limits bite here. Indefinite retention of children’s data is no longer defensible. You need a written retention policy and the ability to delete. Ask vendors what theirs is. [LEGAL REVIEW] [VERIFY — recheck before publishing]
What a permission slip actually does
Uncomfortable but important: in most states a parent cannot validly waive a minor child’s claims. The child’s cause of action belongs to the child, and in many states the limitation period doesn’t begin until they reach majority — meaning a claim can arrive fifteen or more years after the trip.
What a permission slip genuinely does:
Documents that the parent was informed of the activity and its risks
Records consent to participate
Captures medical information and emergency authorization
Waives the parent’s own derivative claims, in some states
Establishes who authorized what, and when
Those are real and worth having. Barring the child’s claim isn’t reliably among them.
So the slip is one layer. Supervision ratios, staff training, transport safety, insurance and incident procedures do the protective work. A liability waiver template gives structure, but have counsel adapt it — enforceability varies sharply by state and several states are hostile to pre-injury releases in recreational and youth contexts. [LEGAL REVIEW]
Medical authorizations deserve their own form
Permission to administer medication, authorization for emergency treatment, allergy action plans and care plans are distinct documents with distinct requirements.
Many states require a physician signature alongside the parent’s for medication administration, which makes this a multi-party signing flow.
Licensing rules often specify content and format for childcare medical forms, and some require originals on site and available for inspection.
Keep health information access-controlled. Most schools and daycares aren’t HIPAA covered entities, so this is a state data law and duty-of-care question rather than HIPAA — but collecting an allergy disclosure and not acting on it is worse than not collecting it.
Have a documented response path for every red flag your forms can surface. [LEGAL REVIEW]
Enrollment paperwork, by setting
Daycares and childcare centers. State licensing typically prescribes an enrollment packet: enrollment agreement, immunization records, emergency medical authorization, handbook acknowledgment, authorized pickup list. Some states specify content, retention and on-site availability. Check your licensing rules before digitizing, since a responsive form that reflows required disclosures can fail a formatting requirement the paper version met.
Schools. Annual registration, handbook and acceptable use acknowledgments, directory information opt-out, media release, device agreements. High volume, fixed calendar — ideal for bulk send, where one template goes to every family and each returns an individual signed record.
Tutoring centers. Service agreements, payment and cancellation terms, photo release, and — if you’re enrolling students the family will pay for on a recurring basis — auto-renewal disclosure requirements under state law. A service agreement from the template library covers the commercial side.
Special education. IEP-related consents carry their own procedural requirements under IDEA — prior written notice, consent for evaluation, procedural safeguards. Don’t fold these into a general consent flow. [LEGAL REVIEW]
Photo and media release: keep it separate and revocable
Schools and centers post student images constantly. A general enrollment acknowledgment rarely covers it properly.
Make it a distinct, specific consent — which platforms, what contexts, whether names appear alongside images — and make it revocable, with a process that actually removes content when someone revokes. For FERPA-covered schools, photo use intersects with directory information rules.
For children, err toward narrow consent and short retention.
Getting forms to parents and back
Deliverability is the main operational failure. A permission slip that lands in spam looks identical to a parent who forgot. Authenticate your sending domain before the first mass send: sending from your own domain and why emails land in spam.
Tell families what to expect. A mass email asking parents to click a link and sign something is indistinguishable from phishing — see spotting fake signature requests and phishing protection. Announce the system before the first send, and tell parents what your real requests look like.
Language access. Title VI requires meaningful access for parents with limited English proficiency, and Section 504 and the ADA cover accessibility. Digital forms must be translated and screen-reader usable. Moving online doesn’t relax this, and a poorly built form can create a barrier paper didn’t. [LEGAL REVIEW]
Phones, not laptops. Most parents will sign on a phone, often in a hurry. Minimise required fields: forms and fields that get signed and signature field placement.
Offer a paper route. Not every family has reliable connectivity or a device. A digital-only process can exclude people, and in some contexts that’s a compliance issue rather than an inconvenience.
Connect to your SIS or management system. If signed forms don’t attach to the student record automatically, staff still check manually at the bus door: integrations.
Retention
Student records retention is set by state law and runs long. Some categories — immunization records, special education files, cumulative records — are held for years after a student leaves, and in some states into or past their twenties.
Permission slips involving minors need long retention for the reason above: the limitation period may not start until majority. How long to keep signed documents covers the framework, though education-specific periods are governed separately.
Set retention at signing, and reconcile it against COPPA’s retention limits where children’s data is involved — those pull in opposite directions and need deliberate handling. [LEGAL REVIEW]
Common mistakes
Accepting a signature from whoever replies, rather than the authorized signer.
Assuming a non-custodial parent has no rights. FERPA’s default is that they do.
Treating an emergency contact as a signer.
Believing a permission slip bars a child’s claim. In most states it doesn’t.
Bundling medical, media and activity consent into one form.
Running on stale COPPA guidance that predates April 2026.
Ignoring licensing format requirements when digitizing.
No paper alternative.
English-only forms.
Short retention on minors’ records.
FAQ
Are digital permission slips legal?
Yes. FERPA expressly permits electronic consent at 34 CFR §99.30(d) where the method identifies and authenticates the signer and indicates approval. State licensing rules may add format requirements.
Who is allowed to sign a permission slip?
A parent or guardian with educational decision-making authority. Custody orders can allocate that, so capture it at enrollment. Emergency contacts and authorized pickups have no signing authority.
Does a non-custodial parent have rights?
Under FERPA, generally yes — schools may presume either parent can exercise rights absent a court order or statute revoking them. Decision-making authority is a separate question from access.
Does a permission slip stop a parent suing?
Not reliably. In most states a parent can’t waive a child’s claims. The slip documents informed consent and may waive the parent’s own derivative claims.
Does COPPA apply to our enrollment forms?
If you collect information online from children under 13, yes. The amended rule has been fully enforceable since April 2026 and requires separate consent for third-party disclosure, a written security program and retention limits.
Are private schools covered by FERPA?
Usually not, since FERPA follows Department of Education funding. State law, licensing and your enrollment contract still apply.
When do rights transfer to the student?
At 18, or on enrolling in postsecondary education at any age.
How long do we keep signed forms?
Per state education retention rules, which run long. For permission slips involving minors, plan for retention beyond the child reaching majority.
